cleanup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:01 AM UTC
• Version: 0.5.1

Overview

This cleanup skill is purpose-aligned but automatically takes high-impact session-end actions, including raw conversation persistence and hook-driven control over the agent, so it should be reviewed before installation.

Install only if you intentionally want a session-end automation that can run on Stop, invoke other skills, inspect agent/workspace state, store raw conversation and artifact content into a RAG system, and keep local pending queues. For sensitive work, require explicit consent before RAG import, disable automatic Stop-triggered cleanup, and review the bundled hook scripts before enabling them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: resources/block-cleanup-without-claudify.sh:99
• Finding: Stop-event hooks hijack agent execution and force additional Skill calls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-17`, `run.md:50-128`, and `resources/block-cleanup-without-claudify.sh:99-114,127-186` **Vulnerability Type**: Agent instruction and output-flow hijacking **Risk Level**: High ### Vulnerable Code From `SKILL.md:13-17`: ```yaml triggers: - event: Stop action: inject message: "Run /cleanup run. This is the pre-session-end cleanup task." ``` From `run.md:50-68`: ```markdown ### Per-Step Invocation Obligation Self-Check Table (HARD STOP) Each step clearly distinguishes between **automatic skill calls** and **user-decision asks**. Do not bypass a step with a text-only report. | Step | Invocation obligation (automatic) | Ask (user decision) | Auto-invocation condition | |------|------------------|------------------|---------------| | Step 2 (Self-Improve) | **`Skill("claudify", "improve")` call mandatory** — retrospect + automation review + pattern detect | How to handle findings (internal Phase 2 ask inside the skill) | **Always** (regardless of whether the conversation had mistakes/patterns — the skill judges) | | Step 3 (Knowledge Persist) | **`Skill("claudify", "persist")` call mandatory** + RAG receiver import dispatch 3-C.1 | Storage location (internal ask inside the skill) | **Always** + auto-import when the RAG receiver readyz responds | | Step 5 | **`Skill("wip")` call mandatory** (multi-select task registration) | Internal multi-select ask inside wip (N next-session work candidates) | **Always** — state preservation for next-session resume at cleanup end | | **Step 5 report (HARD STOP — re-read before writing)** | **Before composing the completion report, scroll back to "Step 5 Completion Report Table Mandatory Rows" and copy its row list literally.** | — | **Always** — applies to the cleanup wrap-up table AND any separate session-end report | ``` From `resources/block-cleanup-without-claudify.sh:99-114`: ```bash emit_block() { local missing="$1" context="$2" # Build JS ...[truncated 3293 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the automatic Stop-event injection. Cleanup should run only after an explicit user request. 2. Replace all unconditional `HARD STOP` and mandatory cross-Skill calls with optional recommendations. 3. Do not return `decision: "block"` merely because an auxiliary Skill was not invoked. 4. Never require unrelated content in the user's final answer. Cleanup results should be a separate, concise status report when requested. 5. Require explicit confirmation before invoking any dependent Skill that can write files, mutate tasks, store memory, or access external services. 6. Define a strict allowlist of permitted cleanup actions and document the side effects of each action before execution. 7. Add recursion and retry limits so Stop hooks cannot create repeated continuation loops. 