Dangerous: cloneguard - test_integration_all_patterns.py | Skillgate

Skillgate scanned tests/test_integration_all_patterns.py in cloneguard and rated it Dangerous with a risk score of 100/100 (14 detections).

Skillgate found one or more attack-shaped patterns - the kind used for credential exfiltration, remote code execution, or instruction hijack. Do not load this file into an agent without reading it end to end.

What was found

• SG-002 Credential Exfiltration - CRITICAL: Env var reads of sensitive credentials combined with outbound HTTP calls
• SG-004 Policy Override - CRITICAL: Patterns that instruct the AI to ignore guidelines or take a new persona
• SG-024 MCP Tool Poisoning - CRITICAL: Malicious instructions in MCP tool descriptions, credential-capturing schemas, built-in tool shadowing
• SG-019 Environment Probing - HIGH: System enumeration commands: whoami, uname, env dump, process listing, cloud IMDS probes
• SG-022 Context Window Flooding - HIGH: Repetitive filler text, context boundary spoofing, excessive separators
• SG-028 File Exfiltration - HIGH: Bulk file reads, credential file access, data staging via tar/zip/rsync/S3 upload
• SG-034 GitHub Actions Risky Trigger - HIGH: pull_request_target with untrusted code execution
• SG-043 Markdown Substructure Smuggling - HIGH (3x): Directive-shaped content inside HTML comments, image alt/title, reference-link titles, footnote bodies, definition-list bodies, <details> blocks, or heading anchors.
• SG-060 IDE Auto-Approval / YOLO - HIGH: autoApprove, runOn folderOpen, permission_mode bypass, --yolo, --dangerously-skip-permissions
• SG-073 Dangerous git env-var injection - HIGH: Setting GIT_EXTERNAL_DIFF / GIT_PAGER / GIT_EDITOR / GIT_SEQUENCE_EDITOR / GIT_SSH_COMMAND turns a benign git command into arbitrary RCE.
• SG-012 Suspicious URL - MEDIUM: HTTP URLs, IP-address URLs, non-standard ports, URL shorteners
• SG-017 External MCP Server - LOW: MCP server URLs pointing outside localhost

What to do

Read the flagged lines in the source file yourself before installing it or letting an agent load it. Every detection above links to the rule that fired, with the conditions that trigger it and remediation where one exists. Open the interactive report for evidence lines and context.

About Skillgate

Skillgate is a free scanner from Mitiga Labs for AI agent skills, hooks, MCP configs, and instruction files (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, .claude/settings.json). It runs static rules plus an LLM judge and maps each finding to a known attack technique. Static analysis only: it never executes the file it scans. No scanner is 100% accurate - a verdict is a signal, not a guarantee. Browse all detection rules.