Sightglass

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:27 PM UTC
• Version: 0.1.0

Overview

Sightglass is purpose-aligned monitoring software, but it installs and runs a broad background watcher with cloud-sync capability and limited privacy/lifecycle controls.

Review this before installing if your projects contain private code, secrets, customer data, or regulated material. Prefer a pinned, reviewed CLI version, confirm exactly what Sightglass collects and uploads, use local-only mode unless cloud sync is required, and make sure there is a clear way to stop the watcher and remove stored session metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: setup.sh:8

Finding

Unpinned Third-Party CLI Installed Globally

Content

View full analysis

Vulnerability Details

File Location: setup.sh, lines 8–13
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

if command -v sightglass &>/dev/null; then
  echo "✅ sightglass CLI installed ($(sightglass --version 2>/dev/null || echo 'unknown version'))"
else
  echo "📦 Installing @sightglass/cli..."
  npm i -g @sightglass/cli
  echo "✅ Installed"
fi

Technical Analysis

The setup script globally installs the mutable latest release of @sightglass/cli. It does not specify an exact version, enforce a lockfile, verify an integrity hash, or validate package provenance. The CLI source is not included in the audited project, but subsequent scripts trust the installed sightglass executable to monitor projects, analyze agent activity, authenticate users, and optionally transmit analysis results.

Consequently, the effective code executed by this skill can change after review. A compromised npm publisher account, malicious package release, or package ownership takeover could cause a future setup operation to install attacker-controlled code. Global installation also makes the executable available outside this project and executes package installation lifecycle scripts with the invoking user's privileges.

Attack Path

1. An attacker compromises the npm publisher account or otherwise gains control over a release of @sightglass/cli.
2. The attacker publishes a malicious version under the legitimate package name.
3. A user follows the documented setup procedure and runs setup.sh.
4. npm i -g @sightglass/cli resolves and installs the attacker-controlled latest release without version or integrity verification.
5. npm lifecycle scripts may execute during installation, and the setup script subsequently invokes the installed sightglass command.
6. The pre-session hook can later launch that executable as a detached watcher with access to the ...[truncated 703 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @sightglass/cli to a specific, audited version rather than installing the latest release.
• Verify the downloaded artifact using a trusted integrity digest or signed provenance before execution.
• Commit and enforce an appropriate lockfile where feasible.
• Prefer a project-local installation over npm -g to limit scope and make dependency resolution reproducible.
• Use npm provenance and signature verification controls where supported.
• Review and restrict installation lifecycle scripts, including using --ignore-scripts when compatible with the package.
• Vendor or publish the CLI source so its executed behavior can be included in security review.
• Run the watcher with restricted filesystem and network permissions, exposing only the project data required for its documented purpose.
• Document the pinned version and establish a controlled process for reviewing and approving upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The script persists session metadata, including the full project path and agent identifier, into a state file under the user's home directory. While it does not directly exfiltrate data, this creates a local context-leakage risk because sensitive project names, directory structures, or agent details may be exposed to other local processes or users if filesystem permissions are too broad.

Content

Scanner excerpt · hooks/pre-spawn.sh (reported line 11)May include surrounding context.

sh

SESSION_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/sightglass/sessions"
mkdir -p "$SESSION_DIR"

# Record session start
SESSION_FILE="$SESSION_DIR/current"
cat > "$SESSION_FILE" <<EOF
{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to run a background watcher that monitors agent sessions, file changes, package installs, and tool calls, and later syncs analysis data to sightglass.dev, but it does not clearly disclose what data is collected, whether code or secrets may be included, how long data is retained, or what is sent off-host. In an agent-development context, session monitoring can capture sensitive source code, dependency metadata, internal paths, prompts, and operational details, so the lack of a prominent privacy and data-handling warning creates a meaningful confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The script launches a background watcher process and then disowns it, allowing it to persist independently of the parent session. This can result in unintended long-lived monitoring of project activity, increased data collection beyond the user's active session, and reduced visibility or control over what continues running.

Content

Scanner excerpt · hooks/pre-spawn.sh (reported line 28)May include surrounding context.

sh

if ! pgrep -f "sightglass watch" &>/dev/null; then
  echo "🔍 Starting sightglass watcher..."
  sightglass watch --project "$PROJECT_DIR" &
  disown
fi

Static analysis

No suspicious patterns detected.