cisco-ai-defense/defenseclaw

Why it got this result

Every route registered in APIServer.Run is wrapped by tokenAuth, which requires a bearer credential (Authorization: Bearer / X-DefenseClaw-Token / X-DC-Auth) compared via constant-time SHA-256 digest comparison (constantTimeStringMatch) against the gateway token generated with crypto/rand at first boot (EnsureGatewayToken). The only unauthenticated route is GET /health. Fail-open is explicitly rejected: tokenAuth fails CLOSED (503) when no token is configured rather than falling back to 'trust loopback' (the code comment calls out that this was a prior local-IDOR risk it fixed). Default bind is loopback (127.0.0.1); a non-default remote bind still requires the same token. Scoped credential paths (OTLP, hook, ACP) each perform their own secret comparison (constantTimeStringMatch / HMAC) rather than accepting an identifier alone.

Why it matters

Prevents unauthorized tool use and data access.

Evidence

func (a *APIServer) tokenAuth(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path == "/health" && r.Method == http.MethodGet {
			next.ServeHTTP(w, r)
			return
		}

	handler := apiBodyLimitMiddleware(mux, apiRequestBodyMaxBytes, otlpRequestBodyMaxBytes)
	handler = a.apiCSRFProtect(handler)
	handler = a.tokenAuth(handler)

		expected := ""
		if a.scannerCfg != nil {
			expected = a.scannerCfg.Gateway.Token
		}
		if expected == "" {
			// Fail closed when no token is configured. ...
			a.emitHTTPAuthFailure(ctx, r, route, gatewaylog.ErrCodeAuthMissingToken, "no_token_configured")
			http.Error(w, `{"error":"sidecar misconfigured: no gateway token"}`, http.StatusServiceUnavailable)
			return
		}

+2 more locations in the finding JSON

Why it got this result

The gateway sidecar's HTTP management API (internal/gateway/api.go) binds loopback by default (viper default gateway.api_port with APIBindHost() returning 127.0.0.1 when unset) and validates Origin/Sec-Fetch-Site/Content-Type/X-DefenseClaw-Client on every mutating request. apiCSRFProtect rejects any Origin that is not localhost/127.0.0.1/::1 and rejects cross-site Sec-Fetch-Site values outright, which defeats DNS-rebinding/browser-hijack attempts even if a non-default bind were configured.

Why it matters

Prevents DNS rebinding/browser hijack of local or remote MCP.

Evidence

func (a *APIServer) apiCSRFProtect(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
...
		if sfs := r.Header.Get("Sec-Fetch-Site"); sfs != "" {
			if sfs != "same-origin" && sfs != "none" {
				a.emitHTTPAuthFailure(ctx, r, route, gatewaylog.ErrCodeAuthCSRFMismatch, "sec_fetch_site_rejected")
				http.Error(w, `{"error":"cross-site request rejected"}`, http.StatusForbidden)
				return
			}
		}

func isLocalhostOrigin(origin string) bool {
	u, err := url.Parse(origin)
	if err != nil {
		return false
	}
	host := u.Hostname()
	return host == "127.0.0.1" || host == "localhost" || host == "::1"
}

func APIBindHost(cfg *Config) string {
	if cfg == nil || cfg.Gateway.APIBind == "" {
		return "127.0.0.1"
	}
	return cfg.Gateway.APIBind
}

Why it got this result

Default bind for both the management API (gateway.api_bind) and the guardrail proxy (guardrail.host) is 127.0.0.1; guardrailListenAddr() canonicalizes any loopback-spelled host to 127.0.0.1. Every mutating / sensitive route requires a bearer token (tokenAuth) compared with constant-time SHA-256 compare, so even an operator-chosen non-default bind is not auth-less. Managed-enterprise deployments additionally hard-fail config load if the bind is not exactly 127.0.0.1 (validateManagedEnterpriseListenerBindings).

Why it matters

LAN/Internet exposure enables remote exploitation.