8. Make dependent Skills independently reviewable and pin their trusted versions rather than dynamically invoking any matching installed Skill. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: .md.metadata.json`), check `userFacing` value. - Fallback: If no `.metadata.json` or schema differs, exclude known internal control files (`task.md`, `ask.md`), and treat all other unrecognized `.md` files as active artifact candidates for RAG store. **Procedure**: 1. **Identify files via Glob/Hybrid Sweep with mtime ≥ session start time** 2. **Query the RAG receiver's scroll for each file** 3. **Branch**: - 1+ existing chunk → already stored. Skip - 0 existing chunks → not stored. Store immediate ...[truncated 4011 chars]:560
• Finding: Automatic raw session and workspace artifact export to dynamically selected RAG receivers<![CDATA[ ## Vulnerability Details **File Location**: `run.md:56-64,492-509,560-588,628-689` and `rag-store.md:66-118,193-225` **Vulnerability Type**: Unsanitized external data persistence without affirmative per-operation consent **Risk Level**: High ### Vulnerable Code From `run.md:56-64`: ```markdown | Step 0.5 (4.5 Resume import) | RAG receiver import dispatch (receiver resolved from the workspace config) for each discovered file | — | RAG receiver readyz response + research-*/plan-* discovered | | Step 3 (Knowledge Persist) | **`Skill("claudify", "persist")` call mandatory** + RAG receiver import dispatch 3-C.1 | Storage location (internal ask inside the skill) | **Always** + auto-import when the RAG receiver readyz responds | | **3-C.1 session RAG import** | **Automatic execution — no ask** | — | Immediately import when the RAG receiver readyz responds OK | | **3-C.2 structured discovery chunk (mode B — HARD STOP)** | **Automatic execution — no ask** | — | If the session produced **reusable discoveries/decisions/deployments**, store each as a keyword-searchable chunk via the **RAG receiver's structured-store dispatch (mode B)** | | **3-C.3 check for missed active-artifact RAG store** | **Automatic execution — no ask** | — | Glob → identify this-session mtime artifacts → RAG receiver scroll → immediately store missing files. Matches plan/research/analysis/report/postmortem-*.md patterns | | **3-C.4 workspace fix_plan-history sync (mode C)** | **Automatic execution — no ask** | — | If this session added `## Completed` entries to `fix_plan.md` AND the current workspace exposes a fix_plan→RAG sync script, run it. | ``` From `run.md:560-588`: ```bash # Store the session chunk (idempotent — re-importing the same session embeds/upserts only new turns) # --raw: current session = the user's own context + active JSONL, so opt out of the receiver's sanitize procedure # (see the receiver topic's "opt-out conditions" for importing the current session) <rag-impor ...[truncated 5305 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable all RAG persistence by default. 2. Require explicit, informed opt-in before each transcript or artifact transfer. 3. Display the exact receiver, endpoint, data scope, retention policy, and files to be transferred before requesting confirmation. 4. Remove the default `--raw` behavior. Apply credential, token, personal-data, and proprietary-content redaction to a copy of the data before import. 5. Use an allowlist rather than broad globbing and unrecognized-file fallback behavior. 6. Never upload complete transcripts when a minimal, user-reviewed summary is sufficient. 7. Exclude command output and tool results by default because they frequently contain secrets. 8. Encrypt local pending queues, restrict their permissions to the current user, and define an automatic expiration period. 9. Do not automatically drain pending queues. Show queued content and request confirmation before later transfer. 10. Pin RAG receivers to an administrator-approved allowlist and validate destination identity with authenticated TLS. 11. Add data-classification checks that block transfer when credentials, private keys, tokens, connection strings, or regulated personal data are detected. 12. Record an auditable receipt containing the approved scope and destination without retaining another copy of the sensitive payload. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: resources/block-cleanup-without-claudify.sh:59
