dotfile

• Outcome: Review
• Latest audit: Sep 18, 2026 · 4:15 PM UTC
• Version: 0.6.1

Overview

This dotfile sync skill is mostly transparent, but it can persist conversation-derived knowledge and change multiple AI tool configurations, Syncthing settings, and startup behavior with incomplete safety checks.

Review this skill before installing if you do not intentionally want a shared ~/.agents source controlling multiple AI tools. Do not run the recovery deletes, Syncthing database reset, service migration, or memory-write workflows without checking paths, making backups, and confirming that no secrets or sensitive project details will be persisted or synced.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · CHANGELOG.md (reported line 29)May include surrounding context.

md

### Features

* **dotfile:** sync ~/.gemini/config/skills path in link scripts ([#181](https://github.com/es6kr/skills/issues/181)) ([9f038fe](https://github.com/es6kr/skills/commit/9f038febb4534ed735eac834aa89a79e43bf8f5f))
* promote next-feat to main ([4fbe313](https://github.com/es6kr/skills/commit/4fbe31332c58bf24327d819cc9204ebda2d4afa8))

## [0.4.2](https://github.com/es6kr/skills/compare/dotfile-v0.4.1...dotfile-v0.4.2) (2026-06-25)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Even though the target path is scoped to plugin marketplace data, the skill instructs users to run a forceful recursive delete without guardrails. In documentation for operational recovery, that creates a realistic accidental-misuse hazard because users often paste commands verbatim, and this skill specifically addresses multi-tool, multi-environment filesystem layouts where path confusion is more likely.

Content

Scanner excerpt · agents.md (reported line 125)May include surrounding context.

bash

# Inside the environment hitting EACCES (Windows OR WSL — never both)
rm -rf ~/.claude/plugins/marketplaces/<repo>
rm -rf ~/.claude/plugins/marketplaces/temp_*
# Then re-run plugin install / marketplace update

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

Even though the target path is scoped to plugin marketplace data, the skill instructs users to run a forceful recursive delete without guardrails. In documentation for operational recovery, that creates a realistic accidental-misuse hazard because users often paste commands verbatim, and this skill specifically addresses multi-tool, multi-environment filesystem layouts where path confusion is more likely.

Content

Scanner excerpt · agents.md (reported line 125)May include surrounding context.

bash

# Inside the environment hitting EACCES (Windows OR WSL — never both)
rm -rf ~/.claude/plugins/marketplaces/<repo>
rm -rf ~/.claude/plugins/marketplaces/temp_*
# Then re-run plugin install / marketplace update

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Even though the target path is scoped to plugin marketplace data, the skill instructs users to run a forceful recursive delete without guardrails. In documentation for operational recovery, that creates a realistic accidental-misuse hazard because users often paste commands verbatim, and this skill specifically addresses multi-tool, multi-environment filesystem layouts where path confusion is more likely.

Content

Scanner excerpt · agents.md (reported line 125)May include surrounding context.

bash

# Inside the environment hitting EACCES (Windows OR WSL — never both)
rm -rf ~/.claude/plugins/marketplaces/<repo>
rm -rf ~/.claude/plugins/marketplaces/temp_*
# Then re-run plugin install / marketplace update

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The wildcard deletion rm -rf ~/.claude/plugins/marketplaces/temp_* can remove multiple directories in one step with no preview or confirmation. Although intended for orphaned temporary marketplace directories, globs in destructive commands are error-prone and can have broader effects than expected if naming conventions change or the command is run in an unexpected environment.

Content

Scanner excerpt · agents.md (reported line 126)May include surrounding context.

bash

# Inside the environment hitting EACCES (Windows OR WSL — never both)
rm -rf ~/.claude/plugins/marketplaces/<repo>
rm -rf ~/.claude/plugins/marketplaces/temp_*
# Then re-run plugin install / marketplace update

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The wildcard deletion rm -rf ~/.claude/plugins/marketplaces/temp_* can remove multiple directories in one step with no preview or confirmation. Although intended for orphaned temporary marketplace directories, globs in destructive commands are error-prone and can have broader effects than expected if naming conventions change or the command is run in an unexpected environment.

Content

Scanner excerpt · agents.md (reported line 126)May include surrounding context.

bash

# Inside the environment hitting EACCES (Windows OR WSL — never both)
rm -rf ~/.claude/plugins/marketplaces/<repo>
rm -rf ~/.claude/plugins/marketplaces/temp_*
# Then re-run plugin install / marketplace update

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · syncthing.md (reported line 215)May include surrounding context.

brew services start syncthing

4. Remove backup after verification

rm -rf ~/Library/Application\ Support/Syncthing/index-v2.bak

text

**Windows (PowerShell - Run as Admin if service-managed):**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · syncthing.md (reported line 215)May include surrounding context.

brew services start syncthing

4. Remove backup after verification

rm -rf ~/Library/Application\ Support/Syncthing/index-v2.bak

text

**Windows (PowerShell - Run as Admin if service-managed):**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · syncthing.md (reported line 215)May include surrounding context.

brew services start syncthing

4. Remove backup after verification

rm -rf ~/Library/Application\ Support/Syncthing/index-v2.bak

text

**Windows (PowerShell - Run as Admin if service-managed):**

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 22)May include surrounding context.

