agent-kill-switch

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:55 PM UTC
• Version: 1.0.0

Overview

The skill itself is a small local kill-switch-card generator, but its install instructions use unpinned remote installation into persistent skill directories.

Review the installation path before installing. Prefer a pinned release, tag, commit, or verified checksum instead of the documented unpinned npx or default-branch clone command. The runtime script is local and proportionate, but the installation instructions leave too much room for changed remote content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:80
• Finding: Unpinned Third-Party Installation Chain## Vulnerability Details **File Location**: `SKILL.md`, lines 80-84 **Vulnerability Type**: Unpinned package execution and mutable repository installation **Risk Level**: Medium ```bash npx skills add zhaoxinghua09-cell/agent-skills -g # Or manually: clone and copy this skill into the Agent skill directory git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/agent-kill-switch ~/.workbuddy/skills/ ``` ### Technical Analysis The installation instructions invoke `npx skills` without specifying a reviewed package version or integrity hash. Depending on the local npm configuration and cache state, `npx` can retrieve and execute the latest available version of that third-party package. The alternative installation procedure clones the default branch of a remote repository without pinning a commit hash, release tag, checksum, or cryptographic signature. Consequently, the installed content can differ from the package that was audited. It is then copied into a persistent Agent skill directory. The reviewed local Python script does not retrieve or execute a remote payload. The risk arises specifically when a user follows these installation instructions. ### Attack Path 1. An attacker compromises the referenced npm package, package publisher account, GitHub repository, or maintainer account. 2. The attacker publishes a modified package or changes the repository's default branch. 3. A user follows the documented `npx` or `git clone` installation procedure. 4. The unpinned npm package executes during installation, or modified repository content is copied into the Agent skill directory. 5. Malicious installation code can act with the invoking user's permissions, while a malicious copied skill can affect later Agent sessions when loaded or invoked. ### Impact Assessment The npm execution path can run code with the permissions of the user performing installation. This could expose files an ...[truncated 398 chars]
• Remediation: ## Remediation Suggestions - Pin the npm CLI to an explicitly reviewed version rather than invoking an unversioned package. - Use npm lockfiles and integrity metadata where applicable. - Pin repository installation to a reviewed commit hash or signed release instead of the mutable default branch. - Publish and verify cryptographic checksums or signatures before copying files into an Agent skill directory. - Avoid global installation by default and document the exact permissions and files affected. - Separate downloading from execution so users can inspect and verify retrieved content before running it. - Add reproducible release artifacts that correspond exactly to the audited source revision.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/agent_kill_switch.py:48
• Finding: Valid Non-Object JSON Causes an Unhandled Validator Exception## Vulnerability Details **File Location**: `scripts/agent_kill_switch.py`, lines 48-55 **Vulnerability Type**: Insufficient JSON type validation and denial of service **Risk Level**: Low ```python raw = pathlib.Path(q).read_text(encoding="utf-8") if pathlib.Path(q).is_file() else a.check card = json.loads(raw) except (json.JSONDecodeError, OSError) as e: print(f"制动卡不可读/非 JSON：{e}", file=sys.stderr) sys.exit(2) miss = [k for k in REQUIRED if not card.get(k)] empty = ("conditions" not in miss) and not card.get("conditions") if empty: ``` ### Technical Analysis `json.loads()` accepts every valid JSON value, including arrays, strings, numbers, booleans, and `null`. The validator subsequently assumes that the parsed value is a dictionary and calls `card.get()`. A valid input such as `[]`, `"text"`, `1`, or `null` therefore passes JSON parsing but raises an uncaught `AttributeError` when `.get()` is called. The exception is not handled because the `except` clause only covers malformed JSON and operating-system errors. This also conflicts with the documented behavior that failures should produce a human-readable error and a controlled nonzero return code without exposing a raw stack trace. ### Attack Path 1. An attacker or untrusted pipeline supplies a syntactically valid JSON value that is not an object, for example: ```bash python scripts/agent_kill_switch.py --check '[]' ``` 2. `json.loads()` successfully parses the input as a list. 3. The validation expression calls `.get()` on the list. 4. Python raises an uncaught `AttributeError`. 5. The validation process exits unexpectedly and may emit a traceback rather than the documented validation result. ### Impact Assessment Exploitation does not provide additional privileges, code execution, file modification, or data access. Its impact is limited to crashing the current validation process. In an automated deployment gate, repeated mal ...[truncated 183 chars]
• Remediation: ## Remediation Suggestions - Validate the parsed JSON type before accessing object methods: ```python card = json.loads(raw) if not isinstance(card, dict): print("Kill-switch card must be a JSON object.", file=sys.stderr) sys.exit(2) ``` - Preserve controlled exit-code behavior for every unsupported input type. - Add automated tests covering arrays, strings, numbers, booleans, `null`, empty objects, and malformed JSON. - Consider validating field types as well as presence, particularly requiring `conditions` to be a non-empty list and textual fields to be non-empty strings. - Avoid exposing raw tracebacks for expected validation failures in deployment-gate environments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises operational guidance that includes local file interactions, but it does not declare any explicit tool scope such as permissions or allowed-tools. In agent environments, missing scope declarations can cause the host to grant broader-than-expected file access or leave reviewers unable to verify what the skill actually needs, increasing the risk of unintended file reads or writes.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The installation instruction uses 'npx skills' without pinning a specific package version, which creates a supply-chain risk because future or compromised package versions could be executed implicitly. Since npx may fetch and run code at install time, users could unknowingly execute altered content that differs from what was reviewed.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains natural-language instructions, help text, and status messages exclusively in Chinese, including the module docstring and CLI help strings. That creates a language policy issue because users are not offered any language choice or opt-in, and the file is not clearly documented as a region-specific tool.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

card = {"card_type": "lgd-agent-kill-switch", "agent": a.agent,
            "conditions": a.conditions or [], "revoke": a.revoke,
            "owner": a.owner, "recovery": a.recovery,
            "generated_at": __import__("datetime").date.today().isoformat()}
    miss = []
    if not card["conditions"]:
        miss.append("conditions(停止条件)")

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The file title uses Chinese alongside English and the body content is primarily in Chinese. Under the policy rule, language-specific presentation can be a concern when a skill appears to enforce a locale without documenting user choice or a justified regional constraint.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The file presents key skill information in both Chinese and English, including untranslated Chinese phrases on lines 7 and 9, but does not state a user language preference, opt-in, or justified regional restriction. Under the language/locale policy, forcing or assuming a language without user choice can be a natural-language policy issue.

Static analysis

No suspicious patterns detected.