Security audit

gate-switch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed verification tool, but it can run arbitrary shell commands from user or agent-generated spec files without guardrails.

Install only if you will review every spec before running it, especially any script_exit check. Prefer project-local or disabled logging when paths or bindings are sensitive, and avoid using this on specs produced from untrusted prompts or third-party content unless command execution is removed or tightly allowlisted.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (9)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: ok = os.path.getmtime(c["path"]) > os.path.getmtime(c["ref_path"]) return ok, f"{label}: 产物{'新于' if ok else '不新于'}参照" if t == "script_exit": r = subprocess.run(c["cmd"], shell=True, capture_output=True, text=True, timeout=300) expect = c.get("expect", 0) ok = r.returncode == expect tail = (r.stdout or r.stderr).strip().splitlines()
Confidence: 99% confidence
Finding: The script executes spec-provided commands with subprocess.run(..., shell=True), so anyone who can influence the spec can run arbitrary shell commands in the agent's environment. In this skill's context, specs are expected to be generated dynamically from workflow claims, which makes this especially dangerous because untrusted or prompt-influenced inputs can cross directly into code execution.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly instructs users to run a local Python script, read arbitrary files and globs, execute shell commands via the `script_exit` check, and append logs to `~/.agents/logs/gate_switch.jsonl`, yet it declares no permissions. This mismatch can cause an agent or reviewer to underestimate the skill's capabilities, especially because the spec format allows attacker-controlled paths and commands to be supplied at runtime.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The engine's stated purpose is mechanical claim verification, but script_exit allows arbitrary command execution defined by the spec, expanding it into a general-purpose executor. That means a crafted spec can perform filesystem access, network calls, or destructive actions under the guise of verification.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: Including a generic external command execution primitive materially broadens the skill beyond a narrow verification engine into a capability that can execute arbitrary system behavior. In an agent setting, such hidden capability expansion increases the chance that prompt-controlled data or unreviewed specs become an execution path.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The documentation promises mechanical verification and removal of handwritten judgment, but script-based checks can embed arbitrary logic and side effects that are neither transparent nor purely mechanical. This mismatch can mislead operators into trusting the tool as a passive verifier when it can actually execute active behaviors.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The engine executes shell commands from specs without any explicit warning, approval step, or trust boundary indicator to the user. In agent workflows, silent execution increases the likelihood of unsafe operation because users may believe they are invoking a read-only verifier rather than a command runner.

Unvalidated Output Injection

High

Category: Output Handling
Content: ok = os.path.getmtime(c["path"]) > os.path.getmtime(c["ref_path"]) return ok, f"{label}: 产物{'新于' if ok else '不新于'}参照" if t == "script_exit": r = subprocess.run(c["cmd"], shell=True, capture_output=True, text=True, timeout=300) expect = c.get("expect", 0) ok = r.returncode == expect tail = (r.stdout or r.stderr).strip().splitlines()
Confidence: 98% confidence
Finding: This is an output-to-execution injection path: data from the spec field c['cmd'] is fed directly into a shell command. Because shell metacharacters are interpreted by the shell, an attacker can inject additional commands, redirect output, exfiltrate data, or alter the environment.

Session Persistence

Medium

Category: Rogue Agent
Content: --- name: gate-switch description: "Claim-verification gate engine for LLM agent workflows. Whenever an agent claims 'X is done / written / synced / verified', write X as a spec JSON of mechanical checks; the engine verifies each check and returns a verdict (A=pass / B=block with violations / CLARIFY / VIOLATION). Cures three chronic LLM failures: skipped work, partial delivery, fabricated claims. 声称 X 已满足，就机械核验 X——判定禁止手写，照抄输出。" --- # gate-switch — Claim-Verification Gate Engine / 声称即核验门禁引擎
Confidence: 79% confidence
Finding: The skill advertises persistent audit logging to `~/.agents/logs/gate_switch.jsonl`, which creates session persistence outside the immediate task context. Persistent logs can retain sensitive filenames, command details, verification targets, or other workflow metadata across sessions, increasing privacy and data-retention risk if users are not clearly warned and given control.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ok = os.path.getmtime(c["path"]) > os.path.getmtime(c["ref_path"]) return ok, f"{label}: 产物{'新于' if ok else '不新于'}参照" if t == "script_exit": r = subprocess.run(c["cmd"], shell=True, capture_output=True, text=True, timeout=300) expect = c.get("expect", 0) ok = r.returncode == expect tail = (r.stdout or r.stderr).strip().splitlines()
Confidence: 99% confidence
Finding: The tool accepts a spec-controlled parameter and uses it as a shell command, enabling tool parameter abuse. Since this skill is designed to process generated specs around agent claims, the trust boundary is weak and the command channel can be abused for arbitrary code execution with the agent's privileges.

Static analysis

No suspicious patterns detected.