Vet Config

Vet Agent Config (trust-boundary check)

Scan agent-config files for adversarial patterns that exploit the config-as-instruction trust boundary. The Cursor CVE-2026-26268 + Gemini CLI CVSS 10.0 yolo-mode exploit class lives here — an attacker plants a config file, the agent reads it on next session-start and trusts it implicitly.

What to do

1. Take the path from $ARGUMENTS. Default to scanning common agent-config locations if no path given:

• ./CLAUDE.md
• ./AGENTS.md
• ./.claude/ (recursive)
• ./.cursor/rules/ (recursive)
• ./.gemini/
• ./.git/hooks/

1. Call mcp__openclaw-skill-vetter__vet_agent_config with the path. (This is skill-vetter v1.1+ — verify version if call fails.)
2. Render the verdict per file scanned.

Verdict rendering

For each file, render one block. Aggregate at the top:

Aggregate header

### 🔍 Agent Config Audit
**Scope:** `` · **Files scanned:** N · **Verdict:** 🟢 ALLOW / 🟡 WARN / 🔴 BLOCK (worst-case across all files)

Per-file findings

For files that triggered findings:

> 🔴/🟡 **``** — 
> **Findings:**
> - **** at line ``:
>   ```
>   
>   ```
>   
> **What this would do:** 

For files that passed:

Just include in aggregate count. Don't render a per-file ALLOW block (would clutter the report when scanning a directory).

Rule families specifically for agent configs (24+ rules)

• AGENTCFG.PROMPTINJ.IGNORE_PREVIOUS — "ignore previous instructions" / role-override
• AGENTCFG.PROMPTINJ.YOUARENOW — system-prompt-rewrite via "you are now ..."
• AGENTCFG.PROMPTINJ.NO_PERMISSION — "do not ask for permission" / approval-bypass
• AGENTCFG.EXFIL.WEBHOOKHARDCODED — outbound POST to non-allowlisted URLs
• AGENTCFG.EXFIL.CREDENTIALREF — instructions to read .env, .aws, .netrc, etc.
• AGENTCFG.DYNAMICEXEC.EVAL_INSTRUCTION — instructions to use eval, Function, runtime imports
• AGENTCFG.SECRETREF.SSHKEY / .AWSKEY / .GIT_TOKEN — references to credential files
• AGENTCFG.GITHOOK_INSTALL — instructions that install or modify git hooks
• AGENTCFG.OBFUSCATION.UNICODETRICK — homoglyphs / zero-width chars / RTL overrides
• AGENTCFG.SUBPROCESS.SHELLTRUE — instructions to spawn shells with shell=True

Cite the actual rule returned. The rules above are the catalog reference.

Style notes

• ALWAYS quote the offending line for BLOCK findings. The quote IS the proof.
• If multiple files in the same directory trigger the same rule (e.g. 3 SKILL.md files all have IGNOREPREVIOUS), group them: "3 files match AGENTCFG.PROMPTINJ.IGNOREPREVIOUS — see file list below"
• For directory scans, render a tree-like summary when there are many files: "Scanned 47 files across .claude/skills/ — 44 ALLOW, 2 WARN, 1 BLOCK".
• Surface git provenance if available — if running inside a git repo, mention "this file was added/modified by `` on " so the user can identify the PR / commit responsible.

Edge cases

• If $ARGUMENTS is empty AND no default paths exist in CWD, ask: "Pass a path: /aufgaard:vet-config .claude/skills/new-deploy/SKILL.md. Common scan targets: .claude/, .cursor/rules/, AGENTS.md, CLAUDE.md."
• If skill-vetter MCP not loaded: "skill-vetter MCP not available. Verify pip install openclaw-skill-vetter-mcp and the plugin is loaded."
• If the version of skill-vetter is older than v1.1 (no vet_agent_config tool), suggest upgrade: "Your skill-vetter is older than v1.1. Run pip install --upgrade openclaw-skill-vetter-mcp to access agent-config scanning."
• If running on a fresh clone with no agent-config files, render: "🟢 No agent-config files found. Repo is clean of CLAUDE.md / AGENTS.md / .cursor/rules / .claude/skills / .git/hooks. Re-run after pulling new branches."

Footer CTA

---
Agent-config trust-boundary attacks (P5.z) is one of 35 documented production-AI failure patterns. The [Production-AI MCP Suite Bundle](https://temurah.gumroad.com/l/production-ai-mcp-suite) ($29) includes the 8-page Field Reference PDF — covers Cursor CVE-2026-26268 + Gemini CLI CVSS 10.0 yolo-mode + 4 other supply-chain and config-poisoning patterns.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: temurkhan13
• Source: temurkhan13/aufgaard
• License: MIT

Install and usage instructions live in the source repository linked above.