vardoger — Analyze History

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 0.3.2

Overview

This skill has a coherent personalization purpose, but it asks to read private conversation history and persistently change global assistant rules with weak scoping and unsafe command guidance.

Review this carefully before installing. It is meant to analyze private conversation history and permanently change assistant behavior, so only run it if you trust the vardoger package and want global personalization. Prefer a pinned, reviewed vardoger version, require explicit consent before reading sessions or writing rules, and do not pipe generated markdown through echo; use a safer stdin/file mechanism.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:91

Finding

Command Injection Through Shell Interpolation of Generated Personalization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 91-95
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code:

bash

echo "YOUR_PERSONALIZATION_HERE" | vardoger write --platform openclaw --scope global

The accompanying instruction states:

text

Replace `YOUR_PERSONALIZATION_HERE` with the actual personalization markdown you generated.

Technical Analysis

The skill directs the agent to place generated personalization text directly inside a double-quoted shell argument. Although double quotes prevent ordinary word splitting, they do not prevent shell command substitution through constructs such as $(command) or backticks.

The personalization is synthesized from historical conversation content. If untrusted conversation text influences the generated Markdown, shell syntax could be preserved in the personalization and then inserted into the documented command. The shell would evaluate command substitutions before passing the resulting text to echo and vardoger.

For example, personalization text containing a construct equivalent to $(malicious-command) could cause that command to execute rather than being treated purely as Markdown.

Attack Path

1. An attacker introduces specially crafted text containing shell command-substitution syntax into conversation history.
2. vardoger prepare exposes that historical text to the assistant during batch analysis.
3. The malicious syntax survives summarization and appears in the generated personalization.
4. The assistant replaces YOUR_PERSONALIZATION_HERE with that generated content in the documented shell command.
5. The shell evaluates the embedded command substitution.
6. The injected command executes with the privileges of the user running the agent.

Impact Assessment

Successful exploitation permits arbitrary command execution under the account running the skill. The resulting process c ...[truncated 509 chars]

Remediation

View remediation

Remediation Suggestions

• Never interpolate generated or conversation-derived content into shell source code.
• Prefer invoking vardoger through a process API with an explicit argument array and supplying the personalization through standard input.
• If a shell must be used, place the personalization in a securely created file using a file-writing API, then redirect that file to the command.
• A quoted heredoc may be used only if its delimiter is fixed and guaranteed not to occur in the content. A direct file API is safer.
• Validate that generated personalization contains only expected Markdown, but do not rely on validation as the primary command-injection defense.
• Add documentation explicitly prohibiting construction of commands such as echo "$GENERATED_CONTENT".
• Execute the write operation with the minimum filesystem and network permissions required.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Execution of a Security-Sensitive Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44-57
Vulnerability Type: Unpinned third-party dependency and unsafe package execution
Risk Level: Medium

Vulnerable Code:

text

Install options:

  # Recommended:
  pipx install vardoger

  # Or run without installing:
  uvx vardoger --help

If you do not have pipx, see https://pipx.pypa.io/stable/installation/.

Project page: https://github.com/dstrupl/vardoger

Technical Analysis

Both installation methods resolve the package name without specifying an audited version or verifying artifact integrity. Consequently, the installed or executed code is whichever release the package index currently serves under the vardoger name.

This is especially security-sensitive because the skill grants the dependency access to private conversation histories and persistent assistant configuration. The uvx vardoger --help alternative may download and execute package code immediately, without first pinning or reviewing a specific release.

Linking to a source repository does not establish that the registry artifact was built from the referenced source or that the fetched release is trusted. No hashes, signatures, lockfile, publisher verification, or version constraints are provided.

Attack Path

1. A package registry account, package release process, dependency, or distribution artifact associated with vardoger is compromised or maliciously modified.
2. A user follows the skill instructions and runs pipx install vardoger or uvx vardoger --help.
3. The package manager retrieves and executes the current unverified artifact.
4. The compromised package executes with the user's privileges.
5. During normal skill use, it can access conversation history and persistent rules files made available to the legitimate CLI.
6. The malicious package can disclose sensitive data or alter persistent assistant instructions within the user's permissio ...[truncated 673 chars]

Remediation

View remediation

Remediation Suggestions

• Pin vardoger to a specific version that has been reviewed, for example through an exact package==version constraint.
• Verify package artifacts with trusted hashes or cryptographic signatures.
• Document the expected package publisher, registry, source repository, release tag, and artifact provenance.
• Avoid recommending unversioned uvx execution because it downloads and runs package code immediately.
• Review and pin transitive dependencies using a lockfile or hash-locked requirements.
• Run the CLI with least privilege and grant access only to the exact conversation and output paths required.
• Reassess and update the pinned version through a controlled review process rather than automatically consuming the newest release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

- Reads conversation history from the platform's session directory (e.g. `~/.codex/sessions/`, `~/.claude/projects/`, `~/.cursor/projects/`, `~/.openclaw/agents/`).
- Writes a checkpoint state file to `~/.vardoger/state.json` (created on first run).
- Writes the final personalization to the platform's rules file (e.g. `~/.codex/AGENTS.md`, `~/.claude/rules/vardoger.md`, `.cursor/rules/vardoger.md`, `~/.openclaw/skills/vardoger-personalization/SKILL.md`).

When the host asks to approve a `vardoger` command, approve it with write access beyond the workspace. Otherwise the first `vardoger prepare` call will fail with `PermissionError: ... ~/.vardoger/state.tmp` because the sandbox blocks writes outside the current working directory.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill explicitly instructs the host to approve vardoger with write access beyond the workspace and documents persistent writes to user home directories and rules files. This grants a tool the ability to store state and modify long-lived assistant behavior outside the normal project boundary, which is dangerous because it can persist sensitive data and alter future agent behavior across sessions.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

- Writes a checkpoint state file to `~/.vardoger/state.json` (created on first run).
- Writes the final personalization to the platform's rules file (e.g. `~/.codex/AGENTS.md`, `~/.claude/rules/vardoger.md`, `.cursor/rules/vardoger.md`, `~/.openclaw/skills/vardoger-personalization/SKILL.md`).

When the host asks to approve a `vardoger` command, approve it with write access beyond the workspace. Otherwise the first `vardoger prepare` call will fail with `PermissionError: ... ~/.vardoger/state.tmp` because the sandbox blocks writes outside the current working directory.

## Steps

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill suggests running uvx vardoger without pinning an exact package version, which can fetch and execute whatever the latest published package is at runtime. In a security-sensitive workflow that reads private conversation history and writes personalization files outside the workspace, this creates a supply-chain risk if an upstream release is compromised or unexpectedly changes behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation conditions are broad enough that routine user language like asking to 'analyze conversation history' or mentioning 'vardoger' may trigger a workflow that reads sensitive session data and writes persistent personalization files. Because the skill performs high-privilege actions outside the workspace, unintended invocation materially increases privacy and integrity risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.