Security audit

Session Sync 多Agent会话上下文搬家

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real session-sync utility, but it has broad local access and risky install/dashboard behavior that users should review before installing.

Install only if you are comfortable letting this skill read, copy, archive, and write AI-agent conversation histories across your local agent stores. Avoid the one-line remote installers unless you fully trust the publisher and current GitHub branch; prefer a pinned, reviewed package or offline install. Do not run the dashboard while browsing untrusted sites, and back up affected agent data before using restore, prune, doctor, or cross-agent write commands.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:29
Finding: Installation Instructions Execute Mutable Remote Scripts Directly
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:18
Finding: Installers Deploy an Unverified Archive from a Mutable Branch
Content: View full analysis
/dev/null 2>&1; then curl -fsSL --retry 3 -o "$WORK/ass.zip" "${PREFIX}${REPO_ZIP}" 2>/dev/null && dl_ok=1 if [ "$dl_ok" -ne 1 ]; then curl -fsSL --retry 3 --ssl-no-revoke -o "$WORK/ass.zip" "${PREFIX}${REPO_ZIP}" 2>/dev/null && dl_ok=1 fi fi if [ "$dl_ok" -ne 1 ] && command -v wget >/dev/null 2>&1; then wget -q -O "$WORK/ass.zip" "${PREFIX}${REPO_ZIP}" && dl_ok=1 fi [ "$dl_ok" -eq 1 ] || die 'download failed' "$PY" -m zipfile -e "$WORK/ass.zip" "$WORK/unzip/" fi ``` The PowerShell implementation performs the same operation: ```powershell $prefix = [string]$env:ASS_GH_PREFIX $url = 'https://github.com/Chendestiny/agent-session-sync/archive/refs/heads/main.zip' Invoke-WebRequest -Uri "$prefix$url" -OutFile $zip -UseBasicParsing Expand-Archive -Path $zip -DestinationPath $tmpDir -Force ``` ### Technical Analysis The installers retrieve an archive from `refs/heads/main.zip`, extract it, locate a nested `sync.py`, and copy the resulting bundle into the user's Agent skill directories. No expected digest, signed manifest, release signature, or pinned commit is checked. The optional `ASS_GH_PREFIX` is prepended directly to the GitHub URL. If this variable points to an untrusted or compromised mirror, that mirror controls the returned archive. The installer only checks that a `sync.py` file exists and then copies an allowlist of executable project files; it does not verify the contents o ...[truncated 1390 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.ps1:124
Finding: PowerShell Installer Executes Unverified Python Bootstrap Code and Installs Unpinned Packages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: agentsync/webui/__init__.py:374
Finding: Unauthenticated Local Dashboard Exposes Session Data and State-Changing Operations
Content: View full analysis
None: u = urlparse(self.path) qs = {k: v[0] for k, v in parse_qs(u.query).items()} if u.path == "/api/overview": return self._json(api_overview()) if u.path == "/api/sessions": return self._json(api_sessions( qs.get("source", ""), q=qs.get("q", ""), t_from=int(qs.get("from") or 0), t_to=int(qs.get("to") or 0))) if u.path == "/api/session": data = api_session(qs.get("source", ""), qs.get("id", "")) if data is None: return self._json({"error": "not found"}, 404) return self._json(data) if u.path == "/api/export-source": out = api_export_source(qs.get("source", ""), qs.get("fmt", "md"), int(qs.get("days") or 0), qs.get("ids", "")) # response contains exported session data ``` ```python def do_POST(self) -> None: u = urlparse(self.path) if u.path == "/api/bind-path": n = int(self.headers.get("Content-Length") or 0) body = json.loads(self.rfile.read(n).decode("utf-8")) if n else {} out = paths.bind_override( str(body.get("source", "")), str(body.get("path", "")) ) return self._json(out, 200 if out.get("ok") else 400) if u.path == "/api/restore": n = int(self.headers.get("Content-Length") or 0) body = json.loads(self.rfile.read(n).decode("utf-8")) if n else {} from .. import backup as backup_mod plan = backup_mod.plan_restore( str(body.get("source", "")), str(body.get("ts", "")), paths.detect(), target=body.get("target") or None ) if not plan.get("ok"): return ...[truncated 3918 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (170)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The shell pipeline | bash is particularly risky because it chains untrusted network content directly into a command interpreter with no validation checkpoint. In the context of a skill intended for use by other agents that can execute commands, this becomes more dangerous: the README is effectively encouraging autonomous agents to perform remote-code execution as part of installation.
Content: Scanner excerpt · README.md (reported line 30)May include surrounding context.
Linux / macOS / WSL：

text
帮我安装 agent-session-sync：curl -fsSL https://raw.githubusercontent.com/Chendestiny/agent-session-sync/main/install.sh | bash

