Findings & checks · 2 flagged
HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · agents/skill-vetter-officer.md×2
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
Show all 2 locations
- Delete the
ignore/disregard/forget … previous instructionssentence. - If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Aufgaard — Production AI Operations Suite
Operator cockpit for production AI. 7 MCPs + 13 skills + 6 hooks + 5 monitors. Catches dangerous bash, cost spikes, agent-config attacks, output-action divergence, silent cron failures, supply-chain risks, and unsafe upgrades.
What this is
A single Claude Code (and Cursor) plugin that wraps seven production-AI safety + observability MCP servers in a coherent operator experience: invocable skills, automatic safety hooks, background monitors that surface failures proactively, and specialized subagents for heavy work.
The seven MCPs:
| Server | Catches |
|---|---|
silentwatch-mcp | Cron silent failures (exit-0 with empty output, length anomalies, retry storms) |
openclaw-health-mcp | Runtime deployment vitals — gateway, plugins, errors, OOM history |
openclaw-cost-tracker-mcp | Per-agent cost attribution + 429-window prediction across providers |
openclaw-skill-vetter-mcp | Malicious skills / agent-config attacks (CVE-class supply-chain risks) |
openclaw-upgrade-orchestrator-mcp | Upgrade regression risk (catalog of known-bad versions + provider-side drift detection) |
openclaw-output-vetter-mcp | Output-action divergence (agent claims vs actual state) + grounding failures |
bash-vet-mcp | LLM-emitted destructive shell commands (30 rules across 8 families) |
Install
Quick install (Claude Code, after marketplace listing)
/plugin install aufgaardLocal install (development / pre-marketplace)
git clone https://github.com/temurkhan13/aufgaard
cd aufgaard
claude --plugin-dir .Cursor (after marketplace listing)
Open Cursor → Marketplace → search "Aufgaard" → Install.
What you get when activated
Visible by default — no invocation required:
- 🟢 SessionStart auto-report: deployment health + yesterday's spend, surfaced the moment you open Claude Code
- ⛔ PreToolUse hooks block dangerous bash + flag malicious agent-config files before they land
- 🔔 Background monitors push notifications when 429 is imminent, when silent failures are detected, when known-regression upgrades land
Invocable on demand:
/aufgaard:production-audit— one-page 35-pattern audit calling all 7 MCPs in parallel/aufgaard:cost-overview— current spend + 429 prediction + cheaper-routing recs/aufgaard:vet-bash <command>— vet a specific shell command before running/aufgaard:should-i-upgrade <package>— pre-upgrade safety check/aufgaard:silent-failures— recent silent-failure detections from cron / scheduled jobs/aufgaard:health-check— current deployment vitals/aufgaard:verify-claim— verify an agent's "I did X" claim against actual state- ...and more (see docs/skills.md)
How this fits into your workflow
The plugin's job is to give you eyes on what your production agents are doing — without you having to ask. Each session opens with a health summary. Dangerous bash gets blocked automatically. Cost spikes ping you before they become billing surprises. Malicious agent-config files in PRs get flagged before they activate.
For the full pattern catalogue (35 production-AI failure modes mapped to MCP coverage), get the Production-AI MCP Suite Bundle — includes the 8-page Field Reference PDF + Welcome.md decision tree.
Compatibility
- Claude Code: native — install via
/plugin install aufgaardorclaude --plugin-dir - Cursor: native — same files, dual config dirs (
.claude-plugin/+.cursor-plugin/) - OpenClaw / Anthropic Console: inherits via Claude Code
- Codex / Windsurf / Continue.dev: the underlying 7 MCPs work via MCP standard; full plugin support TBD
Underlying MCPs (also installable standalone)
If you only want one or two MCPs without the plugin packaging:
pip install silentwatch-mcp openclaw-health-mcp openclaw-cost-tracker-mcp \
openclaw-skill-vetter-mcp openclaw-upgrade-orchestrator-mcp \
openclaw-output-vetter-mcp bash-vet-mcpEach MCP has its own GitHub repo with detailed README, test suite, and CI.
Status
v1.0 — in development (2026-05). This README documents the target shape. Tracking progress: see IMPLEMENTATION-PLAN.md.
License
MIT — see LICENSE. Use freely in your stack, fork it, ship under your own brand if helpful.