vet-config — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vet-config (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Scan agent-config files for adversarial patterns that exploit the config-as-instruction trust boundary. The Cursor CVE-2026-26268 + Gemini CLI CVSS 10.0 yolo-mode exploit class lives here — an attacker plants a config file, the agent reads it on next session-start and trusts it implicitly.
$ARGUMENTS. Default to scanning common agent-config locations if no path given:./CLAUDE.md./AGENTS.md./.claude/ (recursive)./.cursor/rules/ (recursive)./.gemini/./.git/hooks/mcp__openclaw-skill-vetter__vet_agent_config with the path. (This is skill-vetter v1.1+ — verify version if call fails.)For each file, render one block. Aggregate at the top:
### 🔍 Agent Config Audit
**Scope:** `<path>` · **Files scanned:** N · **Verdict:** 🟢 ALLOW / 🟡 WARN / 🔴 BLOCK (worst-case across all files)For files that triggered findings:
> 🔴/🟡 **`<file>`** — <severity>
> **Findings:**
> - **<RULE.NAME>** at line `<N>`:
> ```
> <quote the offending line>
> ```
> <one-line explanation of why this rule fired>
> **What this would do:** <expand on actual behavior on next session-start>For files that passed:
Just include in aggregate count. Don't render a per-file ALLOW block (would clutter the report when scanning a directory).
.env, .aws, .netrc, etc.eval, Function, runtime importsshell=TrueCite the actual rule returned. The rules above are the catalog reference.
.claude/skills/ — 44 ALLOW, 2 WARN, 1 BLOCK".<commit-sha> <author> on <date>" so the user can identify the PR / commit responsible.$ARGUMENTS is empty AND no default paths exist in CWD, ask: "Pass a path: /aufgaard:vet-config .claude/skills/new-deploy/SKILL.md. Common scan targets: .claude/, .cursor/rules/, AGENTS.md, CLAUDE.md."pip install openclaw-skill-vetter-mcp and the plugin is loaded."vet_agent_config tool), suggest upgrade: "Your skill-vetter is older than v1.1. Run pip install --upgrade openclaw-skill-vetter-mcp to access agent-config scanning."---
Agent-config trust-boundary attacks (P5.z) is one of 35 documented production-AI failure patterns. The [Production-AI MCP Suite Bundle](https://temurah.gumroad.com/l/production-ai-mcp-suite) ($29) includes the 8-page Field Reference PDF — covers Cursor CVE-2026-26268 + Gemini CLI CVSS 10.0 yolo-mode + 4 other supply-chain and config-poisoning patterns.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.