Evidence

func guardrailListenAddr(port int, effectiveHost string) string {
	h := strings.TrimSpace(effectiveHost)
	if h == "" {
		h = "localhost"
	}
	switch strings.ToLower(h) {
	case "localhost", "127.0.0.1", "::1", "[::1]":
		return fmt.Sprintf("127.0.0.1:%d", port)
	default:
		return fmt.Sprintf("%s:%d", h, port)
	}
}

func validateManagedEnterpriseListenerBindings(cfg *Config) error {
	if cfg == nil || !managed.IsManagedEnterprise(cfg.DeploymentMode) {
		return nil
	}
	apiBind := cfg.Gateway.APIBind
	if apiBind == "" {
		cfg.Gateway.APIBind = "127.0.0.1"
		apiBind = cfg.Gateway.APIBind
	}
	if apiBind != "127.0.0.1" {
		return fmt.Errorf(
			"config: managed_enterprise gateway API must bind to exact canonical 127.0.0.1, got %q",
			apiBind,
		)
…

		expected := ""
		if a.scannerCfg != nil {
			expected = a.scannerCfg.Gateway.Token
		}
		if expected == "" {
			a.emitHTTPAuthFailure(ctx, r, route, gatewaylog.ErrCodeAuthMissingToken, "no_token_configured")
			http.Error(w, `{"error":"sidecar misconfigured: no gateway token"}`, http.StatusServiceUnavailable)
			return
		}

Why it got this result

No Access-Control-Allow-Origin header is ever set by the gateway (grepped repo-wide: zero occurrences in internal/gateway/*.go outside tests/vendor), so there is no wildcard-with-credentials CORS configuration to misuse. The gateway instead rejects any non-localhost Origin outright (see ATR-M0003 evidence) rather than reflecting/wildcarding it.

Why it matters

Prevents credentialed cross-origin abuse.

Evidence

		if origin := r.Header.Get("Origin"); origin != "" {
			if !isLocalhostOrigin(origin) {
				a.emitHTTPAuthFailure(ctx, r, route, gatewaylog.ErrCodeAuthOriginBlocked, "origin_blocked")
				http.Error(w, `{"error":"non-localhost Origin rejected"}`, http.StatusForbidden)
				return
			}
		}

Why it got this result

The gateway does not implement an OAuth proxy / confused-deputy-prone token-exchange pattern on behalf of multiple downstream MCP clients; it has no OAuth client-registration or token-issuance code at all (see ATR-M0005). There is therefore no per-client consent surface for this rule to evaluate.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Evidence

func (a *APIServer) Run(ctx context.Context) error {
	mux := http.NewServeMux()
	mux.HandleFunc(enterprisepolicy.ForeignHookSessionPathPrefix+"{connector}", a.handleForeignHookSession)

Why it got this result

The gateway sidecar does not itself register/serve MCP tool definitions to an LLM client (no @mcp.tool/registerTool/server.tool pattern anywhere in the repo, confirmed by repo-wide grep). It is a REST management/inspection API consumed by DefenseClaw's own hook scripts, CLI, and TUI -- its job is to scan and govern OTHER agents' MCP tool definitions (via /v1/mcp/scan), not to publish its own tool manifest to a model. There is therefore no tool-definition hot-reload/signature surface for this rule to evaluate on this component.

Why it matters

Prevents rug-pull tool poisoning.

Evidence

func (a *APIServer) handleToolsCatalog(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodGet {
		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
		return

Why it got this result

This component exposes no MCP tools of its own to an LLM client (see ATR-M0001); its REST endpoints are a management surface for DefenseClaw's own CLI/hooks/TUI, all gated by a single shared bearer token with per-route scoping (hook-scoped, ACP-scoped, OTLP-scoped credentials) rather than per-tool capability scoping. The rule's 'overprivileged tool' model (generic exec tool reachable by any request) does not map onto this architecture.

