byterover

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.0.0

Overview

This skill is a legitimate memory tool, but it asks agents to use externalized memory and LLM processing too broadly and can persist or sync project knowledge without enough per-action user control.

Install only if you are comfortable with project memory and selected files being processed by a configured LLM provider. Prefer local search when possible, avoid storing secrets or personal data, review every memory write and remote sync manually, pin or otherwise verify the CLI package, and do not let the skill run its before/after workflow automatically on sensitive or unrelated tasks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Mandatory Workflow Hijacking Triggers External Context Processing

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:58

Finding

Automatic Curation Can Poison Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:537

Finding

Project Context Is Transmitted to External LLM Providers Without Mandatory Consent or Redaction

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The skill explicitly supports connecting arbitrary external LLM providers with user-supplied API keys. This is dangerous because it enables routing project queries and file contents to third-party services, potentially violating data-handling expectations and expanding the trust boundary to whichever provider is selected.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

bash

brv providers list
brv providers connect openai --api-key sk-xxx --model gpt-4.1

6. Project Locations

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 98% confidence

Finding

The skill states that brv query and brv curate send query text and included file contents to a configured LLM provider, and also supports cloud sync. That is a direct exfiltration path for project data; in this skill context it is especially risky because the skill instructs broad use before work and supports attaching source files.

Content

Scanner excerpt · SKILL.md (reported line 539)May include surrounding context.

md

**File access**: The `-f` flag on `brv curate` reads files from the current project directory only. Paths outside the project root are rejected. Maximum 5 files per command, text and document formats only.

**LLM usage**: `brv query` and `brv curate` send context to a configured LLM provider for processing. The LLM sees the query or curate text and any included file contents. No data is sent to ByteRover servers unless you explicitly run `brv vc push`.

**Cloud sync**: `brv vc push` and `brv vc pull` require authentication (`brv login`) and sync knowledge with ByteRover's cloud service via git. All other commands operate without ByteRover authentication.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest says no API key is needed by default, but the skill also documents authenticated flows and direct use of user-supplied API keys for third-party providers and cloud sync. This mismatch can mislead operators about when secrets may be requested or handled.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to use this skill 'before any work' is an overly broad trigger that pressures an agent to consult an externalized memory system for every task, regardless of necessity or sensitivity. In context, that broad invocation rule amplifies privacy and data-minimization risks because many tasks may unnecessarily query or send context to external providers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill expands from knowledge management into git-like version control, branching, resets, merges, clone, and remote sync. Those capabilities increase the mutation and exfiltration surface far beyond simple retrieval/curation and can lead to unintended state changes or remote data transfer if an agent uses them automatically.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Cross-provider access to Obsidian, GBrain, Memory Wiki, and local markdown broadens the accessible data perimeter beyond the stated project context tree. In an agent setting, this makes the skill more dangerous because a simple memory lookup can traverse unrelated personal or organizational knowledge stores and expose sensitive information.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest says no API key is needed by default, but the skill also documents authenticated flows and direct use of user-supplied API keys for third-party providers and cloud sync. This mismatch can mislead operators about when secrets may be requested or handled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.