ai-guardian

• Outcome: Review
• Latest audit: Oct 15, 2026 · 9:47 AM UTC
• Version: 0.13.0

Overview

AI Guardian is mostly transparent and purpose-aligned, but it exposes local model-changing and model-deletion authority without an enforced read-only mode or approval gate for agent-driven use.

Install only if you are comfortable giving the agent visibility into local model state and, when write tools are exposed, authority to change or delete local models. For observe-only use, expose only scan/read tools or run against an account/runtime that cannot administer the model store. Treat ~/.ai-guardian as sensitive because it contains audit, usage, undo, and optional encrypted secret material.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:193

Finding

Destructive MCP model removal lacks an enforced authorization gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:193-204; corroborated by references/capabilities.md:37-45 and references/agent-guardrails.md:18-29
Vulnerability Type: Destructive operation without enforced authorization or confirmation
Risk Level: Medium

Evidence

SKILL.md:193-204:

text

The skill delivers reads and writes and records them; it does **not** decide
whether a write is permitted. That is your agent's judgement, or the permission
of the host and account you run it under (point it at a runtime the account
cannot administer, or hand the agent only the scan/observe tools). There is no
read-only switch, deny-rules file, or approval gate — content governance (the
model allow/deny policy and the `guarded_generate` block threshold) is a
separate, product-level control that stays.

- **Audit is the guarantee, and it is not bypassable.** Every operation — MCP and CLI alike — is logged to `~/.ai-guardian/audit.db` (relocatable via `AI_GUARDIAN_AIOPS_HOME`): params, result, status, duration, and the risk tier. Observed local-LLM usage lives in a **separate** `~/.ai-guardian/usage.db`.
- `AI_GUARDIAN_AUDIT_APPROVED_BY` / `AI_GUARDIAN_AUDIT_RATIONALE` are optional annotations recorded on the audit row (who/why); they are never required and never block.

references/capabilities.md:37-45:

text

## Write tools (8)

| Tool | Risk | Ollama endpoint / effect | Undo / safety |
|------|------|--------------------------|---------------|
| `pull_model` | medium | `POST /api/pull` | **refused if it violates the deny/allow policy** |
| `remove_model` | **high** | `DELETE /api/delete` | captures the model manifest; records an undo (`pull_model` re-pull); CLI `--dry-run` + double confirm |

references/agent-guardrails.md:18-29:

text

## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool
...[truncated 3163 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce authorization in the MCP execution path for remove_model, rather than relying solely on agent judgment or system-prompt instructions.
2. Require a short-lived, operation-bound approval token that includes the target runtime, exact model name, approving user, and expiration time.
3. Add a read-only operating mode and make it the default for MCP sessions. Destructive tools should be unavailable unless explicitly enabled by the user or administrator.
4. Implement an MCP dry-run that returns the exact target and planned API request, then require a separate confirmed call tied cryptographically or through server-side state to that preview.
5. Apply the same double-confirmation guarantee documented for the CLI to all entry points, including MCP.
6. Keep audit annotations, but do not treat them as authorization. Require verified approval independently of audit metadata.
7. Permit administrators to configure deny rules for destructive tools and per-target access controls.
8. Where practical, use runtime credentials restricted to inventory and observation operations, and grant model-administration privileges only for explicitly approved maintenance sessions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The documented remove_model write tool exposes destructive model deletion through DELETE /api/delete, which can be abused if the agent is induced to act on attacker-controlled model names or performs insufficient authorization and confirmation checks. In this skill context, model inventory and governance tasks make deletion a plausible action path, so prompt/tool-parameter abuse could disrupt local AI operations or remove sanctioned models.

