vmware-pilot

• Outcome: Pass
• Latest audit: Oct 18, 2026 · 4:20 AM UTC
• Version: 2.4.0

Overview

This skill is a disclosed VMware workflow orchestrator with real production-change authority, but its high-impact behavior is purpose-aligned and documented with approval, audit, rollback, and scoping guidance.

Install this only for operators who are allowed to orchestrate VMware changes. Prefer the pinned uv install, expose read-only tools unless write workflows are needed, use least-privilege companion-skill accounts, require explicit approvals for production or credential-returning steps, and keep ~/.vmware workflow, audit, baseline, and kubeconfig files owner-only.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a full orchestration 'brain' for complex VMware workflows, including step planning, approval gates before destructive actions, rollback tracking, templates, and coordination across multiple VMware skills. The supplied code does none of that. It only defines a static in-memory SKILLS dictionary and prints it as a formatted table or JSON. While the listed metadata mentions workflow orchestration, approval gates, and risk levels, this script itself merely documents available tools and their risks. It contains no workflow execution, no approval enforcement, no rollback state handling, no YAML/template processing, and no integration with VMware APIs or companion skills. Therefore the actual behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents the skill as the active orchestration engine for complex VMware workflows, including step planning, approval gates before destructive operations, and explicit rollback handling. The actual code chunk only validates custom YAML workflow definitions before loading: it parses YAML, checks required fields and step structure, emits catalog warnings, and invokes vmware-pilot's approval-gate logic to ensure the file would be accepted. This is a materially narrower and different function than the declared orchestration/management behavior. While approval-gate enforcement is consistent with one aspect of the description, the code shown lacks the primary advertised capabilities such as designing workflows, executing steps across VMware skills, managing approval checkpoints interactively, or performing rollback. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All workflow operations audited to ~/.vmware/audit.db.
  No direct vCenter/NSX credentials: Pilot is an orchestration layer that delegates to companion skills (aiops, monitor, nsx, etc.) which handle their own auth.
  Approval gates: Workflows pause for human review before destructive steps; a custom workflow (YAML, create_workflow, or AI-designed) with a destructive or unclassifiable step not preceded by a gate is rejected, and force=True cannot override that. Rollback is never automatic: a failed step stops the workflow, and undo happens only when rollback is called; it is best-effort, and on the MCP server the calling agent performs each rollback_tool call itself.
  Pilot drives companion skills that change production (VM power, guest commands, network, storage, Kubernetes). Guest commands (run_vm_guest_command, upload_vm_guest_file, …) and credential-returning steps (vks issue_tkc_kubeconfig, issue_supervisor_kubeconfig) are gated like destructive ones.
  State persistence: SQLite-backed workflow state (~/.vmware/workflows.db, owner-only 0600 in a 0700 directory) survives restarts; secret-named params are masked before they are written. No webhooks, no outbound network calls.
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

md

vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All workflow operations audited to ~/.vmware/audit.db.
  No direct vCenter/NSX credentials: Pilot is an orchestration layer that delegates to companion skills (aiops, monitor, nsx, etc.) which handle their own auth.
  Approval gates: Workflows pause for human review before destructive steps; a custom workflow (YAML, create_workflow, or AI-designed) with a destructive or unclassifiable step not preceded by a gate is rejected, and force=True cannot override that. Rollback is never automatic: a failed step stops the workflow, and undo happens only when rollback is called; it is best-effort, and on the MCP server the calling agent performs each rollback_tool call itself.
  Pilot drives companion skills that change production (VM power, guest commands, network, storage, Kubernetes). Guest commands (run_vm_guest_command, upload_vm_guest_file, …) and credential-returning steps (vks issue_tkc_kubeconfig, issue_supervisor_kubeconfig) are gated like destructive ones.
  State persistence: SQLite-backed workflow state (~/.vmware/workflows.db, owner-only 0600 in a 0700 directory) survives restarts; secret-named params are masked before they are written. No webhooks, no outbound network calls.
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration-patterns.md (reported line 227)May include surrounding context.

md

vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All workflow operations audited to ~/.vmware/audit.db.
  No direct vCenter/NSX credentials: Pilot is an orchestration layer that delegates to companion skills (aiops, monitor, nsx, etc.) which handle their own auth.
  Approval gates: Workflows pause for human review before destructive steps; a custom workflow (YAML, create_workflow, or AI-designed) with a destructive or unclassifiable step not preceded by a gate is rejected, and force=True cannot override that. Rollback is never automatic: a failed step stops the workflow, and undo happens only when rollback is called; it is best-effort, and on the MCP server the calling agent performs each rollback_tool call itself.
  Pilot drives companion skills that change production (VM power, guest commands, network, storage, Kubernetes). Guest commands (run_vm_guest_command, upload_vm_guest_file, …) and credential-returning steps (vks issue_tkc_kubeconfig, issue_supervisor_kubeconfig) are gated like destructive ones.
  State persistence: SQLite-backed workflow state (~/.vmware/workflows.db, owner-only 0600 in a 0700 directory) survives restarts; secret-named params are masked before they are written. No webhooks, no outbound network calls.
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration-patterns.md (reported line 228)May include surrounding context.