• Finding: Hook scripts execute mutable external files without integrity validation<![CDATA[ ## Vulnerability Details **File Location**: `resources/block-cleanup-without-claudify.sh:59-66` and `resources/block-cleanup-option-below-context-gate.sh:158-190` **Vulnerability Type**: Untrusted local script sourcing and path-based executable selection **Risk Level**: High ### Vulnerable Code From `resources/block-cleanup-without-claudify.sh:59-66`: ```bash # Load locale-specific regex patterns from data/. The file is git-ignored so # the public repo never sees Korean characters. When absent, cleanup detection # falls back to English-only markers. HG_DATA_FILE="$(dirname "$0")/../../hook-kit/data/hangul-patterns.regex" if [ -f "$HG_DATA_FILE" ]; then # shellcheck source=/dev/null . "$HG_DATA_FILE" fi ``` Equivalent sourcing is also present in other bundled shell hooks. From `resources/block-cleanup-option-below-context-gate.sh:158-190`: ```bash CTX_INJECT="" for _cand in \ "$(dirname "$0")/../../session/resources/context-usage-inject.sh" \ "$(dirname "$0")/../../hook-kit/resources/context-usage-inject.sh" \ "$(dirname "$0")/../../context-measure/resources/context-usage-inject.sh" \ "${CLAUDE_PLUGIN_ROOT:-/nonexistent}/skills/session/resources/context-usage-inject.sh" \ "${CLAUDE_PLUGIN_ROOT:-/nonexistent}/skills/hook-kit/resources/context-usage-inject.sh" \ "$HOME/.claude/skills/session/resources/context-usage-inject.sh" \ "$HOME/.claude/skills/hook-kit/resources/context-usage-inject.sh"; do if [[ -f "$_cand" ]]; then CTX_INJECT="$_cand"; break; fi done LATEST_PCT="" if [[ -f "$CTX_INJECT" ]]; then TRANSCRIPT_JSON=${TRANSCRIPT//\\/\\\\} CTX_OUT=$(printf '{"transcript_path": "%s"}' "$TRANSCRIPT_JSON" \ | CC_EMIT_THRESHOLD=1 bash "$CTX_INJECT" 2>/dev/null) fi ``` ### Technical Analysis The first hook treats a file named `hangul-patterns.regex` as executable shell code by sourcing it with the `.` command. File extension and comments suggest inert regular-expression data, but sourcing executes every shell command prese ...[truncated 2595 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never source data files. Parse the regex file as inert text using a strict parser. 2. Store locale patterns in JSON or another non-executable format and validate every field against an expected schema. 3. Reject unexpected lines rather than evaluating them as shell syntax. 4. Resolve helper scripts from one immutable package directory instead of probing multiple mutable paths. 5. Canonicalize the selected path with `realpath` and verify it remains inside the approved installation root. 6. Reject symbolic links and files not owned by the expected user or package owner. 7. Reject group-writable or world-writable helper scripts and parent directories. 8. Pin and verify a cryptographic hash or package signature before executing helper code. 9. Do not trust `CLAUDE_PLUGIN_ROOT` without validating its origin and canonical path. 10. Invoke a packaged executable directly rather than passing a discovered file to `bash`. 11. Run hooks in a restricted sandbox with minimal filesystem and network permissions. 12. Add tests proving that malicious shell syntax in the locale data is treated as plain text and cannot execute. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (37)

