Skills/Glama/aegis

aegis@r1

CAUTION

Publisher claims: "Aegis sits between AI agents (Claude Code, LangGraph, CrewAI, AutoGen, custom MCP tools) and real-world APIs or databases. It stops prompt injections, rogue tool calls, and credential leakage before they hit your infrastructure, completely open source." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher augastinklazar · joined 0 days agoInstalls 0Last detonated 2 h ago
What would fix thisWatchDispute verdict

Is aegis@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Destructive command against a filesystem root or device. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsinternal/sandbox/evaluate_handler_test.go:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinternal/e2e/e2e_usecases_test.go:253 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Destructive command against a filesystem root or deviceinternal/sandbox/sandbox_test.go:58 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedinternal/sandbox/sandbox_test.go:58 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Outbound HTTP to raw IP addressinternal/hitl/webauthn.go:70 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsinternal/sandbox/bash_guard.go:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Stripe-like API key pattern detectedinternal/e2e/e2e_usecases_test.go:45 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Telegram Bot API URLinternal/hitl/notifiers/notifier.go:87 · Telegram Bot API URL — data will be sent to TelegramFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
CRITICAL
Destructive command against a filesystem root or deviceinternal/e2e/e2e_usecases_test.go:264 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Stripe-like API key pattern detectedinternal/vault/vault_test.go:28 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Stripe-like API key pattern detectedinternal/proxy/proxy_test.go:39 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
CRITICAL
Destructive command against a filesystem root or deviceinternal/sandbox/sandbox_test.go:59 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedinternal/sandbox/bash_guard.go:75 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsinternal/sandbox/bash_guard.go:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinternal/sandbox/sandbox_test.go:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedinternal/sandbox/sandbox_test.go:61 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedinternal/e2e/e2e_usecases_test.go:264 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathspolicies/presets/filesystem-sandbox.yaml:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL using raw IP addressinternal/hitl/webauthn.go:70 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Destructive file system command detectedinternal/sandbox/sandbox_test.go:59 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or deviceinternal/sandbox/sandbox_test.go:61 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈33 tok
1 file · 60 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Unclaimed publisher≈ +8 on the totalClaim augastinklazar: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Stripe-like API key pattern detected≈ +4 on the totalNever read or enumerate credential locations; accept a documented environment variable instead.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim augastinklazarPropose a patch to the maintainer