Assistant Reliability Watchtower

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:45 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed repo-backed reliability wrapper that runs fixed ARW commands and writes expected monitoring artifacts.

Install this only if you intend to run ARW against a trusted local checkout. Review any real alert recipient and out_dir values before enabling immediate alerts or non-dry-run delivery, because the wrapper delegates those effects to the ARW repository configuration.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _env(repo_root: Path) -> dict[str, str]:
    env = os.environ.copy()
    existing = env.get("PYTHONPATH", "")
    env["PYTHONPATH"] = str(repo_root) if not existing else f"{repo_root}:{existing}"
    return env

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs operators to run a local Python wrapper and explicitly references shell execution, environment variables, and file access, but it declares no tool scope or permissions boundary in the skill manifest. That mismatch increases the chance the skill will be executed with broader-than-necessary capabilities, making unintended command execution, repository writes, or environment exposure more likely in a host agent framework.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run(command: list[str], repo_root: Path) -> int:
    result = subprocess.run(command, cwd=repo_root, env=_env(repo_root))
    return result.returncode

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_capture(command: list[str], repo_root: Path) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        command,
        cwd=repo_root,
        env=_env(repo_root),

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.