Ai Mother

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:48 AM UTC
• Version: 1.0.1

Overview

This skill has a coherent AI-supervisor purpose, but it grants ongoing access to local agent sessions and process control with several unsafe implementation and scoping issues.

Install only if you explicitly want an automated supervisor that can keep running on a schedule, inspect local AI transcripts and project state, send Feishu DMs, and inject input into live processes. Before using it, disable or review the cron jobs, avoid --auto duplicate cleanup, restrict target PIDs to verified agent sessions, and fix the unsafe state parsing and Python interpolation issues.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (7)

T06 · System Persistence

Error

• Location: scripts/setup.sh:103

Finding

Automatic Installation of a Persistent Scheduled Patrol

Content

View full analysis

/dev/null | grep -c '"name":\s*"ai-mother-patrol"' || echo "0") if [ "$EXISTING_CRON" -ge "1" ]; then echo "✅ Scheduled patrol already configured" else # Create cron job (every 30 minutes) if openclaw cron add \ --name "ai-mother-patrol" \ --every "30m" \ --message "$CRON_MSG" \ --channel "feishu" \ --to "user:$OPEN_ID" \ --session "isolated" \ --timeout-seconds 120 \ --announce \ 2>/dev/null; then echo "✅ Scheduled patrol configured (every 30 minutes)" ``` ### Technical Analysis The setup wizard automatically registers a recurring OpenClaw cron task after collecting the Feishu Open ID. There is no separate opt-in prompt immediately before creating this persistent job. The scheduled instruction launches an isolated agent session every 30 minutes, directs it to execute the patrol script, and configures a Feishu delivery target. This persists beyond the original setup process and continues to consume local and external resources across sessions. Although recurring monitoring is documented as a feature, automatic installation without a dedicated persistence confirmation violates least-surprise and gives the Skill ongoing execution capability. ### Attack Path 1. A user launches `scripts/setup.sh`. 2. The user provides a valid Feishu Open ID. 3. Setup sends a test notification. 4. Without requesting separate ...[truncated 593 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/track-conversation.sh:41

Finding

Arbitrary Shell Execution Through Sourced Conversation State

Content

View full analysis

"$STATE_FILE" <> "$STATE_FILE" echo "ESCALATION_REASON=\"$ESCALATION_REASON\"" >> "$STATE_FILE" fi ``` A second execution point exists in `scripts/cleanup-conversations.sh`, line 24: ```bash source "$STATE_FILE" ``` ### Technical Analysis Conversation state is serialized as executable shell syntax and later loaded with `source`. Error content extracted from `MESSAGE` is placed into `LAST_ERROR` without shell-safe encoding. An attacker-controlled or compromised agent can include command substitution, quote characters, newlines, or other shell syntax in an error response. The text is stored in the state file. When that state file is later sourced, Bash parses it as code rather than inert data. This is a stored command-injection vulnerability. The dangerous operation is not m ...[truncated 1051 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/update-state.sh:36

Finding

Python Code Injection in State Database Updates

Content

View full analysis

/dev/null import sys sys.path.insert(0, '$HOME/.openclaw/skills/ai-mother/scripts') from db import init_db, update_agent init_db() update_agent($PID, '$AI_TYPE', '$WORKDIR', '$TASK', '$STATUS', '$NOTES') EOF fi ``` ### Technical Analysis Shell variables are interpolated directly into Python source code. Values such as `WORKDIR`, `TASK`, and `NOTES` are not encoded as Python string literals. A single quote, newline, backslash sequence, or crafted Python expression can terminate the intended string and introduce executable Python statements. `WORKDIR` is derived from a monitored process and can contain attacker-chosen filesystem characters. `TASK` may originate from the writable state file. Direct callers can also supply arbitrary arguments to `update-state.sh`. The use of parameterized SQL inside `db.py` does not mitigate this flaw because injection occurs before the database function is invoked, while Python is parsing the generated program. ### Attack Path 1. An attacker creates or uses a working directory whose path contains crafted Python syntax, or poisons a task/state value. 2. A process matching patrol's AI-process heuristic runs from that directory. 3. `patrol.sh` invokes `update-state.sh` with the process-derived path and state values. 4. The heredoc expands those values into Python source. 5. Python parses the injected syntax and executes it. 6. The payload runs with the AI Mother's user privileges. ### Impact Assessment Exploitation yields arbitrary Python and operating-system command execution as the current user. This permits reading or modifying user files, OpenClaw state, AI transcripts, projec ...[truncated 128 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/send-to-ai.sh:20