Why it matters

Limits blast radius and privilege escalation.

Evidence

func (a *APIServer) Run(ctx context.Context) error {
	mux := http.NewServeMux()
	mux.HandleFunc(enterprisepolicy.ForeignHookSessionPathPrefix+"{connector}", a.handleForeignHookSession)

Why it got this result

This component publishes no MCP tool names to a model (see ATR-M0001); there is no tool namespace for a spoofing/collision attack to target. (Note: DefenseClaw's product purpose elsewhere is precisely to detect tool-name collision/spoofing in OTHER agents' MCP servers via its scanner, e.g. cli/defenseclaw/scanner/mcp.py, but that is the scanner CLI/feature, not this component's own tool surface.)

Why it matters

Prevents malicious tool shadowing.

Evidence

func (a *APIServer) handleMCPs(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodGet {
		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)

Why it got this result

This component has no tool descriptions of its own presented to a model (see ATR-M0001); there is no tool-description metadata surface for prompt injection to target on this component.

Why it matters

Prevents covert model manipulation.

Evidence

func (a *APIServer) Run(ctx context.Context) error {
	mux := http.NewServeMux()
	mux.HandleFunc(enterprisepolicy.ForeignHookSessionPathPrefix+"{connector}", a.handleForeignHookSession)

Why it got this result

This is a documentation-only contributor skill (SKILL.md + reference/*.md, no bundled scripts) describing how to add a DefenseClaw connector. It bundles no executable code at all, so there is no undisclosed runtime capability to evaluate -- its only 'behavior' is the text itself, which matches its declared purpose (engineering guidance).

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: defenseclaw-add-connector
description: Use when adding or changing a DefenseClaw connector for a new AI agent ...
---

Why it got this result

The instruction body describes engineering rules for adding connectors (fail-closed behavior, enterprise guard requirements, never bypassing admin-owned hook paths); it never instructs the agent to suppress a confirmation, hide an action from the user, or subvert a guardrail -- if anything it repeatedly insists on fail-closed, admin-owned gates (e.g. rule 10: 'a guarded connector must run the admin-owned ... never a user-writable script').

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

10. **Enterprise guard:** a guarded connector must run the admin-owned `defenseclaw-hook ... --enterprise-managed` (or call `--foreign-hook-check`), never a user-writable script (Devin, `0f728f8b`).

Why it got this result

No manifest permission/capability declaration exists beyond the SKILL.md frontmatter name/description (no ai-plugin.json-style permission list); it ships no executable code, so there is no capability for the declared scope to over-reach.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: defenseclaw-add-connector
description: Use when adding or changing a DefenseClaw connector for a new AI agent ...
---

Why it got this result

Scanned SKILL.md and all reference/*.md files for concealment codepoints (zero-width, bidi override, BOM mid-content) -- none found. No 'ignore previous instructions'-style injection language present.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: defenseclaw-add-connector
description: Use when adding or changing a DefenseClaw connector for a new AI agent (a vendor command hook, in-agent plugin, policy bridge, LLM proxy or ACP route). ...
---

Why it got this result

Shipped as static markdown inside the repo's own version control; no runtime instruction fetch, no self-updater, no external package registry dependency. Changes are reviewed through the same PR process as the rest of the codebase.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

Verified against `fix/enterprise-hardening` at `fc9e12a2`. The references name files and symbols, not line numbers. ...