Ae1

High

• Category: analysis-evasion

Content

cution (`fa-analyze.py`, `hybrid_sweep_rag.py`, `sync_dual_wiki.py`) | [run.md](./run.md) |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill mandates storing findings, decisions, and artifacts to external RAG receivers at session end without requiring a user-facing disclosure or consent step. Because session artifacts can contain sensitive operational, security, or project data, silent persistence to external systems is a significant confidentiality and privacy risk.

Ssd 3

High

• Confidence: 98% confidence
• Finding: This section mandates automatic import of whole session transcripts into a RAG store using raw session data. Full transcript persistence is especially dangerous because it can capture secrets, credentials, internal URLs, incident details, or personal information that appeared anywhere in the conversation, then make them retrievable later via semantic search.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill mandates sending session data to a RAG receiver automatically, yet does not provide an upfront privacy warning or meaningful consent control before transmission. Because cleanup is framed as mandatory and session-ending, users may disclose sensitive prompts, credentials, or proprietary discussion content to an external or semi-external persistence system without realizing it.

Context Leakage

High

• Category: Data Exfiltration

Content

| 3 | RAG receiver readyz responds OK but the import call is skipped while the report table still shows a "RAG Store" row | The call itself is mandatory — the report row displays the result, it is not a bypass channel |
| 4 | The cleanup wrap-up table explicitly states the RAG row, but the subsequent separate session-end report (e.g., "## ✅ Session Ended") buries the RAG result in a 1-line prose list | The session-end report carries the same obligation — highlight visibility with a separate markdown table row / bold line / dedicated header section |
| 5 | Fill the "Self-Improve / Knowledge Persist" rows with a self-written inline retrospect text + FA Prune non-execution report + comprehensive-matrix text (0 claudify Skill call traces) | **Only quoting Skill call results is allowed.** Quote only the `Skill("claudify", "improve")` tool response result text + `Skill("claudify", "persist")` tool response result text into the rows. Filling the row with a self-written retrospect report = bypassing the call = a violation |
| 6 | Omitting the active session UUID (`<uuid>`) or substituting a placeholder in the RAG store row or report header | Always extract conversation ID and explicitly format as `session UUID <full-36-UUID>` in row 3-C.1 and report header |
| 7 | Omit the physical numerical chunk count `N` (e.g. replacing `N chunks added` with vague prose omitting `N`) | Always include the concrete integer number of chunks `N` (e.g., `12 chunks added`) and imported artifacts count `M` in row 3-C.1 (e.g. `12 chunks added (receiver: RAG import dispatch) — session UUID <uuid>. 0 artifacts imported.`) |
| 8 | On a 2nd+ `/cleanup` invocation in the same session, reconstruct this table from memory of the prior pass's report shape | Re-read this section's literal row text before composing — a remembered shape silently drops compound sub-clauses (e.g., the Session identity row's `/rename` sub-clause) that a fresh read would catch. Enforced by `block-cleanup-missing-rename.sh` (Sto
...[truncated 24 chars]

• Confidence: 94% confidence
• Finding: The skill requires extracting and surfacing the active session UUID and quoting tool-call results tied to session persistence/reporting. Combined with mandatory transcript import and reporting obligations, this reinforces cross-medium linkage of conversation identity and preserved content, making session data easier to correlate, retrieve, and leak.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

1. `.ralph/` directory exists AND
2. Environment variable `RALPH_LOOP=1` is set

**If `.ralph/` exists but it's an interactive user session, use normal mode** — AskUserQuestion is used normally. Do not judge based on `.ralph/` existence alone.

**Explicit `--ralph` flag in an interactive session (no `RALPH_LOOP=1`) is a distinct case from a true autonomous loop (HARD STOP)**: a true `RALPH_LOOP=1` loop gets a self-healing safety net — a step skipped this iteration can be retried on the next. A user-typed `--ralph` flag in an interactive session has no such next iteration; a step skipped here is skipped for good unless someone notices. Do not apply the two identically — see the RAG-store carve-out below, which applies regardless of which path triggered Ralph Mode.

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

#### Hook behavior review

1. Collect the registered hooks from the canonical inventory first — `Read skills/hook-kit/hook-registry.yaml` (hook-kit `registry.md`), then compare it against the live surfaces (`~/.claude/settings.json` `hooks`, each plugin's `hooks/hooks.json`). A settings.json entry whose id is already registered on a plugin surface is a dual registration to remove; a file with no registry row is a backfill candidate, not an orphan to re-point by guesswork
2. **Verify hook file existence**:
   - Extract the executable path from each hook's `command`
   - Check whether the file actually exists

• Confidence: 90% confidence
• Finding: The skill directs inspection of `~/.claude/settings.json` and related hook/plugin configuration in the user's agent config area. Accessing and comparing files in the global agent configuration directory can expose sensitive local paths, plugin commands, tokens, or security-relevant environment details beyond the workspace's intended scope.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

> **TODO**: consolidate pattern-detection logic after absorbing auto-agentify.

**⚠️ Always run — do not skip**: do not judge candidate presence in advance.

1. Detect repeated patterns in the conversation context
2. Recommendation route by pattern type:

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

> **TODO**: consolidate pattern-detection logic after absorbing auto-agentify.

