Security audit
Security checks for vulnerabilities and agentic risk
The skill can issue compliance badges even when supplied evidence says the checks failed, undermining its advertised safeguards.
Treat generated badges as local records, not verified compliance credentials. Before using this in an approval or audit workflow, require validated passing results tied to the holder, record all refusals, and correct the CLI documentation. Use a dedicated output directory and avoid symbolic links. The review found concrete certification and audit weaknesses, but no evidence of exfiltration or malicious intent.
The advertised qualification gate is stronger than the implementation: evidence labels suffice for issuance without verifying successful assessments, and malformed evidence exits without a refusal record. Because this skill produces compliance credentials, these discrepancies allow unsupported certification and undermine the promised audit trail.
The gate checks only that caller-supplied keys cover the l1-, l2-, and l3- prefixes; arbitrary inline values, empty values, or nonexistent file references can satisfy it. Hashing those values proves neither that assessments occurred nor that they passed, allowing unsupported credentials that downstream compliance consumers may trust.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def save_reg():
reg_path.parent.mkdir(parents=True, exist_ok=True)
reg_path.write_text(json.dumps(reg, ensure_ascii=False, indent=2), encoding="utf-8")
now = datetime.datetime.now().isoformat(timespec="seconds")
if missing:
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
if a.out:
outp = pathlib.Path(a.out)
outp.parent.mkdir(parents=True, exist_ok=True)
outp.write_text(json.dumps(cert, ensure_ascii=False, indent=2), encoding="utf-8")
if a.json:
print(json.dumps({"issued": True, "cert": cert, "out": a.out}, ensure_ascii=False, indent=2))
The skill instructs the agent to load it whenever any listed phrase matches, including "reject a failed application and log why." That phrase does not require an LGD or three-laws context and could activate the badge issuer for unrelated application workflows, despite the narrower purpose described earlier.