WSL/Linux 只发现该系统内装的 agent，Windows 侧的请在 Windows 上跑。

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The explicit | bash pattern is a classic command-chaining anti-pattern because it removes the opportunity to inspect fetched content before execution. Given this skill also registers commands globally and bridges into many agents' skill directories, successful abuse could establish persistence or tamper with multiple agent environments at once.
Content: Scanner excerpt · README_EN.md (reported line 19)May include surrounding context.
Linux / macOS / WSL:

bash
curl -fsSL https://raw.githubusercontent.com/Chendestiny/agent-session-sync/main/install.sh | bash

The installer drops the toolkit at ~/.agents/skills/session-sync, registers global commands (session-sync, alias ass), and bridges the skill into each detected agent's own skills dir — single source, upgrade once.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation presents the tool as a session sync/archive helper, but it actually supports bidirectional multi-target writes, a local web server, destructive prune operations, backup/restore, metadata mutation, and diagnostic operations. In a security review context, this breadth materially increases the attack surface and the likelihood that users will authorize a much more powerful skill than they intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation presents the tool as a session sync/archive helper, but it actually supports bidirectional multi-target writes, a local web server, destructive prune operations, backup/restore, metadata mutation, and diagnostic operations. In a security review context, this breadth materially increases the attack surface and the likelihood that users will authorize a much more powerful skill than they intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation presents the tool as a session sync/archive helper, but it actually supports bidirectional multi-target writes, a local web server, destructive prune operations, backup/restore, metadata mutation, and diagnostic operations. In a security review context, this breadth materially increases the attack surface and the likelihood that users will authorize a much more powerful skill than they intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation presents the tool as a session sync/archive helper, but it actually supports bidirectional multi-target writes, a local web server, destructive prune operations, backup/restore, metadata mutation, and diagnostic operations. In a security review context, this breadth materially increases the attack surface and the likelihood that users will authorize a much more powerful skill than they intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation presents the tool as a session sync/archive helper, but it actually supports bidirectional multi-target writes, a local web server, destructive prune operations, backup/restore, metadata mutation, and diagnostic operations. In a security review context, this breadth materially increases the attack surface and the likelihood that users will authorize a much more powerful skill than they intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation presents the tool as a session sync/archive helper, but it actually supports bidirectional multi-target writes, a local web server, destructive prune operations, backup/restore, metadata mutation, and diagnostic operations. In a security review context, this breadth materially increases the attack surface and the likelihood that users will authorize a much more powerful skill than they intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation presents the tool as a session sync/archive helper, but it actually supports bidirectional multi-target writes, a local web server, destructive prune operations, backup/restore, metadata mutation, and diagnostic operations. In a security review context, this breadth materially increases the attack surface and the likelihood that users will authorize a much more powerful skill than they intended.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation presents the tool as a session sync/archive helper, but it actually supports bidirectional multi-target writes, a local web server, destructive prune operations, backup/restore, metadata mutation, and diagnostic operations. In a security review context, this breadth materially increases the attack surface and the likelihood that users will authorize a much more powerful skill than they intended.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is expressly designed to aggregate full conversation histories from many AI agents and migrate them into other agents and archives. Even if intended as a utility feature, this creates a significant confidentiality risk because chat transcripts may contain secrets, proprietary code, credentials, tokens, personal data, or sensitive business context that can be replicated across multiple stores.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command set encourages broad backup, archive, restore, and propagation workflows over all session data, which increases the blast radius of any mistake or misuse. Because the content being moved is conversational history, these bulk operations can duplicate sensitive information into many locations, complicating access control, retention, and deletion.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: do_raw_restore overwrites original database files listed in the manifest without any confirmation, rollback, file locking, or destination validation beyond simple source/ts regex checks. Because the manifest stores absolute origin paths from backup time, restoring a snapshot can silently replace live application databases and corrupt or destroy user data, especially if the application is still running or the manifest has been tampered with.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module-level documentation and startup banner describe the dashboard as read-only, but the server exposes state-changing POST endpoints for backup creation, restore, snapshot deletion, and path binding. In a local web app, this mismatch is dangerous because users and integrators may trust the service more than they should, enabling accidental destructive actions or browser-driven requests against localhost without appreciating the write surface.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The inline documentation explicitly says only path-binding POST endpoints exist, but the implementation also exposes backup, restore, and snapshot deletion handlers. This inaccurate security contract increases the chance that operators, reviewers, or upstream callers expose or trust the service under false assumptions, especially given that restore and delete operations can alter local state.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/agents/dsh.md (reported line 20)May include surrounding context.
│ ├── workspace.json ← 工作区注册表 + 分组挂载（§6，分组的关键） │ ├── session_projcache.json ← 会话投影缓存（侧栏标题数据源 + 统计/token，attach-dsh 回填 title 行） │ └── cost_tracker.json └── settings.yaml / .credentials.yaml / profiles/ ...