md

vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All workflow operations audited to ~/.vmware/audit.db.
  No direct vCenter/NSX credentials: Pilot is an orchestration layer that delegates to companion skills (aiops, monitor, nsx, etc.) which handle their own auth.
  Approval gates: Workflows pause for human review before destructive steps; a custom workflow (YAML, create_workflow, or AI-designed) with a destructive or unclassifiable step not preceded by a gate is rejected, and force=True cannot override that. Rollback is never automatic: a failed step stops the workflow, and undo happens only when rollback is called; it is best-effort, and on the MCP server the calling agent performs each rollback_tool call itself.
  Pilot drives companion skills that change production (VM power, guest commands, network, storage, Kubernetes). Guest commands (run_vm_guest_command, upload_vm_guest_file, …) and credential-returning steps (vks issue_tkc_kubeconfig, issue_supervisor_kubeconfig) are gated like destructive ones.
  State persistence: SQLite-backed workflow state (~/.vmware/workflows.db, owner-only 0600 in a 0700 directory) survives restarts; secret-named params are masked before they are written. No webhooks, no outbound network calls.
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration-patterns.md (reported line 275)May include surrounding context.

md

vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All workflow operations audited to ~/.vmware/audit.db.
  No direct vCenter/NSX credentials: Pilot is an orchestration layer that delegates to companion skills (aiops, monitor, nsx, etc.) which handle their own auth.
  Approval gates: Workflows pause for human review before destructive steps; a custom workflow (YAML, create_workflow, or AI-designed) with a destructive or unclassifiable step not preceded by a gate is rejected, and force=True cannot override that. Rollback is never automatic: a failed step stops the workflow, and undo happens only when rollback is called; it is best-effort, and on the MCP server the calling agent performs each rollback_tool call itself.
  Pilot drives companion skills that change production (VM power, guest commands, network, storage, Kubernetes). Guest commands (run_vm_guest_command, upload_vm_guest_file, …) and credential-returning steps (vks issue_tkc_kubeconfig, issue_supervisor_kubeconfig) are gated like destructive ones.
  State persistence: SQLite-backed workflow state (~/.vmware/workflows.db, owner-only 0600 in a 0700 directory) survives restarts; secret-named params are masked before they are written. No webhooks, no outbound network calls.
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/list_available_tools.py (reported line 99)May include surrounding context.

python

vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All workflow operations audited to ~/.vmware/audit.db.
  No direct vCenter/NSX credentials: Pilot is an orchestration layer that delegates to companion skills (aiops, monitor, nsx, etc.) which handle their own auth.
  Approval gates: Workflows pause for human review before destructive steps; a custom workflow (YAML, create_workflow, or AI-designed) with a destructive or unclassifiable step not preceded by a gate is rejected, and force=True cannot override that. Rollback is never automatic: a failed step stops the workflow, and undo happens only when rollback is called; it is best-effort, and on the MCP server the calling agent performs each rollback_tool call itself.
  Pilot drives companion skills that change production (VM power, guest commands, network, storage, Kubernetes). Guest commands (run_vm_guest_command, upload_vm_guest_file, …) and credential-returning steps (vks issue_tkc_kubeconfig, issue_supervisor_kubeconfig) are gated like destructive ones.
  State persistence: SQLite-backed workflow state (~/.vmware/workflows.db, owner-only 0600 in a 0700 directory) survives restarts; secret-named params are masked before they are written. No webhooks, no outbound network calls.
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/list_available_tools.py (reported line 100)May include surrounding context.

