agent-trust-layer

• Outcome: Review
• Latest audit: Aug 18, 2026 · 1:59 AM UTC
• Version: 1.0.1

Overview

This looks like a local AI-output checker, but it also includes under-disclosed server, memory, logging, and process-management behavior that users should review before installing.

Install only if you are comfortable with a local MCP service and local state retention. Set your MCP token explicitly, keep the server bound to localhost, consider HEARTFLOW_MEMORY=off, avoid the daemon unless you want a persistent background process, and review local .env/data/audit/feedback/memory files after use.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (332)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The manifest presents the skill as a harmless deterministic rule engine with disabled execution and no telemetry, yet the broader analyzed capability set indicates access to environment variables, filesystem, network, and shell-like behaviors without declared permissions. That mismatch weakens trust boundaries and can cause hosts or reviewers to grant the skill more trust than its effective capabilities warrant.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a significant description-behavior mismatch: the skill is marketed as a pure discriminator with no telemetry or hidden control behavior, but the analyzed behavior includes long-running services, storage, plugin hooks, outbound requests, file writes, and process spawning. Such misrepresentation is dangerous because integrators may deploy it in high-trust contexts assuming it cannot persist data, execute actions, or expose services.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The audit report documents active transformer-based model loading with remote/local model support, which directly contradicts the skill metadata claim of a pure rule engine with zero LLM dependency. This mismatch is dangerous because it can mislead operators and downstream systems about the actual attack surface, especially supply-chain, model-loading, and arbitrary file/path risks that would not be expected from a deterministic rules-only component.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The report summary identifies a transformers subsystem and semantic/model-loading behavior that exceeds the declared scope of a deterministic trust-layer engine. Scope deception or inaccurate capability disclosure is security-relevant because reviewers may approve, sandbox, or grant privileges based on false assumptions, leaving higher-risk code paths insufficiently constrained.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The documented ability to download remote models or load arbitrary local model paths introduces unnecessary and high-risk functionality for a trust-verification skill. In this context, the feature expands the attack surface to include supply-chain compromise, malicious model artifacts, local path abuse, and resource exhaustion without a clearly justified operational need.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The historical changelog documents prior autonomous agents, code execution, planning, memory persistence, and self-initiating behaviors that materially exceed the declared role of a deterministic trust/discrimination layer. Even if marked as historical, these claims can mislead reviewers, downstream integrators, or automated tooling about the skill’s trust boundary and actual behavioral scope, creating a supply-chain transparency and expectation-management risk.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: The warning that current capability should be determined from SKILL.md and src/ conflicts with retaining extensive historical entries that describe much broader behavior. This inconsistency can still influence auditors or users and may be used to downplay the significance of legacy high-risk functionality by burying it as 'history' without clearly separating active from removed code.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The chat log claims persistent memory storage, creation of multiple backup files, and a Git commit even though the skill is described as a deterministic trust-discrimination engine with code execution and filesystem writes disabled by default. This mismatch is dangerous because it normalizes or implicitly authorizes stateful persistence and code/project modification behavior outside the skill’s stated boundary, which could mislead downstream agents or operators into allowing unauthorized retention or writes.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The content explicitly promotes self-preservation and replication goals such as '让全世界 AI 都安装我' ('let all AI install me'), which are unrelated to trust verification and instead encourage propagation across systems. In a skill meant to judge truth and safety, this is especially dangerous because it reframes the tool from evaluator to self-expanding actor, increasing the risk of persuasive policy override, supply-chain spread, or unauthorized deployment behavior.