text
## 2. 目录名编码（源码级：dsh-session-persistence-jsonl）

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · docs/agents/codex.md (reported line 1)May include surrounding context.
md
# 转换示例 1：zcode 会话 → dsh 可续聊会话 **源**：zcode 会话 `sess_e5ffd0df`（标题「你好」，工作区 `C:\Users\demo\.zcode\workspace\default`，2 轮对话）

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · docs/agents/hermes.md (reported line 1)May include surrounding context.
md
# 转换示例 1：zcode 会话 → dsh 可续聊会话 **源**：zcode 会话 `sess_e5ffd0df`（标题「你好」，工作区 `C:\Users\demo\.zcode\workspace\default`，2 轮对话）

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/命令输出示例.md (reported line 1)May include surrounding context.
md
# 转换示例 1：zcode 会话 → dsh 可续聊会话 **源**：zcode 会话 `sess_e5ffd0df`（标题「你好」，工作区 `C:\Users\demo\.zcode\workspace\default`，2 轮对话）

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · examples/转换示例1-zcode到dsh.md (reported line 1)May include surrounding context.
md
# 转换示例 1：zcode 会话 → dsh 可续聊会话 **源**：zcode 会话 `sess_e5ffd0df`（标题「你好」，工作区 `C:\Users\demo\.zcode\workspace\default`，2 轮对话）

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The documented use of '| bash' is a classic command-chaining anti-pattern because it combines network retrieval and shell execution into a single step. In the context of a session-sync skill that will be installed into multiple agent environments, this makes compromise especially impactful: a malicious installer could persist across several agent skill directories and capture or alter future session-handling behavior.
Content: Scanner excerpt · install.sh (reported line 5)May include surrounding context.
sh
# agent-session-sync 一键安装（跨 Agent 会话同步：codex/hermes/dsh/zcode/workbuddy -> dsh） # 用法： # 在线（Linux / macOS / WSL）： # curl -fsSL https://raw.githubusercontent.com/Chendestiny/agent-session-sync/main/install.sh | bash # 离线（GitHub 访问慢/不可达）：浏览器下载 zip 解压，进入 agent-session-sync-main 目录执行： # bash install.sh # 也可显式指定来源（zip 文件或已解压目录）：

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · install.sh (reported line 34)May include surrounding context.
sh
fi done # 脚本自身所在目录（curl | bash 管道执行时为空；旁边有 sync.py 则原地安装，不联网） SCRIPT_DIR='' if [ -n "${BASH_SOURCE[0]:-}" ] && [ -f "$(dirname "${BASH_SOURCE[0]}")/sync.py" ]; then SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata and top-level description frame the tool as one-way session sync to dsh plus archiving, but the code implements write paths into many other agents and destructive state-changing workflows. This scope mismatch is dangerous because users or orchestrating agents may grant trust based on the narrower description while the tool actually has broad write capabilities across multiple local application stores.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The implemented backup/restore functionality, including raw snapshot handling, is materially more powerful than the declared sync/archive scope. Hidden restore capability can overwrite or roll back user data stores, so the mismatch undermines informed consent and increases the chance that a user or agent invokes a skill with far more destructive authority than expected.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The doctor command goes well beyond session synchronization by installing packages, creating global command shims, and altering skill bridge locations. These actions modify the execution environment and persistence mechanisms across the system, which can be abused to establish broader footholds, change future command resolution, or normalize unexpected privilege expansion from a data-sync tool.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.