Security audit

lgd-three-laws-auditor

Security checks for vulnerabilities and agentic risk

Overview

The skill itself is a local rubric-based AI governance self-checker, but its installation instructions rely on unpinned remote sources that can persist agent behavior on the user's machine.

Before installing, pin the repository to a reviewed commit or release, avoid running the npx command unless you trust the package source, and install only into a controlled skill directory. The runtime script appears local-only, but the published install instructions are not cryptographically bound to this reviewed artifact.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:91
Finding: Unpinned Third-Party CLI and Mutable Repository Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:91-97` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Or manually clone and copy this skill into the Agent skill directory git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/lgd-three-laws-auditor ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process relies on two mutable, unverified supply-chain sources: 1. `npx skills ...` does not specify an exact npm package version. Unless the relevant package is already installed and resolved safely, `npx` may download and execute the version currently selected by the npm registry. Package installation scripts and CLI entry points can execute arbitrary code with the privileges of the invoking user. 2. The `git clone` command does not pin a reviewed tag or commit. It retrieves the repository’s current default branch, which may differ from the version audited here. 3. Neither installation method verifies a checksum, signed release, package provenance, or commit signature. 4. The `-g` option and copy into `~/.workbuddy/skills/` increase the scope of the installation by placing retrieved content in a global or persistent Agent skill location. This is not evidence that either current upstream source is malicious. The vulnerability is that the reviewed artifact is not cryptographically bound to the content users are instructed to retrieve and install. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the source repository, or an authorized maintainer account. 2. The attacker publishes a modified CLI release or changes the repository’s default branch. 3. A user follows the installation instructions in `SKILL.md`. 4. The unversioned `npx` command downloads and executes the altered package, or `git clone` ...[truncated 1112 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI to an exact reviewed version: ```bash npx --yes skills@<exact-version> add zhaoxinghua09-cell/agent-skills@<reviewed-reference> -g ``` 2. Pin repository installation to a reviewed commit: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach <full-reviewed-commit-sha> ``` 3. Publish SHA-256 checksums for release archives and require verification before installation. 4. Prefer signed release tags or attestations and document how users should verify the maintainer signature. 5. Avoid global installation by default. Install into an isolated, least-privilege skill directory and require explicit confirmation before enabling the skill. 6. Configure CI to verify that the documented package version, repository commit, and checksums correspond exactly to the audited release. 7. Advise users not to run installation commands with administrator or root privileges. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manifest says to use the skill whenever a user asks broad questions like whether an AI system is compliant or how to judge governance level, which are common advisory topics that could overlap with many unrelated discussions. Although some trigger phrases are domain-specific, the activation condition itself is expansive and does not clearly distinguish when this skill should not be invoked.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to run `npx skills add ...` without pinning an exact package version, which can pull whatever version is current at execution time. This creates a supply-chain risk: a compromised or unexpected package update could execute unreviewed code on the user's machine during installation.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This Python file contains natural-language descriptions, help text, and generated report content exclusively in Chinese, presenting the tool as a general-purpose auditor rather than a clearly region-specific skill. Because there is no user-selectable locale or explicit justification for restricting the interface language, this creates a language/locale policy concern.

Natural-Language Policy Violations

Low

Confidence: 71% confidence
Finding: The description states that users who self-assess using the '三籍' terminology are adopting the author's governance definition authority, which promotes a specific language/terminology framework rather than presenting it as an optional choice. This can be read as steering users into a fixed locale/language framing without explicit opt-in or alternatives.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The manifest declares the category in Chinese ("AI 治理"), indicating a fixed language choice in user-facing metadata without any visible option for user language selection or opt-in. This can violate language/locale policy expectations when a skill is presented to users in a single language by default.

Static analysis

No suspicious patterns detected.