Caveman Manage Skill Security Audit
What the author says it does (original text)
>
No obvious risks found in this check
- Files checked
- 1
- Risks found
- 0
Inside this skill
The Skill treats experiment lifecycle requests as production-control actions; the agent reads current state and results, then gives one evidence-supported recommendation or blocks the action.
View source
Treat every lifecycle change as a production control action. Read current stateand results, then report one supported recommendation or block.Current agent MCP is intentionally read-only: control-api does not yet enforce acomplete lifecycle transition table and evidence gate atomically.Review, inspection, explanation, and recommendation authorize reads only; the Skill explicitly forbids the agent from executing lifecycle mutations even after user approval.
View source
1. A request to review, inspect, explain, or recommend authorizes reads only.2. Never approve an experiment whose results are pending, whose required logged-in Caveman identity and server RBAC.5. Never execute a lifecycle mutation, even after user approval. Exact `<action>:<experiment_id>` strings are agent-generatable and are not proof of human intent.6. Unknown states and server errors fail closed. Report exactDo not emit or run an executable lifecycle command. Explain that current serverdoes not yet enforce every evidence/state transition atomically. CLI and MCPagent surfaces therefore expose experiment reads only.An approval recommendation requires complete passing results; when required fields are missing, results are pending, or guardrails are breached, the Skill requires fail-closed handling and prohibits proposing approval.
View source
1. A request to review, inspect, explain, or recommend authorizes reads only.2. Never approve an experiment whose results are pending, whose required guardrails are absent, or whose evidence reports a breach.3. Never convert experiment lift into `verified_savings`. Only active realAbsence is not a pass. If a required field is absent, state`evidence incomplete` and do not propose approval.If an external operator says an action was executed, the Skill requires re-reading server state rather than inferring success from intent; it also prohibits converting experiment lift directly into verified savings.
View source
guardrails are absent, or whose evidence reports a breach.3. Never convert experiment lift into `verified_savings`. Only active real traffic plus provider-causal, provider-complete ledger evidence can do that.4. Never supply an organization id. Project and tenant scope come from theIf operator says they executed command, read detail and results again. Reportserver-observed post-state, audit or result response, and any policy-deliverystatus returned. Never infer success from operator intent alone.Files and check records1 files
Coverage and gaps
Content covered in each file
These are the source ranges included in this check, not a guarantee that every issue has been resolved.
SKILL.mdFull text included
This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.
SKILL.mdInstructions
Operations mentioned in code and instructions
Run commands
```bashcaveman cloud experiments list- Lines read
- 113
- File checksum (to compare versions)
- 869a87f61b1bc31ed4b495fd7e12044bc9921de2bfe9e38ecde8fba35e93dff0