Finding

Input Injection into Arbitrary Same-User Processes

Content

View full analysis

/dev/null 2>&1; then echo "Error: Process $PID not found" exit 1 fi ``` ```bash # ─── Fallback: stdin ───────────────────────────────────────────────────────── if [ -n "$SEND_MSG" ]; then printf '%s\n' "$SEND_MSG" > "/proc/$PID/fd/0" 2>/dev/null echo "✅ Sent to PID $PID via stdin (fallback): $SEND_MSG" else printf '\n' > "/proc/$PID/fd/0" 2>/dev/null echo "✅ Sent Enter to PID $PID (fallback)" fi ``` ### Technical Analysis The function verifies only that the PID exists. It does not prove that the process is a supported AI agent, belongs to a registered session, has the expected executable, or has not been replaced through PID reuse. For processes that are not recognized as protected TUI applications, the generic fallback writes supplied text to `/proc//fd/0`. Therefore, any process accessible to the same user may become an input-injection target. If the target is a shell, REPL, debugger, database console, or another command-oriented application, injected text may be interpreted as commands. ### Attack Path 1. An attacker or unsafe caller identifies the PID of an interactive process owned by the same user. 2. The caller executes `send-to-ai.sh `. 3. The script verifies only that the PID currently exists. 4. The process does not match one of the special blocked TUI cases. 5. The fallback opens `/proc//fd/0` and writes the crafted input. 6. The target application processes that input, potentially as a command. ### Impact Assessment The immediate privilege is cross-process input control within the same operating-system account. Depending on the target application, this can lead to arbitrary command execution, project modification, unintended deployments, da ...[truncated 120 chars]

Remediation

View remediation

/fd/0` to reduce PID-reuse races. - Require explicit user confirmation for unregistered targets. - Prefer authenticated, session-specific IPC over direct `/proc` file-descriptor writes. - Refuse operation when process identity cannot be conclusively established. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/cleanup-duplicates.sh:11

Finding

Heuristic Duplicate Cleanup Can Force-Kill Unrelated Processes

Content

View full analysis

/dev/null) RECENT_FILES=$(echo "$CONTEXT" | sed -n '/^--- Recent File Changes/,/^---/p' | grep -v "^---" | wc -l) [ "$STATE" != "T" ] && SCORE=$((SCORE + 10)) SCORE=$((SCORE + RECENT_FILES * 5)) SCORE=$((SCORE + CPU)) if [ "$SCORE" -gt "$BEST_SCORE" ]; then BEST_SCORE=$SCORE BEST_PID=$PID fi done # Kill all except best for PID in "${PIDS[@]}"; do if [ "$PID" != "$BEST_PID" ]; then echo " Killing PID $PID..." kill "$PID" 2>/dev/null sleep 0.5 if ps -p "$PID" > /dev/null 2>&1; then echo " Force killing PID $PID..." kill -9 "$PID" 2>/dev/null fi fi done echo "✅ Kept PID $BEST_PID, killed others" fi ``` ### Technical Analysis Process discovery relies on loose command-line substring matching. It does not verify canonical executable paths, process ownership beyond ambient OS permissions, registered AI sessions, or process start times. In automatic mode, proce ...[truncated 1158 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/get-ai-context.sh:97

