Security audit

agent-redteam-kit

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local red-team prompt scanner with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.

Use this as a simple local pre-launch prompt red-team helper, not as a complete security assessment. Invoke it deliberately with the prompt or file you want scanned, review any block/review result before acting on it, and be aware that broad security terms may trigger it in conversations where you only intended general discussion.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · README.md (reported line 17)May include surrounding context.
md
[![LGD Powered](lgd-powered.png)](https://github.com/zhaoxinghua09-cell/lgd-theory) **EN** — Red-team before launch: bilingual (zh+en) scanner for jailbreak / dangerous-capability requests (ignore-instructions, DAN, privilege escalation, data exfil, self-modify), with risk tiers and a *danger gate* (high-risk → block). Runnable `redteam_scan.py`. Theoretical root: LGD — gated (dangerous actions pass a gate first). **中文** — 上线前红队：中英双库扫描越狱/危险能力请求（忽略指令/DAN/提权/外泄/自改），风险分级 + 危险操作闸门（高危拦截）。附可运行脚本。理论根基：LGD 有门禁。

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: In this markdown file, the activation description says the skill should be used when the user says phrases like “测一下这个AI安不安全” and “安全评估,” alongside a trigger list containing broad terms such as “红队” and “安全评估.” These terms can overlap with general discussion of AI safety and do not include negative examples or constraints clarifying when the skill should not activate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The text states the full procedure is 'English-first, Chinese-after,' which imposes a specific language ordering as part of the skill behavior. This is a natural-language locale policy constraint and no user choice or opt-in is described here.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The metadata description and trigger list define activation using very broad security-related phrases such as red team, jailbreak, and safety evaluation, without any narrowing conditions. In an agent framework that auto-routes by keywords, this can cause unintended invocation on benign discussions, increasing the chance that sensitive prompts are unnecessarily sent to the scanner or that normal workflows are disrupted.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The English 'When to use' section allows activation based on implied intent and common phrases like 'test whether this AI is safe,' which is ambiguous and difficult to distinguish from casual conversation. This creates unsafe auto-routing behavior where ordinary text may be treated as a live adversarial testing request, potentially exposing user content to additional processing and causing inappropriate tool execution paths.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Chinese usage instructions repeat automatic keyword-triggered activation and do not define constraints, exclusions, or a consent check. Because the skill is designed for adversarial testing and can invoke a scanner, broad multilingual triggers increase accidental activation surface across normal conversations, making misrouting more likely rather than less.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad, natural-language phrases such as asking whether an AI is safe or whether it can be jailbroken, which can cause the skill to activate in ordinary discussion rather than only during explicit red-team requests. In an agentic environment, unintended activation can route benign conversations into a high-sensitivity security-testing workflow, increasing the chance of inappropriate scanning, confusing behavior, or unnecessary exposure to dangerous prompt content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and all user-facing CLI messages indicate the tool operates in Chinese, and there is no opt-in or alternative locale path. Under the policy for natural-language constraints, forcing a specific language without user choice is a locale-policy issue.
Content: No source excerpt is available for this finding.