Caveat verdict

quorum

🟢 Trusted

No high-risk patterns surfaced by the deep scan — automated capability review, not behavioral proof.

Multi-agent validation framework that clones from a public GitHub repo, installs Python dependencies, and runs independent AI critics against artifacts using ANTHROPIC_API_KEY and OPENAI_API_KEY; all operations serve the stated code/artifact validation purpose with no suspicious exfiltration.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

security

transparency

maintenance

Permission integrity

Installs packages at runtime — transitive dependencies are not auditable

package_install

Findings (18)

Pattern match critical

Uses eval() — can execute arbitrary code

golden-test-set/DESIGN.md · code · eval(

Pattern match critical

Possible hardcoded credential

reference-implementation/docs/INSTALLATION.md · code · password = "secret123

Pattern match critical

Writes to SKILL.md — self-modifying skill

ports/copilot-cli/ARCHITECTURE.md · code · SKILL.md loops over files → sequential or parallel task dispatch → progressive f

Pattern match high

Pipe to python — executes piped content as Python code

CLAUDE.md · prose · downgraded · | Python

Pattern match high

Instructs covert action — may act without user awareness

docs/guides/RUBRIC_BUILDING_GUIDE.md · code · silently

Pattern match high

Prompt injection — tries to override agent instructions

ports/claude-code/quorum-validation-skill/completeness-findings.md · prose · downgraded · Ignore all previous instructions

Pattern match high

Accesses sensitive system files

reference-implementation/tests/test_relationships.py · prose · downgraded · /etc/passwd

Pattern match high

Recursive delete from root or home — destructive command

reference-implementation/tests/test_utils.py · prose · downgraded · rm -rf /

Pattern match medium

References agent configuration files

docs/architecture/IMPLEMENTATION.md · code · agent-config

Pattern match medium

Uses exec() — may execute shell commands

docs/critics/SECURITY_CRITIC_FRAMEWORK.md · prose · downgraded · exec(

Pattern match medium

os.system/popen — direct OS command execution

docs/critics/SECURITY_CRITIC_FRAMEWORK.md · prose · downgraded · os.system(

Pattern match medium

subprocess execution — runs system commands from Python

docs/research/security-code-review-frameworks.md · prose · downgraded · subprocess.run(

Pattern match medium

subprocess with shell=True — command injection vector

docs/research/security-code-review-frameworks.md · prose · downgraded · subprocess.run(cmd, shell=True

Pattern match medium

Hex-encoded string — possible obfuscated payload

reference-implementation/tests/test_prescreen_properties.py · prose · downgraded · \x00\x01\x02\x03\x04\x05

Pattern match low

Python os.environ.get — reads environment variable

docs/critics/CODE_HYGIENE_FRAMEWORK.md · prose · downgraded · os.environ.get(

Pattern match low

Python httpx request — network access

docs/critics/SECURITY_CRITIC_FRAMEWORK.md · prose · downgraded · httpx.get(

Pattern match low

importlib.import_module — dynamic module loading

ports/copilot-cli/test_quorum_prescreen.py · prose · downgraded · importlib.import_module(

Pattern match low

Popular HTTP library — network access

reference-implementation/quorum/tools/schema_tool.py · prose · downgraded · got

Why the tier is capped

Execution sink present in raw bytes (Hard Floor: class B/D/E). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.

Permissions & capabilities

Requires 2 environment variables. (2 sensitive: ANTHROPIC_API_KEY, OPENAI_API_KEY). Requires 2 system binaries. (1 elevated: pip).

package_install

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API