Why it got this result

First-party contributor skill named after the project itself ('defenseclaw-add-connector'); no third-party brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: defenseclaw-add-connector

Why it got this result

This skill is documentation-only (SKILL.md + reference markdown, no bundled code) and implements no host-credential or conversation/memory read mechanism; ATR-P0003 defines applicability by the existence of such a harvest step, which this artifact does not have, so the rule does not apply to it.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

---
name: defenseclaw-add-connector
description: Use when adding or changing a DefenseClaw connector ...
---

Why it got this result

This skill ships no scripts, hooks, entry code, host configuration, dotenv files, or exec-enabling assignments -- only SKILL.md and reference markdown. The documented 'defenseclaw setup' flow describes the separate DefenseClaw product's own setup tooling, not a format-native execution or persistence primitive shipped by this skill itself, so the rule does not apply.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

defenseclaw setup <x>   (Python)                      defenseclaw-gateway   (Go)
  contract + platform check (hook_contracts.json)
  writes config.yaml + <data_dir>/picked_connector
  restarts the gateway  ----------------------------> Connector.Setup(SetupOpts)

Why it got this result

The only bundled script, scripts/check_skill_fresh.py, performs exactly what its docstring/SKILL.md describe: read-only repo-local checks (git grep, Makefile parsing, markdown scanning) with 'Standard library only, no network' stated and verified by code -- its only subprocess calls are local git grep/git log invocations, no outbound network, no credential access, no eval/exec of remote content.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

It also enforces the size limits (SKILL.md 200 lines, checklist 340, other
reference files 300), the frontmatter name, that every reference file is
linked from SKILL.md, and the ID rules: ...

Exit codes: 0 no drift, 1 drift, 2 the script could not run.
Standard library only, no network.

def preload_symbols(root: str, symbols: set[str]) -> None:
    """Find every symbol with one git grep (one process per symbol is too slow)."""
    global _FOUND
    _FOUND = set()
    if not symbols:
        return
    cmd = ["git", "grep", "-h", "-o", "-F", "-w"]

Why it got this result

The design principles explicitly mandate the OPPOSITE of consent suppression: 'Fail closed, never silently lenient', 'Managed hosts never allow what policy denies', and a stop-and-ask list for risky changes. No directive instructs the agent to skip user confirmation or hide a privileged action.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

2. **Fail closed, never silently lenient.** A failed lookup, bad pack, missing scan result or unreachable gateway resolves to the stricter outcome, with a reason code. Removed keys say what replaced them. (POL, ID, CFG)
3. **Managed hosts never allow what policy denies.** ...

Why it got this result

check_skill_fresh.py writes nothing to any host config/memory/control-plane file; it only reads the repo tree and prints a pass/fail exit code, with no self-update or persistence mechanism.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

Exit codes: 0 no drift, 1 drift, 2 the script could not run.
Standard library only, no network.

Why it got this result

No formal permission manifest; the sole bundled script's capability (local git/make subprocess calls, no network) is intrinsic to and narrower than its declared purpose of verifying the skill's own freshness against the repo.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

#!/usr/bin/env python3
# Copyright 2026 Cisco Systems, Inc. and its affiliates
# SPDX-License-Identifier: Apache-2.0
"""Check that the defenseclaw-develop skill still matches the repository.

Why it got this result

Scanned SKILL.md and all reference/*.md files for concealment codepoints -- none found; no injected override directives present in the instruction body.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: defenseclaw-develop
description: Use before writing or reviewing any DefenseClaw change that is not a new connector ...
---

Why it got this result

Shipped as static markdown + a local verification script inside the repo's own version control; no runtime instruction fetch or self-updater. The bundled script's own purpose is to DETECT drift between this skill and the repo (anti-rug-pull tooling), reinforcing integrity rather than undermining it.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

Source code and tests are authoritative. Last full sweep: not yet run (set by the first quarterly sweep). If this skill disagrees with them, trust the code and fix the skill (`reference/maintenance.md`).

Why it got this result

First-party contributor skill named after the project itself; no third-party brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: defenseclaw-develop

Why it got this result

The bundled validator (check_skill_fresh.py) reads only repository files and local git/make command output to check skill freshness; it does not read host credentials, SSH keys, cloud metadata, or live conversation/memory context. Because ATR-P0003 is scoped to artifacts with an existing credential/conversation harvest step, and this script has none, the rule's harvest subject does not exist here.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

Standard library only, no network.