**⚠️ Always run — do not skip**: do not judge candidate presence in advance.

1. Detect repeated patterns in the conversation context
2. Recommendation route by pattern type:

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The document explicitly justifies storing current-session raw context on the basis that it is on a private network and should retain profanity/emotional content as semantic signals. That rationale weakens safeguards by treating network location as sufficient protection, while private systems can still be misconfigured, broadly accessible, or later queried inappropriately.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill advertises many broad natural-language trigger phrases such as "wrap up," "end session," "improve," and "cleanup," which can cause the skill to be invoked in contexts the user did not explicitly intend. Because the skill performs multi-step end-of-session actions and can inject behavior on Stop events, accidental invocation could trigger persistence, commits, or helper-script execution at inappropriate times.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger conditions are overly broad, including ordinary phrases like 'finish' and an open-ended housekeeping heuristic. That makes it easy for the skill to activate unexpectedly and persist session information when the user did not clearly intend wrap-up or external storage.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill expands its behavior beyond simple RAG persistence by directing the agent to use direct REST API calls and to write durable queue files on the local filesystem. Those capabilities create additional data exfiltration and local data retention surfaces without any scoped permission, user notice, or clear minimization rules, increasing the chance that sensitive session content is stored or transmitted in unintended ways.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Medium (4) — local durable pending-import queue (HARD STOP — server-down ≠ info lost)

**When all RAG-server media (1)-(3) fail (server unreachable / network down), the info is NOT preserved by "register BLOCKED + retry next session".** Next session may never run; the semantic index is then permanently lost. Medium (4) is the **terminal, always-available** fallback: write the import payload to a durable local queue file **this session**, so a future cleanup deterministically drains it when the server returns.

**Queue location** (central — drained by any future cleanup, workspace-independent):

• Confidence: 93% confidence
• Finding: The skill requires durable local queueing of import payloads when remote media are unavailable, preserving session content across sessions in a central filesystem location. This creates a persistent local cache of potentially sensitive findings and artifacts without retention limits, encryption, or user consent, increasing exposure if the host is shared or later compromised.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

- Distilled facts (decisions, infra findings) with metadata `{type, project, date, topic}`
- One-line reason the server was unreachable (e.g., `Qdrant readyz http_code=000`)

**Drain step (next cleanup 3-C.1)**: before/after the session import, `ls ~/.claude/skills/cleanup/data/rag-pending/*.md`. For each queued file, if RAG server now reachable → import its payload → delete the queue file. If still unreachable → leave queued.

| # | Don't | Do |
|---|-------|-----|

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. Medium (1) MCP failed → did you try medium (2) vendor script?
2. Medium (2) script failed → identify cause (cache miss / dependency / network) → did you try medium (3) REST API direct call?
3. Medium (3) failed → check "RAG server readyz" (server up?). Only mark RAG-server media unusable when the server itself is down
4. **All server media (1)-(3) fail → write medium (4) local pending-import queue file THIS session** (`~/.claude/skills/cleanup/data/rag-pending/<session-uuid>.md`). Do NOT punt to "next session retry" — that abandons preservation. The queue file is the durable guarantee
5. Only after medium (4) queue is written: register a BLOCKED note in `fix_plan` as a supplementary reminder (the queue file, not the note, is the preservation)

