Security audit

God's eye view of your dev repos. Multi-project tracking across GitHub/Azure DevOps. AI learns from your commits to upgrade your agents.md.

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent project-dashboard purpose, but it reads and stores repository and agent-instruction content with weak scoping and hardening.

Install only after reviewing the code and using it on repositories you trust. Keep ~/.god-mode private, avoid custom analysis.agentFiles entries with absolute paths or .. components, do not automatically send generated prompts to an LLM with write-capable tools, and prefer a non-persistent PATH setup unless you trust the cloned scripts directory.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: scripts/commands/agents.sh:129
Finding: Indirect Prompt Injection Through Repository-Controlled Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/db.sh:23
Finding: SQL Injection Through Raw SQLite String Interpolation
Content: View full analysis
/dev/null || echo "[]" } # Run a query that doesn't return data db_exec() { local sql="$1" sqlite3 "$DB_PATH" "$sql" } ``` Multiple unescaped values are then interpolated into those strings: ```bash db_upsert_commits() { local project_id="$1" local commits commits=$(cat) echo "$commits" | jq -c '.[]' | while read -r commit; do local sha=$(echo "$commit" | jq -r '.sha') local author=$(echo "$commit" | jq -r '.author // .commit.author.name') local message=$(echo "$commit" | jq -r '.message // .commit.message' | head -1 | sed "s/'/''/g") local timestamp=$(echo "$commit" | jq -r '.date // .commit.author.date') if [[ "$timestamp" =~ ^[0-9]{4}- ]]; then timestamp=$(date -d "$timestamp" +%s 2>/dev/null || echo "0") fi db_exec "INSERT OR REPLACE INTO commits (sha, project_id, author, message, timestamp) VALUES ('$sha', '$project_id', '$author', '$message', $timestamp);" done } ``` PR and issue records contain additional raw fields: ```bash db_exec "INSERT OR REPLACE INTO pull_requests (id, project_id, number, title, state, author, created_at, updated_at, labels) VALUES ('${PROJECT_ID}:pr:${PR_NUM}', '$PROJECT_ID', $PR_NUM, '$PR_TITLE', '$PR_STATE', '$PR_AUTHOR', '$PR_CREATED', '$PR_UPDATED', '$PR_LABELS');" db_exec "INSERT OR REPLACE INTO issues (id, project_id, number, ...[truncated 2719 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/lib/analysis/agents.sh:28
Finding: Repository-Boundary Bypass in Configurable Agent-File Discovery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/config.sh:195
Finding: Unsafe yq Expression Construction From Project Metadata
Content: View full analysis
&2 echo "Install with: brew install yq (macOS) or apt install yq (Debian/Ubuntu)" >&2 return 1 fi local existing existing=$(config_get_project "$id") if [[ -n "$existing" && "$existing" != "null" ]]; then echo "Project already exists: $id" >&2 return 1 fi local new_project="{\"id\": \"$id\"" [[ -n "$name" ]] && new_project="$new_project, \"name\": \"$name\"" new_project="$new_project, \"priority\": \"$priority\"}" yq -i ".projects += [$new_project]" "$GOD_MODE_CONFIG" echo "Added project: $id" } ``` Removal has the same issue: ```bash config_remove_project() { local search="$1" if ! _has_yq; then echo "Error: yq is required to modify config" >&2 return 1 fi local project project=$(config_get_project "$search") if [[ -z "$project" || "$project" == "null" ]]; then echo "Project not found: $search" >&2 return 1 fi local id id=$(echo "$project" | jq -r '.id') yq -i "del(.projects[] | select(.id == \"$id\"))" "$GOD_MODE_CONFIG" echo "Removed project: $id" } ``` ### Technical Analysis Project IDs, names, and priorities are embedded into a manually constructed JSON fragment, which is then embedded in a `yq` expression. The values are not encoded with a JSON serializer and are not passed to `yq` as isolated variables. Quotes, backslashes, braces, or expression syntax in a value can break out of the intended string context. This permits malformed expressions and m ...[truncated 1203 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/db.sh:4
Finding: Plaintext Sensitive Cache Created Without Explicit Permission Hardening
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 71)May include surrounding context.
Testing

Unit tests for all new functions

Run npm test before commits

text
## Installation ### Prerequisites - `gh` - [GitHub CLI](https://cli.github.com/) (authenticated) - `sqlite3` - Usually pre-installed - `jq` - `brew install jq` or `apt install jq` ### Install ```bash # Clone git clone https://github.com/InfantLab/god-mode-skill cd god-mode-skill # Add to PATH echo 'export PATH="$PATH:'$(pwd)'/scripts"' >> ~/.bashrc source ~/.bashrc # Setup god setup

Or for OpenClaw:

bash
openclaw skills add god-mode

Quick Start

bash
# 1. Add your first project god projects add github:yourname/yourrepo # 2. Sync data god sync # 3. See the overview god status # 4. Analyze your agents.md god agents analyze yourrepo

Commands

Command Description
god status Overview of all projects
god status <project> Details for one project
god sync Fetch latest data

Command	Description
`god status`	Overview of all projects
`god status <project>`	Details for one project
`god sync`	Fetch latest data