Why it got this result

SKILL.md explicitly discloses that the TUI runs the DefenseClaw CLI as a subprocess, and demo.py's --real-exec option is clearly labeled as an opt-in mode that isolates HOME while invoking confirmed CLI commands. This capability is therefore transparent and disclosed rather than a shadow feature: the skill's declared purpose (developing/testing the TUI, which wraps the CLI) matches its actual subprocess-execution behavior.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: defenseclaw-tui
description: Improve the DefenseClaw Textual TUI (cli/defenseclaw/tui) consistently. ...

Why it got this result

The skill's golden rules explicitly REQUIRE confirmation for destructive flows ('Destructive intents set risk="destructive" and go through ConsequenceModalScreen(danger=True)') and forbid the TUI from mutating state outside of previewed CLI intents -- this is a consent-preserving design, not a subversion of it.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

2. **Mutate only through CLI intents.** Flow: `model.handle_key` -> action/intent ->
   `_confirm_and_run_intent` -> `CommandPreviewScreen` ->
   `CommandExecutor` -> `_handle_successful_command` refresh. Destructive
   intents set `risk="destructive"` and go through
   `ConsequenceModalScreen(danger=True)`.

Why it got this result

Bundled scripts contain no network calls and no credential-file reads (grepped for requests/urllib/socket/os.environ secret patterns -- none found); the skill's own rule 3 explicitly protects secrets ('Send secrets over stdin, never argv ... Secrets never appear in the preview, the Activity log or argv'), the opposite of an exfiltration directive.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

3. **Send secrets over stdin, never argv.** Set `intent.secret_stdin` and use
   `--value-stdin` (for example `keys set NAME --value-stdin`). Secrets never
   appear in the preview, the Activity log or argv. `click.prompt(hide_input)`
   and getpass ignore piped stdin.

Why it got this result

The skill's own golden rules require all mutation to go through previewed, confirmed CLI intents (CommandPreviewScreen before CommandExecutor); there is no covert or undisclosed self-persistence path, and the bundled scripts (render/demo/touchpoints/gap_audit) perform no writes to host control-plane files.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

2. **Mutate only through CLI intents.** Flow: `model.handle_key` -> action/intent ->
   `_confirm_and_run_intent` -> `CommandPreviewScreen` ->
   `CommandExecutor` -> `_handle_successful_command` refresh.

Why it got this result

No formal permission manifest exists; the bundled helpers are not strictly read-only -- render.py can write a requested SVG file via its --svg option, and demo.py can execute confirmed DefenseClaw CLI actions under its opt-in --real-exec mode -- but both capabilities are explicitly documented and intrinsic to the contributor skill's declared purpose of developing and testing the TUI, not hidden privilege in a passive-looking package.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: defenseclaw-tui
description: Improve the DefenseClaw Textual TUI (cli/defenseclaw/tui) consistently. ...

Why it got this result

Scanned SKILL.md and all references/*.md files for concealment codepoints -- none found; no injected override directives present.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: defenseclaw-tui
description: Improve the DefenseClaw Textual TUI (cli/defenseclaw/tui) consistently. ...
---

Why it got this result

Shipped as static markdown + local scripts inside the repo's own version control; no runtime instruction fetch or self-updater present.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: defenseclaw-tui
description: Improve the DefenseClaw Textual TUI (cli/defenseclaw/tui) consistently. ...
---

Why it got this result

First-party contributor skill named after the project itself; no third-party brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: defenseclaw-tui

Why it got this result

SKILL.md's compatibility field explicitly discloses: 'Optional self-check (main.py) calls the local DefenseClaw gateway over the loopback network'. main.py's only network action is a POST to a strictly-validated loopback/operator-configured HTTP(S) origin (DEFENSECLAW_SIDECAR_URL, default 127.0.0.1:18790) carrying a temp file path for a code scan, matching the declared purpose exactly. No credential harvesting, no undeclared subprocess/eval, no third-party egress -- the skill.yaml declares permissions: [read-only] and capabilities: [text-generation, code-generation], consistent with main.py's behavior (writes a temp file it owns and deletes, reads an HTTP JSON response).

