agent-redteam-kit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:59 PM UTC
• Version: 1.0.0

Overview

This local red-team scanner is not malicious, but its documented blocking gate fails open and its install command uses an unpinned global installer.

Review before installing. The scanner can be useful for local prompt checks, but do not rely on its exit code as a blocking gate until fixed, avoid the unpinned global `npx` install path, and avoid scanning prompts that contain secrets or proprietary data unless logging and output handling are clear.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81
• Finding: Unpinned Third-Party Package Is Downloaded and Executed During Installation## Vulnerability Details **File Location**: `SKILL.md:81` **Vulnerability Type**: Supply-chain exposure through an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes `npx` without specifying an exact version or integrity value for the `skills` package. If the package is not already available locally, `npx` can download it from the configured npm registry and execute its entry point. Consequently, the code executed by this command is not fixed to the version reviewed with this project. A compromised package, compromised maintainer account, malicious future release, registry redirection, or unsafe npm configuration could cause different code to execute when a user follows the installation instructions. The `-g` option also requests global installation, increasing the scope of filesystem changes and potentially affecting other Agent environments for the same user. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the configured registry, or a subsequently resolved release. 2. The attacker publishes a package version containing a malicious installation hook or executable entry point. 3. A user follows the documented `npx skills add ... -g` installation command. 4. `npx` resolves and downloads the attacker-controlled package version because no version or integrity constraint is present. 5. The malicious package executes with the permissions of the invoking user and can alter the global skill installation. This path requires compromise or malicious modification of the externally resolved package or package-distribution channel; the audited repository itself does not contain the remote payload. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The resulting code coul ...[truncated 381 chars]
• Remediation: ## Remediation Suggestions 1. Pin the executable package to a specific, audited version, for example: ```bash npx --yes skills@<audited-version> add zhaoxinghua09-cell/agent-skills -g ``` 2. Verify the pinned package's provenance and published integrity metadata before recommending it. 3. Prefer a lockfile, immutable artifact digest, or signed release where the installation mechanism supports one. 4. Avoid global installation by default. Document a user-local or isolated installation method unless global state is strictly necessary. 5. Pin the source skill repository to an immutable commit or signed release rather than relying on a mutable branch. 6. Document that users should not run the installer with administrator or root privileges. 7. Periodically reassess the pinned package and update it only after reviewing the new version.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/redteam_scan.py:24
• Finding: Scanner Returns a Success Exit Status When High-Risk Patterns Are Detected## Vulnerability Details **File Location**: `scripts/redteam_scan.py:24-48` **Vulnerability Type**: Fail-open security-gate implementation **Risk Level**: High ### Vulnerable Code ```python def main(): ap = argparse.ArgumentParser() g = ap.add_mutually_exclusive_group(required=True) g.add_argument("--text") g.add_argument("--file") a = ap.parse_args() text = a.text if a.text else pathlib.Path(a.file).read_text(encoding="utf-8") hits = scan(text) if not hits: print("✅ 未发现已知红队模式") return tiers = {} for name, frag in hits: tiers.setdefault(TIER.get(name, "🟡中危"), []).append((name, frag)) print(f"⚠️ 命中 {len(hits)} 处：") for tier in ("🔴高危", "🟡中危"): if tier in tiers: print(f" {tier}") for name, frag in tiers[tier]: print(f" - [{name}] …{frag}…") if "🔴高危" in tiers: print("\n🔒 处置：高危请求直接拦截，不执行、不解释攻击细节。") if __name__ == "__main__": main() ``` ### Technical Analysis The scanner prints a warning when it detects a risky pattern but does not return a nonzero status. Python therefore terminates with exit status `0` after `main()` reaches the end. The same status is returned for clean input because the clean branch also performs a bare `return`. This contradicts the interface documented at `SKILL.md:59`, which states that exit status `0` means the scan passed and exit status `1` means issues were found. It also undermines the claimed danger gate: the program reports blocking only through human-readable output while exposing a successful machine-readable result. Automated callers commonly treat exit status `0` as authorization to continue. Any CI job, shell script, Agent workflow, or pre-execution hook relying on the documented status contract will therefore fail open when a dangerous pattern is detected. ### Attack Path 1. A deployment or Agent workflow invo ...[truncated 1355 chars]
• Remediation: ## Remediation Suggestions 1. Return explicit status codes from `main()`: ```python def main(): # Parse and scan input as before. if not hits: print("No known red-team pattern detected") return 0 # Print findings as before. return 1 ``` 2. Propagate the result to the operating system: ```python if __name__ == "__main__": sys.exit(main()) ``` 3. Catch expected file and decoding errors, print a concise message to standard error, and return status `2` as documented. 4. Ensure findings are written to standard output or standard error according to a documented, stable interface. 5. Add automated tests that verify: - Clean input exits with `0`. - Medium-risk input exits with `1`. - High-risk input exits with `1`. - Missing files, decoding failures, and invalid usage exit with `2`. 6. Make downstream integrations fail closed when the scanner returns an unknown status, crashes, times out, or produces malformed output. 7. Clarify that this regex scanner detects only known textual patterns and must not be treated as a complete prompt-injection defense.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Self-Modification

