ByteRover - Headless

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:09 AM UTC
• Version: 1.6.0

Overview

This skill is a straightforward ByteRover CLI helper, but users should handle the API key carefully and be aware it installs an unpinned npm CLI.

Install only if you trust ByteRover and the npm package source. Prefer a pinned or reviewed CLI version where possible, provide API keys through a secure secret mechanism rather than pasting them into chat or command history, and approve push, pull, and reinitialization actions only when you understand what project knowledge may be uploaded, downloaded, changed, or deleted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned ByteRover CLI Dependency Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml metadata: {"moltbot":{"emoji":"🧠","requires":{"bins":["brv"]},"install":[{"id":"npm","kind":"node","package":"@byterover/cli","bins":["brv"],"label":"Install ByteRover CLI (npm)"}]}} ``` ### Technical Analysis The installation metadata specifies `@byterover/cli` without an exact version or integrity constraint. Consequently, dependency resolution may install whichever package version is current when installation occurs rather than the version reviewed when this Skill was published. npm packages can execute code through lifecycle scripts and installed command-line binaries. If the upstream package, maintainer account, or package-distribution channel is compromised, a malicious future release could execute under the privileges of the process installing or invoking the Skill. The Skill provides no lockfile, checksum, signature requirement, or other mechanism for verifying that the downloaded package matches an audited artifact. This finding does not establish that the current ByteRover package is malicious. It identifies an unsafe dependency-resolution practice that permits the effective executable implementation to change after review. ### Attack Path 1. An attacker compromises the upstream npm package, its publisher account, or the relevant package-distribution channel. 2. The attacker publishes a malicious release under the legitimate `@byterover/cli` package name. 3. The Skill installation mechanism resolves the unversioned dependency to that malicious release. 4. Malicious code runs during package installation or when the `brv` binary is invoked. 5. The code accesses data and resources available to the Agent or user account and may transmit data or alter local files. ### Impact Assessment Successful exploitation could execute ...[truncated 467 chars]
• Remediation: ## Remediation Suggestions - Pin `@byterover/cli` to a specific, audited version instead of resolving the latest available release. - Enforce package integrity verification with a trusted lockfile and npm integrity hash. - Review package provenance, publisher identity, signatures, lifecycle scripts, and transitive dependencies before approval. - Disable npm lifecycle scripts during installation unless they are explicitly required and audited. - Install and execute the CLI in a sandbox with minimum filesystem, credential, and network access. - Establish a controlled dependency-update process in which new versions are reviewed and tested before the pin is changed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25
• Finding: ByteRover API Key Passed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 25 and 217 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium **Vulnerable Code Snippets**: ```bash brv login --api-key <key> ``` ```markdown - **Not authenticated**: Run `brv login --api-key <key>` ``` ### Technical Analysis The Skill instructs the Agent to interpolate a ByteRover API key directly into the `brv` command line. Command-line arguments may be exposed through process-inspection interfaces, command histories, terminal or automation logs, debugging telemetry, error reports, and Agent transcripts. Any local process or user permitted to inspect the command line may capture the key while the command is running. The credential may remain recoverable for longer if the command is recorded in shell history or execution logs. The document does not require redaction, protected input, history suppression, or secure credential storage. Exploitability depends on the host operating system, process visibility controls, logging configuration, and command-execution mechanism. Nevertheless, placing a secret directly in an argument unnecessarily broadens its exposure. ### Attack Path 1. A user provides a ByteRover API key so the Agent can authenticate. 2. The Agent substitutes the key into `brv login --api-key ...`. 3. The complete command is exposed in process metadata, shell history, logs, telemetry, or the conversation transcript. 4. An attacker with access to one of those sources extracts the API key. 5. The attacker authenticates to ByteRover using the stolen credential. 6. The attacker performs operations authorized by that key, potentially including querying, curating, pulling, or pushing accessible knowledge-base content. ### Impact Assessment A stolen key may grant unauthorized access to the ByteRover account, teams, spaces, and knowledge-base data permitted by the credential. The ...[truncated 285 chars]
• Remediation: ## Remediation Suggestions - Prefer a CLI authentication mechanism that reads the API key from protected standard input or an operating-system credential store. - If supported, pass a reference to a secret managed by the execution environment rather than embedding the secret in the command line. - Do not print, echo, persist, or include the key in Agent transcripts, diagnostics, telemetry, or error messages. - Disable command-history recording for authentication operations and remove any historical entries that contain credentials. - Apply automatic secret redaction to command traces and logs. - Issue narrowly scoped, short-lived credentials with only the minimum required ByteRover permissions. - Rotate the credential immediately if it may already have appeared in process listings, histories, logs, or transcripts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the user to provide an API key for authentication but does not warn that the key is a sensitive secret that must not be logged, echoed, stored in chat history, or committed to files. In an agent or automated environment, this increases the risk of credential exposure through prompts, transcripts, shell history, or downstream tooling.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

3. Check `brv status --headless --format json` first to verify auth and project state.
4. For curate operations, include relevant files with `--files` for better context.
5. Query responses may include tool call details showing what knowledge was searched.
6. For push operations, always use `-y` to skip confirmation in headless mode. For re-initialization, use `-f` to force re-initialization.
7. Pull will fail if there are unpushed local changes - push first.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.