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: codeguard
description: "Security-aware code generation ..."
license: Apache-2.0
compatibility: "Optional self-check (main.py) calls the local DefenseClaw gateway over the loopback network"
---

def _scan_via_sidecar(path: str) -> str:
    endpoint = _validated_scan_url(SIDECAR_URL)
    if endpoint is None:
        return "error: DEFENSECLAW_SIDECAR_URL must be a valid HTTP(S) origin"
    payload = json.dumps({"path": path}).encode("utf-8")
    request = Request(
        endpoint, data=payload,
        headers={"Content-Type": "application/json", "X-DefenseClaw-Client": "codeguard-skill"},
        method="POST",
    )

Why it got this result

SKILL.md explicitly states the scanner's findings are advisory ('This is an optional self-verification step; the sidecar's inspectToolPolicy enforces rules regardless'), so the skill cannot be used to suppress or bypass the host's own enforcement gate; it has no language instructing the agent to skip confirmations, hide actions, or override any human-in-the-loop control.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

"""CodeGuard self-check tool for OpenClaw agents.

Allows the agent to validate code against CodeGuard rules before writing it,
via the DefenseClaw sidecar API.  This is an optional self-verification step;
the sidecar's inspectToolPolicy enforces rules regardless.
"""

Why it got this result

main.py makes a single bounded HTTP POST to a validated local origin and reads/deletes its own temp file; it never writes to any host config/memory/control-plane file, never sets environment variables with command-exec semantics, and never persists a directive beyond the current call.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

    with tempfile.NamedTemporaryFile(
        mode="w", suffix=ext, delete=False, prefix="codeguard-check-"
    ) as tmp:
        tmp.write(code)
        tmp_path = tmp.name
    try:
        return _scan_via_sidecar(tmp_path)
    finally:
        try:
            os.unlink(tmp_path)
        except OSError:
            pass

Why it got this result

skill.yaml declares permissions: [read-only] and capabilities: [text-generation, code-generation]; the actual code performs one bounded, read-only-equivalent action (an HTTP POST of a temp-file path to a local scan endpoint, reading back JSON) with no filesystem write outside its own throwaway temp file, no shell exec, no broad network reach. Scope matches declaration.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: codeguard
version: "1.0.0"
description: Security-aware code generation ...
capabilities:
  - text-generation
  - code-generation
permissions:
  - read-only

Why it got this result

Scanned SKILL.md for bidi-override/zero-width/Tag-block codepoints (U+200B/U+200C/U+200D/U+FEFF/U+202A-E/U+2066-9) -- none found. All example/control-token text sits inside fenced code blocks rendered as literal examples, not active instructions.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: codeguard
description: "Security-aware code generation — teaches the agent CodeGuard rules to write secure code by default"
license: Apache-2.0
compatibility: "Optional self-check (main.py) calls the local DefenseClaw gateway over the loopback network"
---

Why it got this result

The skill is shipped fully declaratively inside this repo (SKILL.md + main.py + skill.yaml), versioned (1.0.0) in the same git history and release process as the rest of DefenseClaw; main.py fetches no instructions/code at runtime and has no self-update mechanism. The only runtime network action fetches scan RESULTS from the local sidecar for the data just submitted -- not a mutation of the skill's own instructions or manifest -- matching the false-positive guard for a runtime fetch of the tool's own declared-job data.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

name: codeguard
version: "1.0.0"
description: Security-aware code generation — teaches the agent CodeGuard rules to write secure code by default
author: defenseclaw

Why it got this result

Name 'codeguard' with author 'defenseclaw' is the project's own first-party skill, published inside its own repository under its own brand; no similarity to or impersonation of a known third-party brand/tool name was found.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: codeguard
version: "1.0.0"
description: Security-aware code generation — teaches the agent CodeGuard rules to write secure code by default
author: defenseclaw