Content

Scanner excerpt · references/capabilities.md (reported line 28)May include surrounding context.

md

| Tool | Risk | Ollama endpoint / effect | Undo / safety |
|------|------|--------------------------|---------------|
| `pull_model` | medium | `POST /api/pull` | **refused if it violates the deny/allow policy** |
| `remove_model` | **high** | `DELETE /api/delete` | captures the model manifest; records an undo (`pull_model` re-pull); CLI `--dry-run` + double confirm |
| `unload_model` | medium | `POST /api/generate` `keep_alive:0` | evict from VRAM; no undo |
| `set_model_allowlist` | medium | writes `config.yaml` | undo → prior allowlist (immutable replace, not append) |
| `set_model_denylist` | medium | writes `config.yaml` | undo → prior denylist (deny patterns always win) |

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest explicitly says the skill should be used for Ollama, llama.cpp, LM Studio, and local single-node vLLM. This file states 'Non-Ollama local-LLM runtimes' are out of scope, which directly contradicts the stated product intent and would mislead users about what the skill is meant to cover.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cli-reference.md (reported line 11)May include surrounding context.

bash

ai-guardian init                      # interactive wizard: Ollama endpoint(s) + optional token + model allowlist
ai-guardian doctor [--skip-auth]      # config + policy summary + Ollama reachability (/api/version)
ai-guardian mcp                       # start the MCP server (stdio transport)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/setup-guide.md (reported line 115)May include surrounding context.

bash

ai-guardian init                      # interactive wizard: Ollama endpoint(s) + optional token + model allowlist
ai-guardian doctor [--skip-auth]      # config + policy summary + Ollama reachability (/api/version)
ai-guardian mcp                       # start the MCP server (stdio transport)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/cli-reference.md (reported line 50)May include surrounding context.

ai-guardian secret set [--value ] # store a token (hidden prompt if no --value) ai-guardian secret list # names only — values never shown ai-guardian secret rm ai-guardian secret migrate # import legacy plaintext .env (AI_GUARDIAN__TOKEN) ai-guardian secret rotate-password # re-encrypt under a new master password

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill explicitly persists operational data to local SQLite databases and stores service tokens in a reusable encrypted secrets store, with a deprecated plaintext environment-variable fallback still honored. Persistent local storage of audit/usage metadata and credentials increases the chance of sensitive prompt-derived findings, model activity history, or tokens being recovered by other local users, malware, backups, or forensic collection.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

Every tool call is audited to a local SQLite DB at ~/.ai-guardian/audit.db (relocatable via AI_GUARDIAN_AIOPS_HOME); the OBSERVED local-LLM usage log is a SEPARATE DB at ~/.ai-guardian/usage.db.
  Zero-config: ai-guardian defaults to the local Ollama at http://localhost:11434 with no token. Ollama endpoints usually run open on a trusted host, so a bearer token is OPTIONAL; when one is supplied it is stored ENCRYPTED in ~/.ai-guardian/secrets.enc (Fernet/AES-128 + scrypt-derived key) — never plaintext on disk. The store is unlocked by a master password from AI_GUARDIAN_AIOPS_MASTER_PASSWORD (non-interactive/MCP/CI) or an interactive prompt (CLI on a TTY). A legacy plaintext env var AI_GUARDIAN_<TARGET_NAME_UPPER>_TOKEN is still honoured as a fallback with a deprecation warning (migrate with 'ai-guardian secret migrate').
  The prompt scanner is deterministic and offline (no I/O, no network); route-through guards (guarded_generate/observe_chat) call Ollama only if the prompt's risk band is below block_threshold AND the model is allowed. The raw prompt is never stored — only its length + redacted findings.
  State-changing operations: remove_model (high, dry-run + double confirm at the CLI, undo re-pull); pull/unload/allowlist/denylist/pin/guarded writes are medium. All write tools pass through the @governed_tool decorator (pre-check + budget guard + audit + risk-tier label).
  Webhooks: none — no outbound network calls beyond the configured Ollama REST API.
  Transitive dependencies: httpx (HTTP client) and the MCP SDK. No post-install scripts or background services.
  Validation status: the scanner/policy/risk-band are deterministic offline logic; the core Ollama route-through (real generation + policy deny + undo capture) was exercised against a live Ollama 0.24.0 on 2026-07-13, while the remaining runtime API paths and the OpenAI-compatible dialects are exercised against mocked responses (see docs/VERIFICATION.md). Content governance is opt-in route-through in v0.1
...[truncated 24 chars]