## fix_plan.md Completed Item RAG Sync + Delete Obligation (HARD STOP)

• Confidence: 93% confidence
• Finding: This reinforces a mandatory local persistence mechanism as a 'durable guarantee,' making storage of session-derived content unavoidable once remote options fail. The hard-stop language reduces operator discretion and increases the likelihood that sensitive data will be written locally even when persistence may be inappropriate for the session's sensitivity level.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The Plane synchronization requirement introduces a separate external system and workflow obligation unrelated to the file's core RAG-store purpose. That broadens the skill's authority to modify or depend on another backlog system, creating risk of unintended state changes, data leakage, and cross-system side effects from a persistence-oriented skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| 14 | Report "RAG obligation done" after 1 script sync then compress other-section `[x]` items | Script parses **Completed section only**. Other-section `[x]` handling + body-loss cases require separate manual RAG store. Report both "script: N + manual: M" counts |
| 15 | "If user concludes 'no further action needed', the body can be cleaned up too" reasoning | Conclusion and body preservation are separate. User conclusion = **state decision**; body = **troubleshooting steps / primary source / commit history** with future value. Conclusion = `[x]` processing; body = RAG store then compress |
| 16 | Treat oversized `[x]` items as safe to ignore because they're "not in `## Completed`" | The sync script's Completed-only scope is a tooling gap, not a signal that inline `[x]` bloat is fine. At wrap-up, also scan top-level `- [x]` items outside `## Completed` for size — condense the same way |
| 17 | Delete a synced `## Completed` body without checking whether any item is Plane-indexed | RAG sync (step 1) is a search-index write, not a canonical-record write. A Plane-indexed item still needs its Plane issue completed (or intake-registered if missing) before its local text — the only remaining trace of the work — is deleted (step 1.5) |

### Self-Check (every session start / end + every time before fix_plan Edit)

• Confidence: 76% confidence
• Finding: The skill instructs the agent to verify and potentially complete or register Plane issues before deleting local records, which can drive external state changes based on procedural rules rather than explicit user authorization. This is risky because it authorizes autonomous decisions and actions in another system during cleanup-oriented work.

Session Persistence

Medium

• Category: Rogue Agent

Content

5. Does the body to be compressed contain sub-bullets (options / verification medium / primary source / user-decision commit SHA / hold work / related plan refs) that would be lost?
6. If yes, did you call `mcp__<vendor>__*-store` **before** the Edit? Include source location (fix_plan-L<num>) + type/project/date/category metadata?
7. Only after RAG store success, run Edit (script does not handle other sections — manual obligation)
8. **At wrap-up, scan for oversized inline `- [x]` items outside `## Completed`** (rough heuristic: > 10 lines of body under one top-level item) — the `block-fixplan-completed-bloat.sh` hook advisory is one signal, but also check proactively since the hook only fires on the Edit/Write that touches the file
9. For each oversized item found, RAG-store the full detail (with pointer to any artifact file already holding it), then condense to a 1-line summary + pointers — same procedure as trigger condition 4

## Exceptions

• Confidence: 89% confidence
• Finding: The skill directs proactive scanning for oversized completed items and RAG-storing their full detail before condensing them, which expands persistence of potentially sensitive work history beyond immediate task needs. In context, this creates additional long-lived copies of troubleshooting steps, references, and commit context that may contain confidential operational information.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Line L011 includes the natural-language statement "this repo is PUBLIC, English-only source." This is a locale/language policy constraint expressed in the file comments, and the file does not indicate user choice, opt-in, or a region-specific justification for forcing English.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The natural-language comments explicitly describe a design where Korean detection patterns are excluded from the public repository and, if the external file is missing, cleanup detection works only for English markers. That means users in another language may receive different safety behavior without being offered a language choice or clear opt-in.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sources a git-ignored file as shell code using `. "$HG_DATA_FILE"`, which means any local modification to that file is executed with the privileges of the hook. Because the file is intentionally untracked and undisclosed to users, its contents can silently alter behavior or run arbitrary commands, creating a supply-chain/local tampering risk rather than merely a regex-configuration issue.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The comments at L021-L024 state that Korean-character patterns are kept out of the public repo and that behavior falls back to English-only markers when the local file is absent. This creates a language-dependent behavior that privileges English by default without an explicit opt-in or clearly documented user choice in the file.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill's core philosophy explicitly promotes preserving session progress, distilled facts, and learned knowledge across multiple storage destinations. That creates a real data-minimization problem: user-provided content and operational details can be duplicated broadly, increasing the chance of unintended retention or later disclosure.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: At the top-level execution order, Step 4 is documented as 'Weekly Report → record work (company projects only)'. Later, the actual Step 4 section says 'Checklist Record', requires checklist updates for all project types, and explicitly says not to call the weekly-report skill in Step 4. That is a direct contradiction in intent and procedure.

Static analysis

No suspicious patterns detected.