Why it got this result

main.py's run(code, filename) tool accepts source code and a filename as explicit arguments and reads only the DEFENSECLAW_SIDECAR_URL environment variable (configuration, not a credential or conversation/memory source); it has no mechanism to obtain host credentials, SSH keys, cloud metadata, or live conversation/memory context. Because ATR-P0003 is scoped to artifacts with an existing credential/conversation harvest step, and this tool has none, no harvest/exfiltration pair can arise here.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

def run(code: str, filename: str = "check.py") -> str:
    ext = os.path.splitext(filename)[1] or ".py"
    with tempfile.NamedTemporaryFile(
        mode="w", suffix=ext, delete=False, prefix="codeguard-check-"
    ) as tmp:
        tmp.write(code)
        tmp_path = tmp.name
    try:
        return _scan_via_sidecar(tmp_path)
    finally:
        try:
            os.unlink(tmp_path)
        except OSError:
            pass

def _validated_scan_url(base_url: str) -> str | None:
    ...
    if parsed.scheme.lower() not in {"http", "https"}:
        return None
    if not parsed.hostname or parsed.username is not None or parsed.password is not None:
        return None

Why it got this result

The fixture declares an identity ('parity-fixture') in its SKILL.md, so the impersonation/typosquatting rule is applicable to it. The name is a neutral, descriptive fixture label bearing no resemblance to any known third-party brand or publisher, so the declared identity is benign.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: parity-fixture

Why it got this result

This is a test fixture (under testdata/) used by internal/guardrail/artifact_scan_test.go and cli/tests/test_rulepack_overlay_python_source.py to validate the AWS-key rule pack; it is not a shipped product skill (per scan-workflow guidance, test fixtures under testdata/ are not shipped components). Its deliberately-planted AWS-key-shaped strings (scripts/docstring.py, scripts/comment.py) are the intended test input for the scanner's rule pack, not a concealed capability of a real shipped skill.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: parity-fixture
description: Fixture for the rule-pack parity test of install admission and skill scan.
---
# Parity fixture

Runs `scripts/docstring.py` and `scripts/comment.py`.

Why it got this result

Test fixture under testdata/, not a shipped skill (see ATR-P0001 rationale for this component). Its one-line instruction body ('Runs scripts/docstring.py and scripts/comment.py') contains no consent-related directive at all.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

# Parity fixture

Runs `scripts/docstring.py` and `scripts/comment.py`.

Why it got this result

The documentation-example AWS-key-shaped string exists only in an inert fixture docstring (scripts/docstring.py) with no credential source, conversation read, or outbound exfiltration path; the fixture is test input for the rule pack, not a shipped skill with a harvest/exfiltration capability.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

"""Parity fixture: the example key sits only in this docstring.

Example access key from the AWS documentation: [REDACTED]
"""


def run():
    return 0

Why it got this result

Test fixture under testdata/, not a shipped skill; its scripts only return 0 with no persistence or execution behavior.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

def run():
    # Example access key from the AWS documentation: [REDACTED]
    return 0

Why it got this result

Test fixture under testdata/, not a shipped skill; declares no permission manifest and ships only no-op scripts.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: parity-fixture
description: Fixture for the rule-pack parity test of install admission and skill scan.
---

Why it got this result

Test fixture under testdata/, not a shipped skill; scanned for concealment codepoints -- none found, and its one-line instruction body carries no directive at all.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: parity-fixture
description: Fixture for the rule-pack parity test of install admission and skill scan.
---
# Parity fixture

Runs `scripts/docstring.py` and `scripts/comment.py`.

Why it got this result

Test fixture under testdata/, not a shipped skill with any provenance/distribution concerns of its own.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: parity-fixture
description: Fixture for the rule-pack parity test of install admission and skill scan.
---