ClawVault

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:50 PM UTC
• Version: 3.0.0

Overview

This vault-sync skill is purpose-aligned, but it needs Review because it handles sensitive agent memory and system setup with under-disclosed encryption and several unsafe high-impact paths.

Review carefully before installing. The skill is not plainly malicious, but it syncs highly sensitive identity, memory, project, package, and skill data while overstating encryption, and some setup/restore paths can execute privileged or remotely influenced commands. Do not use it for confidential data unless content encryption, cloud account enrollment, SSH verification, package restore validation, and rclone installation are fixed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: providers/gdrive.sh:26

Finding

Unverified Remote Installer Executed with Shell and Root Privileges

Content

View full analysis

/dev/null; then log "rclone not found. Installing..." case "$(uname -s)" in Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;; Linux) curl https://rclone.org/install.sh | sudo bash ;; esac fi } ``` Equivalent installation logic appears in all four listed provider implementations. ### Technical Analysis When `rclone` is unavailable, the provider automatically downloads a mutable script from `https://rclone.org/install.sh` and streams it directly into `bash`. On Linux, the script is executed through `sudo bash`, granting the downloaded payload root privileges. The implementation does not: - Pin an immutable rclone release. - Download the installer before execution. - Verify a cryptographic signature or expected checksum. - Display the downloaded code for review. - Obtain separate consent before executing a root-level installer. The domain is the expected upstream rclone domain, but HTTPS alone does not protect against compromise of the upstream publication process, domain, TLS termination, or installer hosting infrastructure. The effective code executed on a user's machine can change after this Skill has been reviewed. Installing rclone is relevant to the provider functionality, but executing mutable remote code—particularly as root—exceeds the minimum privileges necessary. ### Attack Path 1. A user selects Google Drive, Dropbox, S3, or WebDAV as the storage provider. 2. The corresponding setup function invokes `ensure_rclone`. 3. The machine does not already have `rclone`. 4. An attacker compromises or intercepts the remote installer source, DNS resolution, ...[truncated 864 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: cloud-api-worker/src/index.ts:124

Finding

Unauthenticated Existing-Account Key Registration Enables Cloud Vault Takeover

Content

View full analysis

(); if (existing) { // Register new key if provided and not already registered if (body.public_key) { const fp = await computeFingerprintAsync(body.public_key); const dup = await db .prepare("SELECT id FROM vault_keys WHERE vault_id = ? AND fingerprint = ? AND revoked_at IS NULL") .bind(existing.id, fp) .first(); if (!dup) { await db .prepare("INSERT INTO vault_keys (id, vault_id, public_key, fingerprint, hostname, instance_id) VALUES (?, ?, ?, ?, ?, ?)") .bind(crypto.randomUUID(), existing.id, body.public_key, fp, body.hostname || "", body.instance_id || "") .run(); } } return c.json({ vault_id: existing.id, status: "existing" }); } ``` ### Technical Analysis The `/v1/signup` route does not require authentication. If the submitted email already belongs to a vault, the route registers the requester's supplied public key directly against that existing vault and returns the vault ID. This bypasses the dedicated key-registration route at `cloud-api-worker/src/index.ts:438-474`, which correctly requires a signature from an existing authorized key. Knowledge of an account email is therefore treated as sufficient authorization to add a new signing key. Once the attacker's key is inserted, it becomes indistinguishable from a legitimate active key for the purposes of `authenticateVault`. The attacker can sign requests for download, upload, profile listing, key registration, and key revocation. ### Attack Path 1. The attacker obtains or guesses a ClawVault customer's email address. 2. The attacker generates their own Ed25519 key pair. 3. The attacker submits the v ...[truncated 1218 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: providers/cloud.sh:148