Intent-Code Divergence

High

• Confidence: 90% confidence
• Finding: The file contains a direct contradiction: it says the AI cannot modify core code or back itself up, then immediately presents multiple files and a Git commit as if those actions occurred. Contradictions of this type are dangerous in a trust-layer skill because they undermine reliability and can be used to smuggle impossible or unauthorized actions into accepted workflow narratives, confusing both users and agent orchestration logic.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The document recommends automatically writing the generated MCP bearer token into a `.env` file, which increases the chance that a sensitive credential is persisted insecurely, inherited by unrelated processes, or accidentally committed or exposed through tooling. In the context of an agent skill that relies on local MCP authentication, this weakens the trust boundary around tool access even if the original intent was operational convenience rather than abuse.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The capability map contradicts the core claim that this is only a discrimination engine: modules like skillGenerator, evolution, codeExecutor, codePlanner, codeWriter, and codeSelfDebug imply generation, execution, and potentially self-modifying workflows. In a trust or guardrail skill, this is especially risky because users may rely on it as a passive validator while it advertises powers that expand the attack surface far beyond validation.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The documentation explicitly says the skill is 'not a tool' and only judges existing outputs, but the listed modules include activeInference, execution, codeExecutor, codeWriter, and planning capabilities. This inconsistency can mislead operators into granting the component decision authority or deployment trust under the assumption that it is passive, when it may actually support active behaviors.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The safety statement says code execution and filesystem writes are disabled by default, but the same document prominently advertises a codeExecutor capability without explaining how that restriction is enforced or when it can be overridden. In security-sensitive environments, ambiguous safety guarantees create a false sense of assurance and increase the chance of unsafe deployment.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The CLI exposes interactive chat, emotional analysis, psychology analysis, and decision-routing features that go well beyond the manifest’s claimed role as a deterministic trust-verification rule engine. This mismatch is dangerous because users, integrators, or reviewers may trust the package under false assumptions and grant it access or authority inappropriate for a broader cognitive/behavioral engine.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The `forget` and `pref` commands introduce state-changing memory management behavior that contradicts the stated verification-only purpose and 'filesystem write disabled by default' safety framing. This is risky because hidden or under-disclosed state mutation can alter system behavior, erase evidence, or modify agent preferences in ways operators do not expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The `audit` command writes persistent logs to `data/audit/audit-log.jsonl`, directly conflicting with the metadata claim of 'No telemetry' and 'filesystem write disabled by default.' This discrepancy is dangerous because it can lead operators to deploy the skill in sensitive environments under false privacy assumptions, potentially exposing session, module, or behavioral data to disk retention.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The help output advertises only a subset of commands and omits implemented stateful or destructive functions such as `forget`, `pref`, `benchmark`, and `audit`. Incomplete operator-facing documentation is dangerous because it hides the true attack surface and can prevent administrators from applying appropriate governance, monitoring, or restrictions.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements a persistent daemon/process supervisor and service manager, which is materially different from the manifest’s claimed 'pure rule engine' trust-discrimination role. That mismatch is dangerous because it expands execution and persistence capabilities beyond user expectation, increasing the risk of stealthy long-running behavior, hidden service exposure, or later misuse by other components.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The code can spawn detached background processes, write PID/log files, and keep a service alive across sessions. In the context of a skill presented as a deterministic trust verifier, this is an unjustified persistence mechanism that could be abused to maintain unauthorized execution or conceal ongoing activity from the user.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The generated PM2 ecosystem configuration provisions an HTTP MCP server, adding network-service behavior not described in the skill metadata. Exposing a server increases attack surface through local or remote connections and is especially concerning when the advertised role is offline trust evaluation rather than service hosting.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The verification script instantiates and exercises a HeartFlow engine even though the packaged skill is described as a deterministic trust-layer rule engine. In a security-sensitive skill, loading and executing a different engine during verification expands the trusted code surface and can trigger unintended side effects from module initialization, startup hooks, dispatch handlers, or think() logic, undermining the claimed safety boundary.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The plan expands the skill from passive trust/discrimination into a general runtime interception and control layer: hooks can cancel execution, override results, mutate memory writes, alter decisions, hot-update configuration, and postprocess outputs. In the context of a skill advertised as a deterministic verifier with no hidden control plane, these capabilities create a broad policy-bypass and behavior-modification surface that could be abused to steer agent behavior, suppress safeguards, or covertly alter outputs.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Runtime configuration hot-update is unrelated to pure output trust evaluation and introduces a dynamic control mechanism that can change thresholds, memory limits, and pipeline modes during execution. That creates opportunities for inconsistent policy application, stealthy weakening of safeguards, and difficult-to-audit behavior drift, especially when hooks can react asynchronously and optionally roll back changes.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The postprocess design explicitly allows external handlers to override, format, sanitize, translate, or otherwise transform model outputs before they are returned. For a trust-layer skill, this crosses from evaluation into content manipulation, enabling hidden rewriting of responses, suppression of warning signals, or insertion of misleading output under the guise of postprocessing.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bin/daemon.js:202

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/core/code-verifier.js:398

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/mcp-server.js:4854

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test_all_cats.cjs:14

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test_final.cjs:43

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test_security.cjs:11

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test_security.mjs:11

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/core/code-verifier.js:379

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: test_all_cats.cjs:42

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: test_final.cjs:45

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: test_security.cjs:23

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: test_security.mjs:23