Security

GenCMS Guard

What a scan checks, how the score is produced, and how to run it in CI.

Availability note — these docs describe both working and planned product areas. Account authentication, administrator-managed AIHK/AICA tenant regions and keys, signed-in Composer runs and public Guard scans are connected. Skills, Memory, Agents, Workflows, Apps, billing, the public SDK/CLI and the unified API are previews unless a section explicitly says otherwise.

Guard performs static analysis over a package, its manifest, its prompts and its dependencies, then reports observed signals grouped by what an attacker could do with them.

Check families

  • Shell execution — interpreters reached, runtime code evaluation, remote scripts piped into a shell
  • Credentials and secrets — embedded keys, environment sweeps, credential-file access
  • Network access — outbound calls, hard-coded IPs, local data posted off-platform
  • Filesystem access — writes, path traversal, persistence mechanisms
  • Prompt injection — instruction override, context exfiltration, hidden text
  • Package files — install hooks, obfuscated payloads, vendored minified code
  • Binary payloads — executable indicators, runtime downloads made executable
  • Permission declaration — behaviour the manifest does not declare
  • Tool declarations — wildcard grants, requests to skip confirmation
  • Dependencies — unpinned ranges, off-registry sources
  • Known dangerous patterns — destructive commands, reverse shells, mining

Scoring

Each finding carries a severity weight; repeats add less than the first hit. The score starts at 100 and is reduced by the total. A match found only in Markdown is reported one level lower, except for prompt-injection, credential and permission findings — in those families the prose is the payload.

ResultMeaning
Low RiskNo high or critical findings, score 85 or above
Review RecommendedScore below 85, or at least one high finding
High RiskAny critical finding, or score below 55

Guard never labels anything guaranteed safe. A result describes signals found in one version of one package at one moment.

Running a scan from CI

terminal
curl -sS https://gen-cms.com/api/v1/guard/scan \
  -H "Content-Type: application/json" \
  -d '{ "target": "https://github.com/acme/our-skill" }' \
  | jq '.report | {score, risk, findings: [.findings[] | .ruleId]}'
← PreviousAppsNext →Permission model