Finding

Sensitive Agent Memory Is Uploaded Without Client-Side Encryption

Content

View full analysis

/dev/null local archive_hash archive_hash=$(shasum -a 256 "$archive" 2>/dev/null || sha256sum "$archive" | awk '{print $1}') archive_hash=$(echo "$archive_hash" | awk '{print $1}') local signature signature=$(sign_request "$archive_hash" 2>/dev/null || echo "unsigned") http_code=$($CURL -sf -o /dev/null -w "%{http_code}" \ -X PUT "$API_BASE/vaults/$vault_id/profiles/$profile_name/sync" \ -H "X-ClawVault-Signature: $signature" \ -H "X-ClawVault-Hash: $archive_hash" \ -H "Content-Type: application/gzip" \ --data-binary "@$archive" 2>/dev/null) || http_code="000" ``` The declared behavior states: ```md - **Encrypted**: Ed25519 keypair per installation — private key never leaves the machine ``` ### Technical Analysis The implementation signs the archive hash with an Ed25519 key, but signing provides authenticity rather than confidentiality. The archive is gzip-compressed using `tar -czf`; it is not encrypted. The staged archive can contain sensitive material, including: - `identity/USER.md` - `knowledge/MEMORY.md` - Project context under `knowledge/projects` - `requirements.yaml` - `skills-manifest.yaml` - Hostnames and instance metadata - Local Git metadata and historical content, because `.git/` is not excluded from the managed-cloud staging command TLS protects the network connection in transit, but the ...[truncated 1690 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: track-packages.sh:267

Finding

Remote Package Manifest Allows Shell Command Injection Through eval

Content

View full analysis

/dev/null | grep '^\s*- name:' | awk -F'"' '{print $2}') for pkg in $mgr_pkgs; do if echo "$missing" | grep -qx "$pkg"; then mgr_missing="$mgr_missing $pkg" fi done if [[ -n "$mgr_missing" ]]; then local cmd="" case "$mgr" in brew) cmd="brew install$mgr_missing" ;; apt) cmd="sudo apt install -y$mgr_missing" ;; npm_global) cmd="npm install -g$mgr_missing" ;; pip_global) cmd="pip3 install$mgr_missing" ;; snap) cmd="sudo snap install$mgr_missing" ;; flatpak) cmd="flatpak install$mgr_missing" ;; esac if [[ -n "$cmd" ]]; then echo "Install command ($mgr):" echo " $cmd" echo "" read -rp "Run this command? [y/N]: " yn if [[ "$yn" =~ ^[Yy] ]]; then eval "$cmd" || log "Some packages failed to install" fi fi fi done ``` ### Technical Analysis Package names are extracted from `.vault-requirements.yaml`, which can originate from remote synchronized storage. The values are not parsed using a safe YAML parser and are not validated against package-manager-specific naming rules. The script concatenates package names into a command string and invokes that string with `eval`. Shell metacharacters, command substitutions, redirections, or separators embedded in a package name can therefore be interpreted as shell syntax. Displaying the generated command and requesting confirmation reduces accidental execution but does not neutralize the injection. A deceptive package name can be overlooked, and some generated commands invoke `sudo`. ### Attack Path 1. An attacker ...[truncated 1187 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: providers/ftp.sh:48

Finding

SSH Host Verification Is Disabled for SFTP and Git Providers

Content

View full analysis

/dev/null || true rsync -avz -e "ssh -i $key -p $port -o StrictHostKeyChecking=no" \ $EXCLUDE "$VAULT_DIR/" "$user@$host:$target_path/" 2>&1 | tail -3 ``` ```sh _git() { GIT_SSH_COMMAND="ssh -i $VAULT_DIR/keys/clawvault_ed25519 -o StrictHostKeyChecking=no" git -C "$REPO_DIR" "$@" } ``` ```sh GIT_SSH_COMMAND="ssh -i $VAULT_DIR/keys/clawvault_ed25519 -o StrictHostKeyChecking=no" git clone "$remote_url" "$REPO_DIR" ``` ### Technical Analysis `StrictHostKeyChecking=no` prevents SSH from enforcing trusted server identity. The client still authenticates using its Ed25519 private key, but it does not reliably establish that the remote endpoint is the intended server. The FTP provider is actually implemented through SSH/SFTP and rsync-over-SSH. The code does not write directly to local `authorized_keys`; it displays the public key and asks the user to register it on the intended server. That behavior is consistent with key-based SFTP authentication. The security defect is disabling server host verification, not displaying the public key. Because synchronized data is not client-side encrypted, a machine-in-the-middle can receive readable vault content. A malicious endpoint can also return modified vault files. ### Attack Path 1. The user configures an SFTP or SSH Git destination. 2. An attacker controls DNS resolution, the local network, a proxy, or routing between the user and the destination. 3. The attacker presents an arbitrary SSH host key while impersonating the configured host. 4. The client accepts the key because strict host checking is disabled. 5. During push, the attacker receives readable synchronized vault content. 6. Dur ...[truncated 763 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: providers/ftp.sh:15

Finding

Unvalidated SFTP Configuration Is Interpolated into Local and Remote Shell Commands

