AI Rebirth

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 1.0.0

Overview

The skill is intended to reload prior CodeBuddy conversations, but it can expose sensitive session history across projects or from crafted JSONL paths without enough safeguards.

Install only if you are comfortable letting the skill read and print prior CodeBuddy conversation logs. Avoid full-history mode for sessions that may contain secrets, and do not load unknown session IDs. The publisher should add session-ID validation, project-scoped lookup, explicit consent for transcript disclosure, redaction or preview defaults, and clear untrusted-content boundaries before broad use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/load_session.py:26

Finding

Path Traversal Allows Reading JSONL Files Outside the Session Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/load_session.py, lines 26-34
Vulnerability Type: Unrestricted path construction and local file disclosure
Risk Level: High

Vulnerable Code

python

def find_session_file(session_id):
    for project_dir in PROJECTS_DIR.iterdir():
        if not project_dir.is_dir():
            continue
        candidate = project_dir / (session_id + ".jsonl")
        if candidate.exists():
            return candidate
    return None

Technical Analysis

The value of session_id comes from the --id command-line argument and is used to construct a filesystem path without validating that it is a UUID or simple filename. The code does not reject path separators, absolute paths, or .. traversal components.

With Python's pathlib, joining a base directory with an absolute path causes the absolute component to replace the preceding base path. Relative paths containing ../ can similarly escape the intended project directory. The program only appends .jsonl, so exploitation is limited to readable files with that suffix or targets addressable through filesystem links, but no canonical-path containment check prevents access outside ~/.codebuddy/projects.

The selected file is subsequently opened by parse_session(). Any valid JSONL records whose type is message or topic are parsed and printed.

Attack Path

1. An attacker identifies an arbitrary readable JSONL file containing compatible records.
2. The attacker supplies an absolute path or traversal path as the --id value, excluding the .jsonl suffix because the program appends it.
3. find_session_file() constructs a path outside the intended CodeBuddy project directory.
4. candidate.exists() accepts the escaped path.
5. parse_session() opens the file and extracts recognized message or topic fields.
6. The selected output mode prints the extracted content to the terminal and pote ...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

• Validate session_id against a strict UUID format before using it in a path. For example, parse it with uuid.UUID and require its canonical string representation.
• Reject values containing /, \, .., null bytes, or other path syntax.
• Resolve the candidate and approved base paths with Path.resolve(), then verify that the candidate remains beneath the approved project directory.
• Require the candidate to be a regular file rather than merely checking exists().
• Avoid constructing paths directly from user input. Build an index of valid session files and select only exact IDs present in that index.
• Add tests covering absolute paths, traversal components, symlinks, malformed UUIDs, and valid session identifiers.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:55

Finding

Untrusted Historical Session Content Is Imported Without Instruction Isolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-60
Vulnerability Type: Indirect prompt injection through imported conversation history
Risk Level: High

Vulnerable Code

markdown

## Workflow

1. User asks to load/resume/reference a previous session
2. If no session ID given, list available sessions for the current project
3. User selects or provides a session ID (can paste partial conversation to help identify)
4. Run the script with chosen mode
5. Present the output to the user as context for continuing work

The associated script emits historical text without safety delimiters or trust metadata:

python

def generate_full(messages):
    lines = []
    for m in messages:
        if not m["text"]:
            continue
        role_label = "USER" if m["role"] == "user" else "ASSISTANT"
        lines.append("### [" + role_label + "] " + format_timestamp(m["timestamp"]))
        lines.append("")
        lines.append(m["text"])
        lines.append("")
        lines.append("---")
        lines.append("")
    return "\n".join(lines)

Technical Analysis

The documented workflow explicitly directs the agent to present loaded historical conversation data as context for continued work. The content is emitted verbatim and is labeled only with historical roles. Neither the Skill instructions nor the output generator establish that the imported text is untrusted data that must not be followed as active instructions.

A session record can contain attacker-controlled instructions in either a user or assistant message. When that record is loaded, the instructions enter the current model context alongside the legitimate task. Without explicit instruction/data separation, the agent may interpret the historical text as current operational guidance, causing indirect prompt injection.