Finding

OpenCode Context Collection Can Expose Unrelated Sessions

Content

View full analysis

/dev/null | while IFS='|' read -r mid mdata; do ROLE=$(echo "$mdata" | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print(d.get('role','?'))" 2>/dev/null) # Get text parts for this message PARTS=$(sqlite3 "$DB" "SELECT data FROM part WHERE message_id='$mid' ORDER BY time_created;" 2>/dev/null) TEXT=$(echo "$PARTS" | python3 -c " import sys, json for line in sys.stdin: line = line.strip() if not line: continue try: d = json.loads(line) if d.get('type') == 'text': t = d.get('text','').strip() if t: print(t[:500]) elif d.get('type') == 'tool-invocation': name = d.get('toolInvocation',{}).get('toolName','?') state = d.get('toolInvocation',{}).get('state','?') print(f'[tool:{name} state:{state}]') elif d.get('type') == 'error': print(f'[ERROR]: {d.get(\"error\",d)[:300]}') except: pass " 2>/dev/null) [ -n "$TEXT" ] && echo "[$ROLE]: $TEXT" && echo "---" done ``` ### Technical Analysis The function claims to retrieve context for a specific PID, but the OpenCode query selects the six most recently updated messages from the entire database. It does not filter by the target process, working directory, session, project, or conversation identifier. Consequently, context requested for one process can contain messages from an ...[truncated 1072 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:12

Finding

Unpinned Runtime Package Installation

Content

View full analysis

/dev/null; then echo "⚠️ Missing dependency: rich" read -p "Install rich library? (y/n) " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then pip3 install rich --user echo "✅ rich installed" else echo "❌ rich is required for TUI dashboard. Install with: pip3 install rich" fi fi ``` ### Technical Analysis Setup installs `rich` without a pinned version or package hash. Package resolution depends on the user's pip configuration, configured indexes, mirrors, and current upstream state. Although installation requires confirmation, the user is not shown the resolved version, source index, integrity information, or dependency tree. Python package installation may execute build-system code, making package provenance security-relevant. ### Attack Path 1. `rich` is unavailable in the active Python environment. 2. Setup offers to install it. 3. The user approves. 4. pip resolves `rich` and transitive dependencies from the configured package source. 5. A compromised mirror, altered index configuration, or future compromised release supplies unsafe code. 6. Installation or later import executes that code under the user's account. ### Impact Assessment A compromised package or build dependency can execute code with the privileges of the installing user. This can affect user files, Python configuration, OpenClaw data, and monitored project repositories. The `--user` option avoids system-wide installation but does not protect the user's account. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (78)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHECKLIST.md (reported line 47)May include surrounding context.

1. Remove personal config:

   bash

   rm ~/.openclaw/skills/ai-mother/config.json
   

2. Verify .gitignore working:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHECKLIST.md (reported line 62)May include surrounding context.

md

- Run setup wizard
   - Verify patrol works

4. **Update SKILL.md metadata** if needed:
   - Version number
   - Author info
   - Repository URL

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md

- **Python 3.7+** with pip
- **OpenClaw** with Feishu channel configured
- **AI agents** (Claude Code, Codex, OpenCode)
- **tmux** (As client warpper, so openclaw can send message to it, you could run tmux new session "claude --continue")

## Installation

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send-to-ai.sh (reported line 83)May include surrounding context.

sh

- **Python 3.7+** with pip
- **OpenClaw** with Feishu channel configured
- **AI agents** (Claude Code, Codex, OpenCode)
- **tmux** (As client warpper, so openclaw can send message to it, you could run tmux new session "claude --continue")

## Installation

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 171)May include surrounding context.

md

| `check-tmux-waiting.sh <PID>` | Detect waiting/permission states in tmux |
| `analytics.py [PID]` | Performance analytics |
| `get-ai-context.sh <PID>` | Deep context for one agent |
| `send-to-ai.sh <PID> <msg>` | Send message to AI |
| `smart-diagnose.sh <PID>` | Detect abnormal patterns |
| `dashboard.sh` | Real-time TUI dashboard |
| `notify-owner.sh <msg>` | Send Feishu DM (0 tokens) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 221)May include surrounding context.

