byterover

• Outcome: Review
• Latest audit: Aug 2, 2026 · 2:43 PM UTC
• Version: 1.0.0

Overview

This skill is mostly a knowledge-management helper, but it pushes agents toward broad memory access and external processing in ways users should review before installing.

Install only if you are comfortable with project knowledge, query text, and selected file contents being processed by a configured LLM provider, and with optional cloud or external memory-provider workflows. Prefer local search where possible, avoid curating secrets or personal data, and require explicit user intent before using sync, swarm curate, or file-including curate commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest frames the skill as project-local knowledge management, but the documented feature set includes remote-capable providers, swarm integrations, and cloud sync. This mismatch can mislead users or agents about where data may flow, weakening informed consent and increasing the chance that sensitive project context is sent outside the local repository.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The Data Handling section states that all knowledge is stored in `.brv/context-tree`, but earlier sections document storage into external providers such as GBrain, Local Markdown, and Memory Wiki. This inaccurate data-flow description can cause users to persist sensitive information under the false assumption it remains only in the local project tree.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The file claims no data is sent to ByteRover servers unless `brv vc push` is used, but it also describes `brv query`/`brv curate` sending context to a configured LLM provider and swarm features that interact with external providers. Even if not sent to ByteRover specifically, the statement materially understates third-party data exposure and may lead users to disclose secrets to remote services unintentionally.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The query activation guidance is so broad that it encourages running retrieval before nearly any action, including routine tasks. In this skill context, that increases unnecessary exposure of user prompts, project state, and internal rules to external providers or stored memory systems, especially because `brv query` uses an LLM provider.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The curate guidance encourages persisting broad categories of interaction content, including meaningful memories from user interactions and facts about actions taken. That creates a real risk of over-collection and long-term retention of sensitive or unnecessary data without sufficiently strict minimization or consent boundaries.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The instruction that the skill 'MUST' be used before any work removes agent discretion and can override user intent or safer handling choices. Because this skill may invoke external retrieval and persistence operations, mandatory pre-use increases the chance of unnecessary data access, disclosure, and policy bypass by design.

Exfiltration Commands

High

• Category: Prompt Injection

Content

**File access**: The `-f` flag on `brv curate` reads files from the current project directory only. Paths outside the project root are rejected. Maximum 5 files per command, text and document formats only.

**LLM usage**: `brv query` and `brv curate` send context to a configured LLM provider for processing. The LLM sees the query or curate text and any included file contents. No data is sent to ByteRover servers unless you explicitly run `brv vc push`.

**Cloud sync**: `brv vc push` and `brv vc pull` require authentication (`brv login`) and sync knowledge with ByteRover's cloud service via git. All other commands operate without ByteRover authentication.

• Confidence: 89% confidence
• Finding: The skill explicitly documents commands that send query text, curated content, and included file contents to a configured LLM provider. In a memory-management skill that encourages frequent use, this creates a concrete exfiltration path for source code, architecture details, secrets, or sensitive user data if operators misunderstand the boundary or providers are remote.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.