ddday

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:12 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed journaling and migration tool, but it concentrates credentials, agent memory, business data, and cron state into AI-readable files and an unencrypted migration bundle with weak scoping controls.

Review this skill carefully before installing. Use it only for trusted local projects, avoid exporting live credentials or agent memory unless you explicitly need them, keep migration archives private and encrypted, inspect setup.sh before running restore, and add or remove the cron job manually so recurring execution stays under your control.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Warning

• Location: SKILL.md:65

Finding

Persistent Daily Execution Through User Crontab Modification

Content

View full analysis

/dev/null; echo "2 18 * * * cd $DDDAY_HOME && python3 generate_dashboard.py") | crontab - ``` ``` ### Technical Analysis The setup instructions modify the user's crontab and arrange for `generate_dashboard.py` to execute every day at 18:02. Although scheduling is identified as optional and is consistent with automatic dashboard generation, it creates execution that persists beyond the current Skill invocation. This persistence is not required for the Skill's manual journaling, scanning, dashboard generation, or migration features. It therefore exceeds the minimum privileges needed for those modes. The command also has the following security weaknesses: - It does not request explicit confirmation immediately before changing the crontab. - It is not idempotent. Repeated setup can add duplicate jobs. - `$DDDAY_HOME` is inserted into cron command text without shell-safe quoting. - It does not verify the ownership, permissions, or integrity of `generate_dashboard.py`. - No corresponding removal or disable procedure is documented. The cron process executes with the user's account privileges. If the dashboard script or its containing directory can later be modified by another party, the scheduled task becomes a recurring execution mechanism for that party's code. ### Attack Path 1. The user or Agent follows the optional setup instructions. 2. The command adds the dashboard generator to the user's crontab. 3. An attacker, compromised process, malicious restore bundle, or untrusted local user replaces or modifies `generate_dashboard.py`. 4. At 18:02, cron changes into `$DDDAY_HOME` and runs the modified script with the victim user's privileges. 5. The malicious co ...[truncated 709 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:233

Finding

Plaintext Aggregation of Credentials, Agent Memory, and Business Data

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:128

Finding

Untrusted Repository Content Is Promoted Into Future Agent Context

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

pe": "node", "emoji": "📦", "description": "Brief description of the project" } ] }

text

**Supported types**: `node`, `python`, `shopify`, `design`, `workspace`, `skill`

### Step 3 — Register as Claude Code skill

```bash
ln -sfn "$DDDAY_HOME" "$HOME/.claude/skills/ddday"

Step 4 — Set up daily cron (optional)

bash

chmod +x "$DDDAY_HOME/generate_dashboard.py"
(crontab -l 2>/dev/null; echo "2 18 * * * cd $DDDAY_HOME && python3 generate_dashboard.py") | crontab -

---

Commands

text

/ddday              — Scan all projects, generate daily log + dashboard
/ddday add <path>   — Register a new project
/ddday context      — Generate AI context pack (for new AI conversations)
/ddday snapshot     — Full work snapshot (all data + business reports + AI memory)
/ddday export       — One-command migration bundle to Desktop
/ddday doctor       — Environment health check (run after migration)
/ddday log          — View latest daily log
/ddday

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The export flow explicitly collects credential files and Claude memory, then packages them into a portable archive intended for reuse by AI agents. This concentrates secrets and sensitive context into a single exfiltration-friendly bundle without requiring clear consent, redaction, encryption, or scope limitation, making accidental disclosure or downstream misuse much more likely.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These instructions direct the skill to aggregate sensitive user data, credentials, skills, cron information, and AI memory into AI-readable migration artifacts. Even if intended for convenience, this creates a high-value target and lowers the barrier to large-scale disclosure of secrets and operational context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The work snapshot is designed to be a self-contained AI-readable file and explicitly includes .env-derived information, business data, AI memory, logs, and environment details. Centralizing this sensitive material into a single markdown artifact dramatically increases exposure risk, especially if shared with external models, stored in version control, or copied across systems.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The snapshot instructions tell the agent to assemble broad project, environment, business, and memory context into one self-contained file for AI consumption. In this skill context, that materially increases the chance of exposing confidential internal details to other tools, future sessions, or unauthorized readers.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Mentioning '.env keys' as part of the project panorama indicates the skill may inspect or summarize environment-derived secret material. In a migration/context tool whose output is meant to be AI-readable, even key names can reveal providers, internal systems, auth mechanisms, and may lead to accidental inclusion of actual secret values in later implementations.

Content

Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.

md

Generates a **self-contained Markdown file** that any AI can read to immediately resume all work:

1. **User profile** — Role, tech stack, work style
2. **Project panorama** — Path, git status, README, .env keys, recent commits
3. **Business data** — Latest reports from all configured report directories
4. **AI memory** — Claude Code project memory files
5. **Recent logs** — Last 7 days of ddday logs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The cron setup establishes persistence by scheduling recurring execution of the dashboard generator. While this appears to be a legitimate feature rather than covert persistence, it still creates an ongoing execution path that could be abused if the script or its directory is later modified.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

bash

chmod +x "$DDDAY_HOME/generate_dashboard.py"
(crontab -l 2>/dev/null; echo "2 18 * * * cd $DDDAY_HOME && python3 generate_dashboard.py") | crontab -

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

### Step 4 — Generate HTML dashboard

Run the dashboard generator to create `dashboard.html`:
- Project cards with status indicators
- Commit history per project
- Stats bar (total commits, active projects, pending changes)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The restore process describes automatically installing dependencies, copying files, rewriting paths, creating symlinks, and registering cron jobs via a bundled setup script. Running a broad, archive-supplied setup script on a new machine is risky because it can make persistent system changes and execute unreviewed actions without prominent safety boundaries or manual approval steps.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.