Caveat verdict
operation-quarantine
Defensive security skill scanning emails and skills for prompt injection; optional webhook egress gated behind ENABLE_WEBHOOKS=1 and defaults off, fully matching stated security-scanner purpose.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Permission integrity
package_install
Findings (10)
Pipe to bash — executes piped content as shell commands
SKILL.md · prose · downgraded · | bash
Raw model control tokens — prompt injection via token manipulation
service/test-quarantine.js · prose · downgraded · [INST]
References webhook/callback URL
SKILL.md · frontmatter · WEBHOOK_URL
References child_process — can spawn system processes
service/alerts.js · prose · downgraded · child_process
References sudo — requests elevated privileges
service/sanitizers/skill.js · prose · downgraded · sudo
Dynamic import() — loads module at runtime
service/server.js · prose · downgraded · import("
Accesses sensitive environment variables
service/alerts.js · prose · downgraded · process.env.QUARANTINE_CUSTOM_TELEGRAM_TOKEN
References agent memory files
service/llm.js · prose · downgraded · MEMORY.md
References tunneling service
service/sanitizers/skill.js · prose · downgraded · ngrok
Popular HTTP library — network access
service/test-quarantine.js · prose · downgraded · Got
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class A). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
network_inpackage_install Is this flag fair?
Thanks — recorded.