md

### Bug Fixes

* **wip:** cross-ref PR-URL and TaskCreate subject repo-qualifier rules ([#186](https://github.com/es6kr/skills/issues/186)) ([4982364](https://github.com/es6kr/skills/commit/49823641a7b08123ebd0325273892bee41bc3280))

## [0.5.0](https://github.com/es6kr/skills/compare/dotfile-v0.4.2...dotfile-v0.5.0) (2026-08-03)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phrase "dotfile management" is overly general and may match a wide range of benign configuration tasks outside the intended toolchain. Because this skill includes references to symlinking, shared config propagation, and external synchronization, broad invocation can misroute users into procedures that alter important files or system state without sufficient relevance checks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The phrase "dotfile management" is overly general and may match a wide range of benign configuration tasks outside the intended toolchain. Because this skill includes references to symlinking, shared config propagation, and external synchronization, broad invocation can misroute users into procedures that alter important files or system state without sufficient relevance checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises destructive or state-altering operations such as API cleanup for encryption configuration and "DB reset" by deleting index data, but it does not present explicit warnings, confirmation requirements, backup expectations, or recovery guidance. In the context of synchronization tooling, these actions can cause data loss, reindex churn, device desynchronization, or prolonged service disruption if followed casually or on the wrong node.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The recovery section documents destructive deletion commands without requiring any verification of the resolved path, listing current contents, or confirming that the user is operating in the intended environment. In a cross-environment Windows/WSL setup, this increases the chance of accidental deletion of the wrong plugin marketplace data or overly broad matches, especially when placeholders or globs are copied blindly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs extracted session/project knowledge to be written into persistent Serena memory without requiring any sensitivity review, redaction, or data minimization. Because the extraction source is prior conversations and sessions, it can easily include secrets, internal infrastructure details, credentials, tokens, file paths, or incident data that should not be persistently stored, increasing long-term exposure and secondary leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill recommends documenting discovered infrastructure information, issue resolutions, and workflow details in persistent files like CLAUDE.md, rules, FAILED_ATTEMPTS.md, and Serena memory without warning that these artifacts may later be shared, synced, or committed. In the context of a dotfile/synchronization skill, this is more dangerous because the documented data may propagate across machines or repositories, broadening the blast radius of any sensitive disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · syncthing.md (reported line 14)May include surrounding context.

md

API_KEY=$(xmllint --xpath '//configuration/gui/apikey/text()' ~/Library/Application\ Support/Syncthing/config.xml)

# Add folder
curl -X POST -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  http://localhost:8384/rest/config/folders \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The DB reset section instructs users to stop Syncthing, move the index directory, and later delete the backup, but the header does not prominently warn that this is a destructive recovery procedure that can trigger lengthy reindexing and possible loss of local forensic/history value if the backup is removed too early. In an agent skill context, concise shell steps are likely to be copied verbatim, so insufficient warning increases the chance of accidental destructive use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · syncthing.md (reported line 257)May include surrounding context.

md

**Recommended approach**: Task Scheduler at user logon + VBS launcher for hidden execution. No password storage required. Run admin steps via `gsudo` (a Windows `sudo`-equivalent — installs via `winget install gerardog.gsudo`; if `gsudo` is unavailable, run an elevated PowerShell prompt manually for the `Register-ScheduledTask` step below).

##### Step 1: Create VBS hidden launcher

`syncthing.exe` is a console app — running it directly from Task Scheduler shows a console window that, **when closed, terminates the process**. Wrap it in VBS to launch hidden.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The migration procedure deletes an existing service and force-kills Syncthing processes, which can interrupt active synchronization and alter system persistence behavior, but it lacks an explicit safety warning about service disruption, unsynced state, and rollback implications. Because this is an operational how-to, the risk is not malicious code execution but unsafe destructive administration guidance.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · syncthing.md (reported line 309)May include surrounding context.

Start-ScheduledTask -TaskName "Syncthing"

text

##### Step 3: Run via gsudo

```powershell
gsudo powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.local\share\syncthing-migrate-to-user.ps1"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · syncthing.md (reported line 312)May include surrounding context.

Start-ScheduledTask -TaskName "Syncthing"

text

##### Step 3: Run via gsudo

```powershell
gsudo powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.local\share\syncthing-migrate-to-user.ps1"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · syncthing.md (reported line 339)May include surrounding context.

$home = "$env:USERPROFILE.local\share\syncthing" # Syncthing --home directory $user = "$env:USERDOMAIN$env:USERNAME" # account to run the service as

sc.exe create syncthing binPath= ""$shawl" run --name syncthing -- "$syncthing" --no-browser --home="$home"" start= auto obj= $user password= "<USER_PASSWORD>"

Plus: grant "Log on as a service" right via secpol.msc or ntrights.exe

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The legacy workaround edits Syncthing's config.xml directly without first instructing the user to stop Syncthing and back up the file, which risks config corruption, daemon overwrite races, or unintended path changes. Direct config-file mutation is especially error-prone in agent-delivered instructions because users may run it against a live daemon.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.