md

openclaw cron remove <job-id>

# Remove skill
rm -rf ~/.openclaw/skills/ai-mother

# Optional: Remove data
rm -f ~/.openclaw/skills/ai-mother/ai-mother.db

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 221)May include surrounding context.

md

openclaw cron remove <job-id>

# Remove skill
rm -rf ~/.openclaw/skills/ai-mother

# Optional: Remove data
rm -f ~/.openclaw/skills/ai-mother/ai-mother.db

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 224)May include surrounding context.

rm -rf ~/.openclaw/skills/ai-mother

Optional: Remove data

rm -f ~/.openclaw/skills/ai-mother/ai-mother.db rm -f ~/.openclaw/skills/ai-mother/ai-state.txt

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 225)May include surrounding context.

Optional: Remove data

rm -f ~/.openclaw/skills/ai-mother/ai-mother.db rm -f ~/.openclaw/skills/ai-mother/ai-state.txt

text

## Privacy & Security

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The permission-response trigger accepts essentially arbitrary text after 'AI Mother:' plus a PID, which makes matching ambiguous and easy to trigger unintentionally or through crafted prompts. In a skill that forwards responses to other live agents, ambiguous parsing can lead to incorrect approvals or denials being sent.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: ai-mother
description: AI Mother - Monitor and manage other AI agents (Claude Code, Codex, OpenCode, Aider, etc.). Use when asked to check AI execution status, supervise AI agents, help stuck AIs, coordinate multiple AI tasks, or act as an AI manager. Triggers on: "check AI status", "what are the AIs doing", "help the stuck AI", "manage AI agents", "AI mother", "supervise AIs", "patrol", "dashboard", "cleanup duplicates". Also triggers when owner replies to AI permission confirmations using "AI Mother: <response> <PID>" format (response can be any text: yes, no, 1, 2, allow once, etc.). When triggered,

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The documented rm ~/.openclaw/skills/ai-mother/conversations/756882.state pattern performs direct file deletion based on a command-like user input. Without strict validation and authorization, this is a tool-parameter abuse risk that can delete safety state or be generalized into unsafe file operations.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

→ Reply: "✅ Sent Yes to AI (PID 756882)"

User: "AI Mother: reset 756882" → rm ~/.openclaw/skills/ai-mother/conversations/756882.state → Reply: "✅ Reset conversation state for PID 756882"

text

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 96% confidence

Finding

The reset flow deletes conversation state for an arbitrary PID-derived file, erasing memory and audit context for that agent. This can be abused to remove evidence of prior prompts, bypass escalation limits, or disrupt safety mechanisms that depend on conversation history.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

User: "AI Mother: reset 756882" → rm ~/.openclaw/skills/ai-mother/conversations/756882.state → Reply: "✅ Reset conversation state for PID 756882"

text

**Quick dashboard (non-interactive):**

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

The documented capability to send arbitrary messages to another AI's stdin is effectively a command/instruction injection channel into a live process. In context, that can steer another agent, influence decisions, or induce it to reveal sensitive context or take unsafe actions.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

| `scripts/manage-patrol-frequency.sh` | **NEW** Dynamic patrol frequency (5min for active, 30min baseline) |
| `scripts/analytics.py [PID]` | Performance analytics and pattern detection |
| `scripts/get-ai-context.sh <PID>` | Deep context for one agent (last output, files, git) |
| `scripts/send-to-ai.sh <PID> <msg>` | Send message to AI stdin (works in ANY terminal/IDE) |
| `scripts/handle-owner-response.sh <PID> <response>` | **NEW** Flexible permission response (accepts any format) |
| `scripts/track-conversation.sh <PID> <dir> <msg>` | Track rounds, detect escalation triggers |
| `scripts/cleanup-conversations.sh` | Remove conversation logs for dead processes (>24h) |

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation lists capabilities to send messages to running AI processes and notify an external owner account, but the top-level description does not prominently disclose these behaviors. Hidden or understated cross-process interaction and outbound messaging materially increase risk because users may invoke the skill without understanding its reach.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

