Security audit
Security checks for vulnerabilities and agentic risk
This optional local preference memory fits its purpose, but saved excerpts can include private text.
Enable hooks only if you accept automatic local retention of preference-like text until removed. Excerpts may preserve an entire short prompt, and secret filtering cannot guarantee privacy. Review ledger.jsonl and 档案.md periodically, preview deletions before applying them, and remove the hook configuration to stop collection.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
> [!CAUTION]
> Enabling the hooks is an explicit opt-in. Once enabled, Dongwo screens every
> prompt automatically and records matching preference summaries without asking
> each time. It never stores the prompt itself: only a semantic key, an excerpt
> of at most 120 characters, a timestamp, the agent name, and a hashed session
> id. Prompts matching secret or sensitive-data rules are skipped entirely.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- read/write `$DONGWO_HOME` (outside the project);
- read `myprofile.md` in the project root, if present;
- write the profile trust store (`~/.config/dongwo/profile-trust/`, outside
the project);
- run the bundled `scripts/dongwo.py` with `python3` (3.9+, standard library
only, macOS/Linux);
Unrecognized statements containing a durable-preference marker are copied verbatim into custom candidates, then persisted in ledger.jsonl and the readable archive, subject to a 120-character truncation. This contradicts the assurance that only recognized preference summaries are retained and can preserve confidential prompt content that the limited sensitive-data patterns do not detect. Local storage and exclusion of custom preferences from automatic context injection reduce exposure, but do not eliminate this privacy and data-minimization issue.