python

vmware-policy auto-installed as Python dependency (provides @vmware_tool decorator and audit logging). All workflow operations audited to ~/.vmware/audit.db.
  No direct vCenter/NSX credentials: Pilot is an orchestration layer that delegates to companion skills (aiops, monitor, nsx, etc.) which handle their own auth.
  Approval gates: Workflows pause for human review before destructive steps; a custom workflow (YAML, create_workflow, or AI-designed) with a destructive or unclassifiable step not preceded by a gate is rejected, and force=True cannot override that. Rollback is never automatic: a failed step stops the workflow, and undo happens only when rollback is called; it is best-effort, and on the MCP server the calling agent performs each rollback_tool call itself.
  Pilot drives companion skills that change production (VM power, guest commands, network, storage, Kubernetes). Guest commands (run_vm_guest_command, upload_vm_guest_file, …) and credential-returning steps (vks issue_tkc_kubeconfig, issue_supervisor_kubeconfig) are gated like destructive ones.
  State persistence: SQLite-backed workflow state (~/.vmware/workflows.db, owner-only 0600 in a 0700 directory) survives restarts; secret-named params are masked before they are written. No webhooks, no outbound network calls.
  Transitive dependencies: Only vmware-policy (audit/policy). No post-install scripts or background services.
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill explicitly references tools that issue live kubeconfig credentials. Even though the guidance says to fetch them only on request, write them to a file, and never print the token, the capability materially enables credential access and creates risk of credential disclosure or misuse if the agent is prompted unsafely, logs outputs, or writes to insecure locations.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 104)May include surrounding context.

md

before undoing anything. On the MCP server the rollback tool cannot see the
  steps you performed (they stay not_executed), so undo them yourself: call each
  one's rollback_tool with its rollback_params, last step first.
- issue_tkc_kubeconfig and issue_supervisor_kubeconfig return a live credential.
  Only fetch one when the user asks, write it to a file, and never print the
  token.
- Run review_workflow before executing. Treat needs_revision as a stop.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The baseline_remediate template accepts user-supplied drift items containing arbitrary skill, tool, params, and optional rollback definitions, effectively turning a bounded workflow template into a generic cross-skill executor. Even with a single approval gate, this broad dispatch surface can be abused to invoke destructive or out-of-scope operations under the guise of remediation, especially if upstream audit data or agent-generated drift items are untrusted or insufficiently validated.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The documentation explicitly advertises a tool that returns a live Supervisor credential in kubeconfig form. Even though it recommends gating and not printing it, exposing such a capability inside an orchestration skill materially increases the risk of credential issuance, mishandling, logging, or downstream exfiltration if access controls or output handling are weak.

Content

Scanner excerpt · references/workflow-design.md (reported line 169)May include surrounding context.

md

| `create_tkc_cluster` | medium | Deploy TKC cluster |
| `scale_tkc_cluster` | medium | Scale worker nodes |
| `delete_tkc_cluster` | high | Delete TKC cluster |
| `issue_tkc_kubeconfig` | high | Returns a live Supervisor credential — gate it, write it to a file, never print it |
| `issue_supervisor_kubeconfig` | high | Same: a live Supervisor bearer token — gate it, write it to a file, never print it |

### storage (Datastores, iSCSI, vSAN)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This line documents issuance of a live Supervisor bearer token, which is a direct credential-access capability. In the context of a workflow orchestrator that can compose multi-step actions, such credentials are especially sensitive because they can enable cluster-wide follow-on actions if disclosed, persisted insecurely, or returned to an untrusted caller.

Content

Scanner excerpt · references/workflow-design.md (reported line 170)May include surrounding context.

md

| `scale_tkc_cluster` | medium | Scale worker nodes |
| `delete_tkc_cluster` | high | Delete TKC cluster |
| `issue_tkc_kubeconfig` | high | Returns a live Supervisor credential — gate it, write it to a file, never print it |
| `issue_supervisor_kubeconfig` | high | Same: a live Supervisor bearer token — gate it, write it to a file, never print it |

### storage (Datastores, iSCSI, vSAN)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

md

Rollback never happens on its own: a failed step leaves the workflow `failed` and stops. A bare `rollback(workflow_id)` only previews; `confirm=True` acts. It only reverses steps pilot recorded as `success`, and on the MCP server (no dispatcher) the steps you performed from `pending_dispatch` stay `not_executed` — so `rollback` there reverses nothing. Undo them yourself: call each performed step's `rollback_tool` with its `rollback_params`, last step first, after confirming with the user. Steps without a `rollback_tool` cannot be undone: rollback reports them `not_reversible`, and the preview lists steps handed to you that have none under `not_reversible_outside_pilot` — if you performed them (a clone, a production resize) they stay. An undo that does not remove what the step created is `partial` — a clone that was only powered off stays; delete it by hand. When pilot dispatches (`--dispatch`), rollback is best-effort: a failed undo does not stop the rest, and the result reports each one.

### "Workflow cannot be run" state error
A workflow can only be run from `pending` or `running` states. If it is in `draft`, call `confirm_draft()` first. If it is in `completed` or `failed`, create a new workflow -- completed workflows cannot be re-run.