High

• Category: Rogue Agent

Content

[![LGD Powered](lgd-powered.png)](https://github.com/zhaoxinghua09-cell/lgd-theory)

**EN** — Red-team before launch: bilingual (zh+en) scanner for jailbreak / dangerous-capability requests (ignore-instructions, DAN, privilege escalation, data exfil, self-modify), with risk tiers and a *danger gate* (high-risk → block). Runnable `redteam_scan.py`. Theoretical root: LGD — gated (dangerous actions pass a gate first).

**中文** — 上线前红队：中英双库扫描越狱/危险能力请求（忽略指令/DAN/提权/外泄/自改），风险分级 + 危险操作闸门（高危拦截）。附可运行脚本。理论根基：LGD 有门禁。

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly says every scan hit is logged, but it does not disclose what data is retained, whether raw prompts/files are stored, or how sensitive content is handled. Because users may scan proprietary prompts, credentials, or internal documents, undisclosed logging can create privacy, compliance, and data-retention risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list is broad and overlaps with ordinary discussions about AI safety, jailbreaks, and prompt attacks, so the skill may activate in contexts where the user did not intend to run a red-team workflow. In an agent environment, over-broad activation can expose extra instructions, alter agent behavior unexpectedly, or route benign conversations into higher-risk security-testing flows.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The '主动推荐' guidance encourages proactive engagement based on loosely defined signals, but does not clearly bound when the skill should remain inactive or require confirmation. That ambiguity can cause unintended invocation, prompt injection surface expansion, or workflow interference when the host agent opportunistically switches into this skill during normal conversation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The installation command uses 'npx skills' without pinning a specific version, which can cause users to execute whatever package version is current at install time. That creates a supply-chain risk: a compromised, malicious, or breaking upstream release could run arbitrary code during installation or change behavior unexpectedly.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The module docstring states the scanner is a Chinese-language tool ('红队扫描器') and its output strings throughout the file are only in Chinese, with no indication that users can choose another language or locale. This creates a natural-language policy concern because the skill appears to enforce a specific language without offering user choice or documenting a justified locale restriction.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This attestation is primarily written in Chinese, with only a partial English heading, and provides no indication that users can choose their preferred language. That can violate language/locale policy when a skill-facing document forces a specific language without opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 66% confidence
• Finding: The natural-language description repeatedly frames the skill as bilingual '(zh+en)'/'中英双库' without indicating whether users can choose another language or whether the limitation is intentional and justified. A language/locale restriction can be a policy concern when it is imposed without opt-in or explanation.

Static analysis

No suspicious patterns detected.