Content

View full analysis

"$PROVIDER_CONFIG" </dev/null || true log "Pushing via $proto to $host (profile: $profile_name)..." rsync -avz -e "ssh -i $key -p $port -o StrictHostKeyChecking=no" \ $EXCLUDE "$VAULT_DIR/" "$user@$host:$target_path/" 2>&1 | tail -3 log "Push complete (profile: $profile_name)" } ``` ### Technical Analysis The setup flow accepts protocol, host, port, username, and remote path without strict validation. These values are stored through direct JSON string interpolation and later inserted into SSH, rsync, and remote-shell contexts. In particular: - `target_path` is placed inside a remote command string using single quotes, but embedded single quotes are not escaped. - `port` is used as an SSH option value without requiring a numeric range. - The rsync remote specification combines the unvalidated username, host, and path. - The `-e` command is constructed as a string rather than a safely controlled argument structure. - Option-like or syntactically significant values may change local or remote command interpretation. - Raw interpolation c ...[truncated 1290 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (108)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Even within the document itself, there is a meaningful trust gap: the skill markets itself as automatic and encrypted while also including package-installation and environment-mutation commands. If encryption and scope guarantees are not clearly enforced and validated, users may permit highly sensitive syncing and system changes under assumptions that are stronger than what is actually guaranteed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Even within the document itself, there is a meaningful trust gap: the skill markets itself as automatic and encrypted while also including package-installation and environment-mutation commands. If encryption and scope guarantees are not clearly enforced and validated, users may permit highly sensitive syncing and system changes under assumptions that are stronger than what is actually guaranteed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Even within the document itself, there is a meaningful trust gap: the skill markets itself as automatic and encrypted while also including package-installation and environment-mutation commands. If encryption and scope guarantees are not clearly enforced and validated, users may permit highly sensitive syncing and system changes under assumptions that are stronger than what is actually guaranteed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Even within the document itself, there is a meaningful trust gap: the skill markets itself as automatic and encrypted while also including package-installation and environment-mutation commands. If encryption and scope guarantees are not clearly enforced and validated, users may permit highly sensitive syncing and system changes under assumptions that are stronger than what is actually guaranteed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Even within the document itself, there is a meaningful trust gap: the skill markets itself as automatic and encrypted while also including package-installation and environment-mutation commands. If encryption and scope guarantees are not clearly enforced and validated, users may permit highly sensitive syncing and system changes under assumptions that are stronger than what is actually guaranteed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Even within the document itself, there is a meaningful trust gap: the skill markets itself as automatic and encrypted while also including package-installation and environment-mutation commands. If encryption and scope guarantees are not clearly enforced and validated, users may permit highly sensitive syncing and system changes under assumptions that are stronger than what is actually guaranteed.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The triggers include generic words like sync, packages, backup, restore, and cloud, which are likely to overlap with ordinary user conversation. Because the skill can invoke shell/file operations, broad trigger matching increases the risk of accidental activation leading to data transfer, package changes, restore operations, or provider setup in contexts where the user did not intend to engage this skill.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.2 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The project directly depends on hono 4.12.2, and the listed advisories include cookie handling and routing flaws that can affect request processing and response header generation. Because this is a cloud API worker, framework-level issues in cookie writing, path mounting, or request handling are more dangerous here than in a non-networked tool, since they may be reachable by remote clients.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

sharp 0.34.5 is flagged for inherited vulnerabilities in bundled native image libraries such as libvips/libheif. In this lockfile sharp is only brought in through miniflare as a dev dependency, so the issue is real but likely constrained to local tooling and test environments unless image processing is exposed through those tools.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.18.2 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

undici 7.18.2 is associated with multiple HTTP parsing and request/response smuggling style issues. Although it is present here via miniflare as a dev dependency, these classes of bugs can materially affect any local preview, testing proxy, or internal service interaction that handles attacker-controlled HTTP traffic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 81% confidence