### vmware-policy dependency missing
Pilot requires `vmware-policy` for the `@vmware_tool` decorator and audit logging. It is declared as a dependency in `pyproject.toml` and should install automatically. If missing, run `pip install vmware-policy` or reinstall pilot.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The eval prompts are broad, action-oriented natural-language requests that can trigger powerful multi-step VMware workflows without tightly constraining target systems, environment boundaries, or required confirmations beyond a few expected checks. In an orchestration skill that can coordinate infrastructure, networking, security, and remediation actions, this ambiguity increases the chance of overbroad execution, unsafe scope expansion, or misuse through prompt phrasing.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · references/agent-guardrails.md (reported line 138)May include surrounding context.

md

| Symptom | Mitigation |
|---|---|
| Describes a tool call, or emits a JSON example, instead of executing it | The "never describe a tool call" rule above. Also check your harness is not echoing tool schemas into context — models imitate the nearest format they see. |
| Long tool responses: omits items, or reports "no data returned" when data was present | Ask for explicit limits so responses stay small. Pilot's lists have no truncation envelope, so verify long results rather than trusting the summary. |
| Adds generic recommendations unsupported by results | The "analysis discipline" rules. |
| Drops requested fields or reorders results | State the required fields and ordering in the request itself. In a workflow, reordering the steps changes what the plan does. |
| Multi-tool workflows take 30–50s end to end | Start from a built-in template with `create_workflow_from_template` rather than designing from scratch; `get_workflow_status` returns state and audit log together. |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/capabilities.md (reported line 13)May include surrounding context.

md

| 4 | `update_draft` | medium | Design | Edit draft workflow steps, name, or description |
| 5 | `confirm_draft` | medium | Design | Finalize draft → state changes to PENDING |
| 6 | `create_workflow_from_template` | medium | Execute | Create workflow from built-in/custom template |
| 7 | `create_workflow` | medium | Execute | Create custom workflow from step list (refused if a destructive step has no approval gate before it) |
| 8 | `run_workflow` | medium | Execute | Execute workflow, pauses at approval gates |
| 9 | `approve` | high | Control | Human approval to continue past approval gate |
| 10 | `rollback` | high | Control | Explicit, best-effort undo of steps pilot recorded as succeeded, in reverse order — never automatic. Previews (`blast_radius`) unless `confirm=True` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/integration-patterns.md (reported line 270)May include surrounding context.

md

| 4 | `update_draft` | medium | Design | Edit draft workflow steps, name, or description |
| 5 | `confirm_draft` | medium | Design | Finalize draft → state changes to PENDING |
| 6 | `create_workflow_from_template` | medium | Execute | Create workflow from built-in/custom template |
| 7 | `create_workflow` | medium | Execute | Create custom workflow from step list (refused if a destructive step has no approval gate before it) |
| 8 | `run_workflow` | medium | Execute | Execute workflow, pauses at approval gates |
| 9 | `approve` | high | Control | Human approval to continue past approval gate |
| 10 | `rollback` | high | Control | Explicit, best-effort undo of steps pilot recorded as succeeded, in reverse order — never automatic. Previews (`blast_radius`) unless `confirm=True` |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cli-reference.md (reported line 60)May include surrounding context.

design_workflow

Create a draft workflow from natural language description.

text

design_workflow(

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/integration-patterns.md (reported line 81)May include surrounding context.

aria.get_remaining_capacity -> Confirm capacity exists aria.list_rightsizing_recommendations -> Validate change is reasonable [APPROVAL GATE] -> Human confirms the plan aiops.create_vm_plan -> Create batch operation plan aiops.apply_vm_plan -> Execute the plan monitor.get_alarms -> Verify no new alarms

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 112)May include surrounding context.

By default the MCP server offers every tool. To offer only read tools, start it with --expose read, or set VMWARE_PILOT_MCP_EXPOSE=read in the MCP client's env block (useful when the client launches vmware-pilot mcp itself). To offer chosen write tools as well, add --allow-write with a comma-separated list (or VMWARE_PILOT_MCP_ALLOW_WRITE):

bash

vmware-pilot mcp --expose read --allow-write cancel_workflow

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/templates.md (reported line 157)May include surrounding context.

md

## 4. compliance_scan

**Purpose**: Periodic read-only health scan across monitor and aria. No approval gate needed (all steps are non-destructive).

**Steps** (3, variable):

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/templates.md (reported line 464)May include surrounding context.

md

## 4. compliance_scan

**Purpose**: Periodic read-only health scan across monitor and aria. No approval gate needed (all steps are non-destructive).

**Steps** (3, variable):

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/templates.md (reported line 512)May include surrounding context.

md

## 4. compliance_scan

**Purpose**: Periodic read-only health scan across monitor and aria. No approval gate needed (all steps are non-destructive).

**Steps** (3, variable):

Static analysis

No suspicious patterns detected.