EXPERIMENT_012 // AGENT.PERMISSION.LINTER
Paste a system prompt and tool definitions. Get a flagged list of privilege escalation risks and missing scope constraints — before your agent reaches production.
LOADING EXPERIMENT...
Agent builds rarely audit whether the system prompt's stated permissions match the tools' actual blast radius. A write_file tool with no scope constraint and a system prompt that says 'do whatever is necessary' is a privilege escalation vector — silent, pre-deployment, and common. This experiment makes the gap visible as a list of flags, using the same policy-analysis logic that governs Diana's twelve-agent fleet.
HOW IT WORKS
Paste a system prompt and tool definitions (JSON). Click Analyse. The API sends both inputs to Claude with a structured security policy prompt. Claude audits for privilege escalation risks, unbound tool executions, missing scope constraints, and common best-practice gaps.
The response returns as a structured flag list: CRITICAL (privilege escalation), WARNING (missing constraints), and INFO (best-practice gaps). Each flag carries an ID, a one-sentence label, a location tag (system prompt, tool, or both), and a 2–3 sentence explanation of the risk and how to fix it.
The linter analyses the configuration — the system prompt and tool schemas — before any agent is deployed. It finds the gap between what the system prompt implies the agent can do and what the tools actually allow. That gap is where privilege escalation lives.
WHAT THIS PROVES
Agent security is a specification problem, not a runtime problem. The vulnerability is in the configuration — in the gap between what the system prompt implies the agent can do and what the tools actually allow.
Static analysis of agent configurations is tractable. A policy prompt running on a frontier model can surface the same classes of privilege escalation that a human security reviewer would catch — in seconds, before deployment.