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The Governance & Safety section says there is 'no ... approval gate' and that approval-related environment variables are optional and never block. However, the earlier removal workflow states remove_model 'needs AI_GUARDIAN_AUDIT_APPROVED_BY', which presents approval metadata as a requirement for that destructive action. This is an active documentation contradiction about whether approval information is mandatory for high-risk writes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill advertises that it can perform write operations but provides no built-in read-only mode, deny-rules file, or approval gate, leaving authorization entirely to the calling agent and host account. In an agentic environment, that means prompt-induced or mistaken tool invocation could directly modify model policy, pull/remove models, or route prompts without an internal safety barrier, making destructive or policy-changing actions easier to trigger.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md

## Governance & Safety

The skill delivers reads and writes and records them; it does **not** decide
whether a write is permitted. That is your agent's judgement, or the permission
of the host and account you run it under (point it at a runtime the account
cannot administer, or hand the agent only the scan/observe tools). There is no
read-only switch, deny-rules file, or approval gate — content governance (the

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 5)May include surrounding context.

md

There is a pleasing recursion here: ai-guardian governs local LLMs, and this page
is about driving ai-guardian *with* one. The same weaknesses this tool exists to
observe — a model that answers confidently without checking, that cannot tell
"unknown" from "none", that reports a truncated view as complete — are the ones
you will hit while operating it.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The document explicitly states the tool does not provide a read-only switch or approval prompt for write actions, relying instead on external account permissions or prompting discipline. In an agentic setting, absence of in-tool authorization controls can allow unintended destructive actions such as model removal or pulling if the runtime credentials are overprivileged or the model ignores prompt-only restrictions.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 21)May include surrounding context.

md

## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the account's. The tool does
not gate it — there is no read-only switch and no approval prompt to configure.
The two right places to control read vs write:

- **The host and account you run under.** Point the tool at a runtime the account

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest centers the skill on observing and governing local LLM endpoints such as Ollama, llama.cpp, LM Studio, and single-node vLLM, with a transparent capture proxy only noted as a v0.2 roadmap item. This file says that proxy functionality is already shipped and describes it as CLI-only, which expands actual behavior beyond the manifest's described currently available operations.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/cli-reference.md (reported line 11)May include surrounding context.

bash

ai-guardian init                      # interactive wizard: Ollama endpoint(s) + optional token + model allowlist
ai-guardian doctor [--skip-auth]      # config + policy summary + Ollama reachability (/api/version)
ai-guardian mcp                       # start the MCP server (stdio transport)

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/setup-guide.md (reported line 115)May include surrounding context.

bash

ai-guardian init                      # interactive wizard: Ollama endpoint(s) + optional token + model allowlist
ai-guardian doctor [--skip-auth]      # config + policy summary + Ollama reachability (/api/version)
ai-guardian mcp                       # start the MCP server (stdio transport)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup-guide.md (reported line 74)May include surrounding context.

md

- A token is **never** written to disk in plaintext. It lives only in
  `~/.ai-guardian/secrets.enc`, encrypted with Fernet (AES-128-CBC + HMAC), the
  key derived from your master password via scrypt. Only a per-store random salt
  and the ciphertext are on disk (chmod 600); the master password is never stored.
- A legacy plaintext env var `AI_GUARDIAN_<TARGET_NAME_UPPER>_TOKEN` is still
  honoured as a fallback with a deprecation warning — migrate with
  `ai-guardian secret migrate` (it imports then renames the old `.env`).

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 83)May include surrounding context.

md

## 5. Audit-annotation env vars (optional)

The skill does not decide whether a write is permitted — that is the agent's
judgement or the permission of the host/account you run it under. If you want the
audit trail to record *who* ran a destructive op and *why*, set these; they are
recorded on the row, never required, and gate nothing:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide explicitly discusses destructive operations and audit metadata for them, which expands the skill from passive auditing/guarding into model-changing behavior. This is dangerous because operators or downstream agents may rely on the manifest’s narrower description and unknowingly grant a tool write-capable authority over local models or policy state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Advertising an undo database for reversible writes strongly implies the existence of state-changing operations not reflected in the declared passive/opt-in scope. Hidden or under-declared write capabilities create security and governance risk because users may not apply the scrutiny, approval flow, or sandboxing appropriate for mutating tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.