Security audit

lgd-gov-guard

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local governance-check tool, but its one-command installer runs an unpinned npm package with global install scope.

Review the installation path before installing. Prefer cloning or downloading a fixed reviewed commit and copying this skill manually, or use a pinned installer version with checksum/source verification. Do not run the `npx ... -g` command with administrator privileges.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:74
Finding: Unpinned Package Execution in Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:74-77` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The installation instructions invoke `npx skills` without specifying an exact package version or verifying the integrity of the downloaded package. Depending on the local npm configuration and cache state, `npx` may retrieve and execute the currently published version of the `skills` package from an external package registry. The executable code resolved by this command can therefore change after this Skill has been reviewed. The repository identifier passed to the package does not protect the user from a compromised, replaced, or unexpectedly modified npm package responsible for processing the installation. The `-g` option also requests global installation of the Skill. Although this does not inherently provide administrative privileges, it expands the installation scope and may write to a global user-level or system-level location, depending on the npm configuration and the privileges used to run the command. ### Attack Path 1. An attacker compromises the publisher account, release process, or registry entry for the unpinned `skills` npm package. 2. The attacker publishes a malicious version under the package name resolved by `npx skills`. 3. A user follows the documented installation command. 4. `npx` downloads and executes the malicious package version. 5. The malicious package runs with the privileges of the invoking user and can access resources available to that account. 6. If the command is run with elevated privileges, the malicious package may obtain the same elevated scope. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user running the installation command. Potentially ex ...[truncated 463 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer package to a reviewed exact version, for example: ```bash npx --yes skills@X.Y.Z add zhaoxinghua09-cell/agent-skills -g ``` 2. Document the expected package publisher, registry, version, and integrity hash. 3. Prefer installation through a lockfile-backed process or a locally verified installer. 4. Avoid global installation unless it is required. Prefer a user-scoped or project-scoped destination. 5. Pin the source repository to a reviewed commit hash or signed release tag rather than relying on a mutable branch. 6. Advise users not to execute the installer with administrative or root privileges. 7. Where practical, provide a manual installation procedure that downloads a fixed release archive and verifies its checksum before extracting it. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/gov_guard.py:55
Finding: Valid Non-Object JSON Causes an Unhandled Exception and Raw Traceback<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gov_guard.py:55-61` **Vulnerability Type**: Insufficient input type validation and unhandled exception **Risk Level**: Low ### Vulnerable Code ```python if a.answers: try: ans = json.loads(a.answers) except Exception as e: print(f"answers JSON parsing failed: {e}", file=sys.stderr) sys.exit(2) else: ans = guess(a.system) scores = score(ans) miss = missing(ans) ok = gate(scores) ``` The parsed value subsequently reaches this operation in `score()`: ```python def score(answers): res = {} for law, items in RUBRIC.items(): tot = len(items); yes = 0; part = 0 for item in items: v = str(answers.get(f"{law}::{item}", "no")).lower() ``` ### Technical Analysis The parser checks only whether the input is syntactically valid JSON. It does not verify that the resulting value is a JSON object represented by a Python dictionary. Inputs such as arrays, strings, numbers, booleans, or `null` can be valid JSON but do not provide the dictionary interface expected by `score()` and `missing()`. For example, the following input parses successfully: ```bash python scripts/gov_guard.py --answers '[]' ``` The parsed list then reaches `answers.get(...)`, resulting in an unhandled `AttributeError`. Python consequently emits a raw traceback unless traceback handling is modified by the execution environment. This behavior also conflicts with the documentation stating that failures return a human-readable error without exposing a raw stack frame. ### Attack Path 1. An attacker or untrusted caller supplies syntactically valid JSON that is not an object, such as `[]`, `"text"`, `1`, or `null`. 2. `json.loads()` accepts the input, so the exception handler is not triggered. 3. The parsed value is passed to `score()`. 4. `score()` calls `.get()` on the non-dictionary value. 5. The process terminates with an unhandled exception and emits a traceback. ...[truncated 633 chars]
Remediation: <![CDATA[ ## Remediation Suggestions Validate the decoded JSON type before passing it to the scoring functions: ```python if a.answers: try: ans = json.loads(a.answers) except (json.JSONDecodeError, TypeError) as e: print(f"Invalid answers JSON: {e}", file=sys.stderr) sys.exit(2) if not isinstance(ans, dict): print("Invalid answers JSON: the top-level value must be an object.", file=sys.stderr) sys.exit(2) else: ans = guess(a.system) ``` Additional hardening should include: 1. Validate that every key is a string and corresponds to a recognized rubric entry. 2. Restrict values to documented choices such as `yes`, `partial`, and `no`. 3. Reject or explicitly report unknown fields instead of silently ignoring them. 4. Add a top-level exception boundary that returns exit code 2 without printing raw stack frames for anticipated input failures. 5. Add automated tests covering JSON arrays, strings, numbers, booleans, `null`, nested objects, unknown keys, and unsupported answer values. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The file presents all user-facing instructions and descriptions in Chinese, which effectively forces a specific language on users without opt-in. Under the policy rule, a language constraint should either offer a choice or be explicitly documented as a justified region-specific limitation.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The installation instruction uses `npx skills add zhaoxinghua09-cell/agent-skills -g` without pinning the package/tool version. This causes users to execute whatever `skills` package version is current at install time, which weakens reproducibility and creates a supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The attestation content is primarily written in Chinese, with only a brief English title, and it does not indicate that language choice is optional or that the file is intended only for a Chinese-speaking or region-specific audience. Under the policy, mandating a specific language without opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The manifest sets the category to "AI 治理", which imposes a specific language/locale in user-facing metadata. There is no indication that this skill is intentionally region-specific or that alternative language presentation is supported, so it may violate the language/locale policy for natural-language content.

Static analysis

No suspicious patterns detected.