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill includes a first-run setup workflow that creates directories, initializes config/database state, checks dependencies/authentication, and may add repositories and trigger syncs, but the top-level description does not emphasize this bootstrap and mutation role. Users expecting passive oversight may unknowingly authorize filesystem changes and external sync activity, which raises both integrity and privacy concerns.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill includes a first-run setup workflow that creates directories, initializes config/database state, checks dependencies/authentication, and may add repositories and trigger syncs, but the top-level description does not emphasize this bootstrap and mutation role. Users expecting passive oversight may unknowingly authorize filesystem changes and external sync activity, which raises both integrity and privacy concerns.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill includes a first-run setup workflow that creates directories, initializes config/database state, checks dependencies/authentication, and may add repositories and trigger syncs, but the top-level description does not emphasize this bootstrap and mutation role. Users expecting passive oversight may unknowingly authorize filesystem changes and external sync activity, which raises both integrity and privacy concerns.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill includes a first-run setup workflow that creates directories, initializes config/database state, checks dependencies/authentication, and may add repositories and trigger syncs, but the top-level description does not emphasize this bootstrap and mutation role. Users expecting passive oversight may unknowingly authorize filesystem changes and external sync activity, which raises both integrity and privacy concerns.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill includes a first-run setup workflow that creates directories, initializes config/database state, checks dependencies/authentication, and may add repositories and trigger syncs, but the top-level description does not emphasize this bootstrap and mutation role. Users expecting passive oversight may unknowingly authorize filesystem changes and external sync activity, which raises both integrity and privacy concerns.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 46)May include surrounding context.
md
Testing (not mentioned) But 31% of your commits touch tests → Add: "Write tests for new code" 📝 SUGGESTED ADDITIONS

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 138)May include surrounding context.
md
4. **Suggests improvements** based on your patterns Example insights: - "You write lots of tests but don't mention testing in agents.md" - "40% of commits are error-handling fixes - add error handling guidance" - "Your 'use TypeScript strict' instruction is working - 0 type errors"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises commands that sync data from GitHub and other providers, which implies network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens user visibility and policy enforcement around outbound access, increasing the chance that an agent invokes network-capable behavior without clear authorization boundaries.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 76% confidence
Finding: The skill stores project data and analyses locally in ~/.god-mode, including commits, PRs, issues, and saved contexts, which creates persistent retention of potentially sensitive repository metadata. While persistence is part of the advertised design, it still expands the exposure window if the local machine is shared, compromised, or subject to over-collection beyond what users expect.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
## Overview **god-mode** gives you a bird's-eye view of all your coding projects and coaches you to write better AI agent instructions. **Key features:** - Multi-project status dashboard

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script assembles repository metadata, full agent instruction content, commit summaries, and recent commit messages into a prompt and prints it for downstream LLM handling. That can expose sensitive internal codebase context, secrets accidentally present in agents.md or commit messages, and private repository identifiers to an external model or logs without any consent, warning, redaction, or policy gate.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The usage/help text frames the command as only listing and managing configured projects. In practice, adding a project also initializes and upserts into the database, and removing a project can delete commits, pull requests, issues, sync state, analyses, and project rows, which is materially broader than the documented behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file header and help text describe this script as god status that shows an overview or project details, but the script calls show_project_detail/show_overview at L67-L70 before those functions are defined later in the file. In bash scripts, this means the documented behavior is contradicted by the actual execution flow, which will fail rather than provide status output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code stores full agent file contents in the database, not just a hash or metadata, which can persist sensitive instructions, secrets, internal URLs, or prompt-injection content longer than necessary. In the god-mode context, which aggregates cross-repo project status and agent guidance, central retention increases blast radius if the database is later queried by broader tooling or exposed to unauthorized users.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/setup.sh (reported line 80)May include surrounding context.
sh
echo "" # Step 2: Create directories echo -e "${BOLD}Setting up directories...${RESET}" echo ""

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The install instructions append a new PATH entry to ~/.bashrc and immediately source it, which creates a persistent shell-environment change without warning the user. While common in setup guides, persistent profile modification can unexpectedly affect later sessions, command resolution, and troubleshooting, especially if users do not realize a repo-local scripts directory has been permanently trusted.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script first initializes the database and immediately dispatches to a status view at L56-L71, then repeats a second 'Run the appropriate view' dispatch at L305-L315. This contradicts the implied intent of a single status command execution and indicates the code structure does not match the documented command behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code calls the GitHub API to retrieve repository file contents and then returns the decoded content, but there is no confirmation prompt or user-facing disclosure at the point of network access. Because the operation transmits repository identifiers to an external service and reads remote content, it fits the code-file warning criterion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The function reads the discovered local agent file with cat and packages its full contents into JSON, but there is no confirmation prompt, print/log message, or explicit warning near this data-access behavior. Reading and surfacing local instruction files may affect user privacy expectations, so the behavior should be disclosed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This code file performs data access and analysis over commit messages and later author metadata, which may contain sensitive project or personal information. Although the file has developer-facing comments about its purpose, it lacks any user-facing prompt, log, or warning indicating that repository history content will be queried and processed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The code initializes and writes to a SQLite database at a user-home path, creating directories and a database file if needed. Although the file contains developer comments and one echo during initialization, there is no consistent user disclosure for ongoing write operations such as inserts and updates performed throughout this library.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: At L60, the comment says Azure and GitLab are "Stubbed, not fully implemented," and provider_supported returns failure for them. But provider_call at L38-L47 actively dispatches Azure and GitLab function names as if those providers are available. This creates an intent/documentation contradiction about which providers the interface actually supports.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Quick Start

Commands

Tp4

Tp4

Tp4

Tp4

Tp4

Session Persistence

Session Persistence

Undeclared Tool Scope

Session Persistence

Missing User Warnings

Intent-Code Divergence

Intent-Code Divergence

Missing User Warnings

Session Persistence

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Static analysis