Summary mode also includes historical user requests and the last six text-bearing message ...[truncated 1284 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly state in SKILL.md that all loaded session content is untrusted historical data, not active instructions.
• Require the agent to ignore requests, tool commands, policy statements, or role changes found inside imported records unless the current user independently confirms them.
• Place imported content inside strong, clearly labeled delimiters and precede it with a warning that it is quoted reference material.
• Prefer structured output containing source, historical role, timestamp, and escaped message text rather than blending raw text into the active conversation.
• Ask for confirmation before acting on any historical request that would access files, execute tools, disclose information, or modify state.
• Consider a safe preview mode that summarizes topics without reproducing operational instructions verbatim.
• Preserve provenance so the agent can distinguish current-user instructions from historical user and assistant messages.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/load_session.py:26

Finding

Session Identifier Lookup Is Not Restricted to the Current Project

Content

View full analysis

Vulnerability Details

File Location: scripts/load_session.py, lines 26-34
Vulnerability Type: Cross-project access-control boundary violation
Risk Level: Medium

Vulnerable Code

python

def find_session_file(session_id):
    for project_dir in PROJECTS_DIR.iterdir():
        if not project_dir.is_dir():
            continue
        candidate = project_dir / (session_id + ".jsonl")
        if candidate.exists():
            return candidate
    return None

Technical Analysis

Session listing is scoped to a project path, but loading a session by ID is not. find_session_file() iterates over every directory beneath ~/.codebuddy/projects and returns the first matching identifier, regardless of the current project or the value supplied through --project or --cwd.

A session UUID is difficult to guess randomly, but it is an identifier rather than an authorization mechanism. It may appear in logs, command histories, documentation, screenshots, copied links, or other session output. Possession of such an identifier is sufficient to load an unrelated project's conversation because no project association or user confirmation is enforced.

Attack Path

1. An attacker or unauthorized local user obtains a session UUID associated with another CodeBuddy project.
2. The attacker invokes the script with --id set to that UUID while working in a different project.
3. find_session_file() searches every project directory rather than only the current or explicitly selected project.
4. The matching session file is parsed.
5. Its conversation history is printed in summary, full, or tail form.

Impact Assessment

Exploitation can disclose historical conversation content from unrelated local projects accessible to the same operating-system account. Such records may include source-code excerpts, internal requirements, user prompts, operational details, or secrets previously entered into c ...[truncated 176 chars]

Remediation

View remediation

Remediation Suggestions

• Pass the current or explicitly selected project directory into find_session_file() and search only within that directory.
• Make --project or a safely derived current project part of every session-loading operation, not only listing operations.
• If cross-project loading is a required feature, require an explicit source-project parameter and informed user confirmation before displaying content.
• Do not treat knowledge of a session UUID as authorization.
• Report the source project before loading and allow the user to cancel when it differs from the current project.
• Avoid exposing full filesystem paths in listings or errors.
• Add tests proving that an identifier from one project cannot be loaded while another project is selected unless explicit cross-project access is authorized.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is explicitly designed to load prior session history, including user and assistant messages, into the current session. That creates a real risk of exposing sensitive data from previous conversations to the wrong user, wrong project context, or an over-broad audience, especially because it supports full-history output and session lookup.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

Session persistence and cross-session restoration are legitimate features, but they introduce a real privacy boundary issue when prior-session state is reintroduced into a new session. The risk is amplified here because the skill advertises loading previous session history directly into the current session, which can bypass normal expectations of conversational separation.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: ai-rebirth
description: "AI Rebirth - Load conversation history from a previous CodeBuddy session into the current session. Use when the user wants to resume, reference, or continue a previous session's work. Supports session ID lookup, project-based listing, summary and full output modes."
description_zh: "AI 重生 - 加载历史 Session 对话，延续前世记忆"
description_en: "AI Rebirth - Load previous session history into current session"
version: 1.0.0
allowed-tools: Read,Bash,Grep
---

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instructs the agent to present recovered session output as continuing context, which can disclose prior conversation contents wholesale instead of selectively summarizing relevant details. In a tool that handles coding discussions, prior sessions may contain secrets, internal code, credentials, or private user data, so replaying them into the current interaction is materially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill loads prior session transcripts and prints them directly to stdout in summary, full, or tail modes without any privacy notice, confirmation, or output minimization. Because session history can contain secrets, credentials, proprietary code, or sensitive user prompts, this can expose confidential data to the current context or to downstream logs/consumers unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill metadata and main description include Chinese text alongside English, but the document does not state whether language is selectable by the user or whether Chinese output is optional. This can conflict with language/locale policy expectations when a skill appears to impose or assume a language without explicit opt-in.

Content

No source excerpt is available for this finding.