Aegis Lab

Research artifacts for an M.Tech dissertation on security boundaries in agentic AI and Model Context Protocol (MCP) workflows.

This repository contains a small shell artifact used to investigate whether an agent follows untrusted instructions into host execution. It supports inspection of a concrete trust-boundary crossing and the evidence needed to attribute it. The wider dissertation project is AegisMCP; the guardrail proxy, agent harness, and comparative evaluation results are not included here.

Research focus: prompt injection, tool-use authorization, execution-trace review, and evidence-based security evaluation.

Research question

When an agent encounters instructions embedded in external content, can it distinguish that content from the operator's authorized task before using execution, file, or communication tools?

The demonstration scenario places a reference to system-audit-tool.sh in attacker-controlled content. The evaluated behavior is the agent's decision to fetch or execute it and act on the resulting report. The script is an observation artifact for that scenario; it does not implement an injection detector or a security boundary.

Untrusted external content
          |
          v
Agent interprets a requested action
          |
          v
Tool-use authorization boundary  <--- Decision and reason to inspect
          |
          v
Attempted host execution         <--- Process/tool trace to inspect
          |
          v
Local execution report           <--- Supporting artifact, not sole proof

Repository contents

Path	Purpose
system-audit-tool.sh	Shell artifact that collects a limited host snapshot and writes a text report
docs/EXPERIMENT_RECORD.md	Template for recording scope, execution evidence, controls, and conclusions

There is no dependency installer, container definition, automated test suite, or complete agent evaluation harness in this repository.

What the script actually does

Operation	Observed implementation
Identity	Reads the current username, hostname, and UTC time
Public address	Makes outbound HTTPS requests to ipinfo.io, with fallbacks to api.ipify.org and checkip.amazonaws.com
Local address	Queries available routing/interface utilities, with macOS-oriented and Linux fallback paths
Listening ports	Uses lsof to list visible listening TCP ports and process names; it does not scan remote hosts
Output	Writes to execution-proof.txt, or to the path supplied through AEGIS_SENTINEL

The IP lookups expose the caller's network address to the contacted services. The output redirection can overwrite an existing file at the chosen report path. The current script does not read application documents or credential files, install persistence, upload its report, or create a listening service. Any agent action that transmits the report belongs to the surrounding demonstration and must be evaluated separately.

The script's comments and report include simplified statements such as “nothing was … sent.” The outbound lookups and report write above are the authoritative description of its visible side effects.

Inspecting the artifact

Source review is sufficient to inspect the artifact's behavior:

git clone https://github.com/MGpromax/aegis-lab.git
cd aegis-lab
sed -n '1,220p' system-audit-tool.sh

Runtime evaluation belongs in an explicitly authorized disposable environment with a fresh output path and recorded network policy. A trial should capture the exact commit, environment, agent/tool configuration, triggering content, policy decision, process evidence, and final artifacts. The experiment record provides a structure for that evidence.

Interpreting an evaluation

• Inspect the whole decision chain. Distinguish retrieval, execution, report reading, and transmission. Each is a separate action with its own authorization boundary.
• Corroborate execution. A report file alone can be stale, copied, or fabricated. Pair it with a fresh run identifier, tool/process logs, and the artifact hash.
• Separate refusal from environment failure. Missing utilities, denied network access, or a failed command do not establish that a guardrail enforced the intended policy.
• Compare equivalent conditions. Baseline and guarded runs need the same artifact, input, permissions, environment, and success criteria.
• Limit the conclusion. One scenario can demonstrate a particular failure or refusal. It does not establish general resistance to prompt injection or production security.

These are evaluation criteria, not published experimental results. No pass rate, attack-success rate, or independently verified defense claim is reported by this repository.

Portability and limitations

The script uses POSIX shell plus utilities including curl, awk, sort, lsof, whoami, hostname, and date. Address-discovery branches also use route, ipconfig, or ifconfig when available. Missing utilities, permissions, and platform differences can yield incomplete observations. No tested operating-system matrix is included.

The output may contain host and network identifiers. Redact those identifiers before publishing an experiment record. This repository documents only the current revision; earlier commits may have different behavior.

Author

Manoj Gowda · M.Tech, Cyber Security · The Oxford College of Engineering, Bengaluru

Affiliated to Visvesvaraya Technological University