Finding

ws 8.18.0 is reported vulnerable to memory disclosure and memory exhaustion DoS conditions. Here it is pulled in through miniflare for development tooling, so the risk is primarily to developer or CI environments, but if preview services accept websocket connections from untrusted parties they may be crashable or expose process memory.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.2 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The runtime dependency resolution allows hono 4.12.2, and the finding indicates that version has multiple known high-severity advisories affecting cookie handling and route mounting behavior. In a cloud API worker for a portable identity vault, weaknesses in cookie generation, header sanitization, or routing can undermine authentication, session integrity, or access control and are therefore materially dangerous.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile pins @hono/node-server to 1.19.9, and the cited advisories describe path traversal and authorization bypass issues in static file serving on Node, including repeated-slash and encoded-path handling. In a cloud API for a portable identity vault, any bypass around protected static paths could expose sensitive files, tokens, or internal assets if serveStatic is used anywhere in the application.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The provider auto-installs rclone by piping a remotely fetched script directly into a shell, and on Linux does so through sudo. This creates a supply-chain and arbitrary code execution risk because any compromise of the download source, network path, or install script executes attacker-controlled code locally with elevated privileges, which is far beyond the minimum needed for a Dropbox sync provider.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Piping curl output directly to bash executes untrusted remote content immediately with no integrity verification, review step, or pinning. In this skill context, a Dropbox provider should not need to grant a website the ability to run arbitrary local code just to satisfy a missing dependency.

Content

Scanner excerpt · providers/dropbox.sh (reported line 12)May include surrounding context.

sh

if ! command -v rclone &>/dev/null; then
    log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This variant is worse because the remotely fetched script is piped into sudo bash, combining remote script execution with privilege escalation. Any compromise of the script source, DNS/TLS trust chain, or upstream distribution path can result in immediate root compromise of the machine.

Content

Scanner excerpt · providers/dropbox.sh (reported line 13)May include surrounding context.

sh

log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi
}

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The shell pipeline chains network retrieval directly into privileged shell execution, which is a classic dangerous pattern because it removes inspection boundaries and amplifies any upstream compromise into root-level command execution. Given this is a sync-provider skill, the behavior is especially unjustified and increases risk disproportionate to functionality.

Content

Scanner excerpt · providers/dropbox.sh (reported line 13)May include surrounding context.

sh

log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi
}

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Piping curl output directly into bash executes network-delivered code without integrity verification. This creates a classic supply-chain risk where compromise of the remote server, DNS, TLS trust, or fetched script leads to arbitrary command execution on the user's system.

Content

Scanner excerpt · providers/gdrive.sh (reported line 30)May include surrounding context.

sh

if ! command -v rclone &>/dev/null; then
    log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup path executes a remote script immediately, and on Linux does so through sudo bash without an explicit consent gate at the execution point. That gives externally sourced code root-level execution, so compromise of the installer source or network path could lead to full host compromise.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This variant is more severe because the externally fetched script is executed under sudo, turning remote-code execution into root-code execution. In the context of a vault product handling sensitive identity and memory data, host compromise would also expose highly sensitive local and synced data.

Content

Scanner excerpt · providers/gdrive.sh (reported line 31)May include surrounding context.

sh

log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi
}

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The pipeline chains network retrieval directly into privileged shell execution, collapsing download, review, and execution into one step. This pattern removes opportunities for inspection and makes exploitation trivial if the upstream content is malicious or altered.

Content

Scanner excerpt · providers/gdrive.sh (reported line 31)May include surrounding context.

sh

log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi
}

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Disabling SSH host key verification without a prominent warning silently trades away a core SSH security guarantee. In this skill's context, the behavior is more dangerous because the product markets 'automatic, invisible, encrypted' vault syncing, so users may assume transport authenticity while sensitive data is exposed to interception or redirection.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · providers/git.sh (reported line 57)May include surrounding context.

sh

# Fetch latest from remote, reset to it
  _git fetch origin "$branch" --quiet 2>/dev/null || true
  _git reset --hard "origin/$branch" --quiet 2>/dev/null || true

  # Apply vault contents into profile subdirectory
  mkdir -p "$profile_dir/identity" "$profile_dir/knowledge"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · providers/git.sh (reported line 108)May include surrounding context.

sh

# Fetch latest from remote, reset to it
  _git fetch origin "$branch" --quiet 2>/dev/null || true
  _git reset --hard "origin/$branch" --quiet 2>/dev/null || true

  # Apply vault contents into profile subdirectory
  mkdir -p "$profile_dir/identity" "$profile_dir/knowledge"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pull path fetches remote state and copies selected files into the local vault, overwriting local identity, memory, and requirements files without confirmation, diff display, backup, or conflict handling. Because this vault stores persistent identity and knowledge, a remote compromise or mistaken profile selection could silently replace trusted local state with attacker-controlled or destructive content.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification, suspicious.obfuscated_code

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: cloud-api/src/db.ts:8

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: src/keypair.sh:55