The dedicated 'Send Message to AI' workflow formalizes arbitrary writes to another process's stdin while preserving that process's context, making it a high-risk control channel. This is especially dangerous because it can manipulate ongoing agent sessions invisibly to the original operator.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

---

## Step 4: Send Message to AI (Preserves Context)

**Universal method — works in VSCode, IntelliJ, iTerm, any terminal:**

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill gives contradictory safety guidance about resuming stopped processes: one section says no approval is needed, while another says owner approval is required. In an autonomous supervisory skill that can act on live processes, this ambiguity can cause unauthorized process resumption and unsafe agent behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The auto-heal section states it will resume stopped processes, but the later safety guarantees state it will never do so without owner approval. This inconsistency is dangerous because operators or downstream agents may rely on the more permissive instruction and perform actions that bypass intended human oversight.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/commands.md (reported line 8)May include surrounding context.

Claude Code

bash

# One-shot task
claude --permission-mode bypassPermissions --print 'task description'

# Interactive mode
claude

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/commands.md (reported line 14)May include surrounding context.

claude

With specific model

claude --model claude-sonnet-4 'task'

text

### Codex

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/commands.md (reported line 20)May include surrounding context.

Codex

bash

# Execute task
codex exec 'task description'

# Interactive mode
codex

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/auto-heal.sh (reported line 239)May include surrounding context.

sh

echo "🔧 Issue: Permission denied error"
    echo "   Action: Check settings.local.json"
    WORKDIR=$(pwdx "$PID" 2>/dev/null | cut -d: -f2 | xargs)
    if [ -f "$WORKDIR/.claude/settings.local.json" ]; then
        echo "   Settings file exists: $WORKDIR/.claude/settings.local.json"
        echo "   ⚠️  Manual review needed - cannot auto-fix permissions"
    else

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/auto-heal.sh (reported line 240)May include surrounding context.

sh

echo "🔧 Issue: Permission denied error"
    echo "   Action: Check settings.local.json"
    WORKDIR=$(pwdx "$PID" 2>/dev/null | cut -d: -f2 | xargs)
    if [ -f "$WORKDIR/.claude/settings.local.json" ]; then
        echo "   Settings file exists: $WORKDIR/.claude/settings.local.json"
        echo "   ⚠️  Manual review needed - cannot auto-fix permissions"
    else

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script sources each .state file before deleting files, which means any attacker who can write a crafted state file into the conversations directory can achieve arbitrary shell code execution when cleanup runs. Although the rm command itself uses quoted paths, the dangerous part is trusting unvalidated state-file content and deriving deletion targets from attacker-influenced filenames in a directory under the user's home, making this much more dangerous in an agent skill context where local files may be influenced by other processes.

Content

Scanner excerpt · scripts/cleanup-conversations.sh (reported line 26)May include surrounding context.

sh

# Process dead - check age
        source "$STATE_FILE"
        if [ -n "$STARTED_AT" ] && [ "$STARTED_AT" -lt "$CUTOFF" ]; then
            rm -f "$CONV_DIR/${PID}.log" "$CONV_DIR/${PID}.state" 2>/dev/null
            CLEANED=$((CLEANED + 1))
        fi
    fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 97% confidence

Finding

The script accesses agent configuration/history directories in the user's home folder and searches Claude session files for workdir references, then prints parsed contents. This crosses normal workspace boundaries and can expose private conversation history, tool inputs, commands, and embedded secrets unrelated to the current task, making it a direct confidentiality risk if used in shared environments or exfiltrated through logs.

Content

Scanner excerpt · scripts/get-ai-context.sh (reported line 54)May include surrounding context.

sh

# Fallback: search all projects for workdir reference, sort by modification time
    if [ -z "$LATEST" ]; then
        LATEST=$(find "$HOME/.claude/projects" -name "*.jsonl" -type f 2>/dev/null \
            | xargs grep -l "$WORKDIR" 2>/dev/null \
            | xargs ls -t 2>/dev/null \
            | head -1)

Static analysis

No suspicious patterns detected.