Agented

• Outcome: Pass
• Latest audit: Jul 15, 2026 · 1:59 PM UTC
• Version: 1.4.0

Overview

Agented is a disclosed agent-focused text editor with sensitive but user-invoked integration features for other agent clients.

Install this if you want agents to use ae as a persistent editor. Expect edits to touch disk, a .agented workspace database to be created, and annotations/history to persist. Prefer the Homebrew install path over curl-to-shell, and review targets carefully before running ae skill install, ae mcp install, or ae permissions commands because those can change other agent clients' configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: These entries describe functionality that writes deny/allow policy changes into external agent clients and shell-command restrictions, which is outside the narrow necessity of a text editor and alters the host agent's security posture. Even if intended as a safety feature, modifying other tools' permission files can unexpectedly weaken user control, create persistence, or disrupt established safeguards if done without strong consent and clear scoping.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This feature writes MCP and extension configuration into external client settings directories, enabling the tool to persistently register itself with other agent environments. That creates a supply-chain and persistence risk because a text-editing tool is modifying execution/configuration surfaces of separate clients, potentially broadening trust and tool access beyond user expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README recommends `curl ... | sh`, which executes remote content immediately without giving users a chance to inspect it or verify provenance. If the upstream source, transport, repository, or install script is compromised, users may run arbitrary code on their system, and this project targets agent/plugin installation where users may be especially inclined to copy-paste setup commands.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The README states that `ae skill install` writes `SKILL.md` into multiple detected agent skill directories, but does not clearly enumerate the scope, prompt for confirmation, or warn about the filesystem modifications. In the context of agent tooling, writing prompt/skill files into many agent environments can change future agent behavior across tools and persist beyond the current session, so users should be explicitly informed before running it.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill documents `ae open <new-path>` as a file-creation primitive without a prominent warning that opening a nonexistent path will modify the filesystem. In agent settings, a model may interpret `open` as read-only and unintentionally create files, leading to unwanted repository changes or triggering downstream automation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented default auto-save and auto-load behavior can persist edits to disk and reconcile external changes in the same call, which makes nominal editing operations state-changing even when the caller may expect an in-memory workspace only. In an autonomous agent context, this increases the risk of unintended file modification, overwriting, or committing blended external changes without clear user awareness.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Features

- **`ae permissions disable-internals` now writes a Codex deny rule too**, completing the Claude / Gemini / Codex matrix. Codex's only edit primitive at the public surface is `apply_patch`, so the implementation maps the canonical Read/Edit/Write/NotebookEdit input down to one TOML line — `apply_patch = false` under a `[tools]` table in `~/.codex/config.toml` — written idempotently with our own minimal section editor (no external TOML lib).

  Honesty caveat: Codex accepts `tools.apply_patch = false` via `-c` parsing without error, but the published config docs don't explicitly state that this disables the tool at runtime. Treated as **experimental** — the docs flag it, the rule gets written, and users can verify the behavior in their own Codex session.

• Confidence: 96% confidence
• Finding: Writing to `~/.codex/config.toml` modifies another agent's global behavior and can persist across sessions and repositories. Access to agent config directories is dangerous because it can silently alter what tools are enabled or disabled, creating persistent policy changes that affect future agent actions outside the current task.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| Target | Mechanism | File |
  |---|---|---|
  | claude | `permissions.deny` array | `~/.claude/settings.json` (global) or `.claude/settings.local.json` (project) |
  | codex | `tools.apply_patch = false` (experimental) | `~/.codex/config.toml` (global) |
  | gemini | Policy Engine TOML rules | `~/.gemini/policies/agented-deny.toml` (global) |
  | openclaw | n/a — managed at agent level | — |

• Confidence: 97% confidence
• Finding: The documented ability to write `~/.claude/settings.json` is a high-risk persistence mechanism because it changes a host agent client's permissions or behavior outside the edited project. In skill context this is more dangerous than ordinary file editing, since agent config files govern future tool access and trust decisions.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| Target | Mechanism | File |
  |---|---|---|
  | claude | `permissions.deny` array | `~/.claude/settings.json` (global) or `.claude/settings.local.json` (project) |
  | codex | `tools.apply_patch = false` (experimental) | `~/.codex/config.toml` (global) |
  | gemini | Policy Engine TOML rules | `~/.gemini/policies/agented-deny.toml` (global) |
  | openclaw | n/a — managed at agent level | — |

• Confidence: 96% confidence
• Finding: Global writes to `~/.codex/config.toml` give the tool a persistent foothold in another agent ecosystem and can alter tool policies beyond the current project. Because these changes affect future sessions, the security impact is higher than normal configuration editing and can be abused for privilege shaping or policy tampering.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| Target | What `disable-internals` writes |
  |---|---|
  | claude | `permissions.deny` in `~/.claude/settings.json` |
  | gemini | `~/.gemini/policies/agented-deny.toml` (Policy Engine TOML) |
  | codex | skip (no upstream schema) |
  | openclaw | skip (managed at agent level) |

• Confidence: 96% confidence
• Finding: The changelog indicates writes to `~/.claude/settings.json`, again showing direct access to a host agent's configuration directory. Such access is sensitive because it can modify permission enforcement and persistently influence agent behavior outside the tool's core editing role.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

- **Per-workspace LSP daemons**. The LSP daemon model follows the same shape: each workspace gets its own daemon, lazily spawned on the first write that targets it. `lsp.SpawnBackground` and `lsp.EnsureDaemon` are now in the `lsp` package (used by both CLI and MCP), and spawn explicitly with `--workspace-dir <wsDir>` so the daemon attaches to the right project regardless of the parent process's cwd. New `Engine.NotifyLSPIfWrite` hook is invoked from MCP after every successful tool call.
- **Per-LSP `init_options` pass-through**. `IDEServerCfg.InitOptions` (a free-form `map[string]any`) is forwarded verbatim as the LSP `initialize` request's `initializationOptions` field. ae does no validation; the schema is whatever the server accepts. Closes the recurring "rust-analyzer / clippy / linkedProjects" round-trip — users can drop `init_options: { check: { command: "clippy" } }` directly into ae's config instead of wrangling a separate `rust-analyzer.toml`.
- **Unified `internal/agents` registry**. The skill-target list (`internal/skill/targets.go`) and MCP-install-target list (`internal/mcpinstall`) used to duplicate per-agent definitions for Claude, Codex, Cursor, Gemini, OpenClaw. They now both build their slices from a single source of truth in `internal/agents/agents.go` — adding a new client is a one-place change.
- **Gemini CLI integration**. New target across both surfaces: `ae skill install --target gemini` writes to `~/.gemini/extensions/agented/GEMINI.md` plus a sibling `gemini-extension.json` so Gemini recognises the directory; `ae mcp install --target gemini` writes the agented entry to `~/.gemini/settings.json`.

### Fixes

• Confidence: 97% confidence
• Finding: Writing to `~/.gemini/settings.json` or extension directories affects another agent platform's runtime configuration and installed capabilities. In this skill context, that is especially sensitive because it turns an editor into an installer/configurator with cross-client persistence, increasing the blast radius of misuse or compromise.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.