Project Context Sync

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:57 AM UTC
• Version: 1.0.0

Overview

This skill does what it advertises, but it installs persistent Git automation and can repeatedly send repository metadata into an AI workflow that writes future agent context without enough safeguards.

Review this before installing on private or shared repositories. Disable ai_summary unless you are comfortable sending commit metadata to the configured Clawdbot gateway, and inspect the generated PROJECT_STATE.md before letting an agent rely on it. Also check existing post-commit hooks before installing or uninstalling because the scripts modify that shared hook file automatically.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: scripts/update-context.sh:142

Finding

Untrusted Git Metadata Can Poison Persistent Agent Context

Content

View full analysis

/dev/null; then CONFIG_PORT=$(jq -r '.gateway.port // empty' "$CLAWDBOT_CONFIG" 2>/dev/null) CONFIG_TOKEN=$(jq -r '.gateway.auth.token // empty' "$CLAWDBOT_CONFIG" 2>/dev/null) fi # Use config values or fall back to env/defaults GATEWAY_PORT="${CONFIG_PORT:-${CLAWDBOT_GATEWAY_PORT:-19000}}" GATEWAY_TOKEN="${CONFIG_TOKEN:-${CLAWDBOT_TOKEN:-}}" GATEWAY_URL="http://localhost:$GATEWAY_PORT" if [ -n "$GATEWAY_TOKEN" ]; then # Escape the prompt for JSON ESCAPED_PROMPT=$(echo "$PROMPT" | jq -Rs .) # Call gateway's OpenAI-compatible endpoint RESULT=$(curl -s -X POST "$GATEWAY_URL/v1/chat/completions" \ -H "Authorization: Bearer $GATEWAY_TOKEN" \ -H "Content-Type: ap ...[truncated 3255 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/uninstall.sh:15

Finding

Uninstaller Can Delete Unrelated Post-Commit Hook Logic

Content

View full analysis

Remediation

View remediation

"/exact/path/scripts/update-context.sh" "/exact/repository/path" # END project-context-sync: ``` 2. During uninstall, remove only the content between the matching start and end markers. 3. Before deleting an entire hook, compare its complete normalized contents or checksum against the exact Skill-owned template. 4. Create a backup of the hook before every modification. 5. Write changes to a temporary file and atomically replace the hook only after successful validation. 6. Preserve the original executable mode and shebang. 7. If markers are missing or malformed, stop and request manual review instead of applying broad pattern deletion. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises an optional AI summary mode but does not clearly warn that repository metadata and recent commit history may be sent to a local HTTP API service for summarization. Even if the endpoint is localhost, that service may forward data to an external model or persist sensitive project context, creating an unacknowledged confidentiality risk for users enabling the feature.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

This will:
1. Install a post-commit hook in `.git/hooks/`
2. Create `.project-context.yml` with default config
3. Create initial `PROJECT_STATE.md`
4. Add `PROJECT_STATE.md` to `.gitignore`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly describes sending repository-derived context to a local OpenAI-compatible HTTP endpoint in AI summary mode, but the warning is understated and framed as low risk. Even when bound to loopback, this still transmits commit messages, branch names, file-change context, and possibly sensitive project metadata to a service over HTTP, which users may not realize from the installation and configuration guidance. The post-commit automation makes this more dangerous because disclosure can happen repeatedly without a deliberate per-use review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This installer immediately modifies the current repository by writing a post-commit hook, creating config/state files, and editing .gitignore without any interactive confirmation, dry-run mode, or explicit opt-in for each change. In a skill-install context, silently altering git hooks is especially sensitive because hooks execute automatically on future developer actions and can introduce persistent behavior the user may not fully notice or review.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The curl request transmits repository context to an HTTP endpoint using a bearer token, creating a real data egress path. Although it targets localhost by default, the effective port and token come from user config/environment, and the local gateway may proxy data externally; repository metadata can contain sensitive internal information.

Content

Scanner excerpt · scripts/update-context.sh (reported line 201)May include surrounding context.

sh

ESCAPED_PROMPT=$(echo "$PROMPT" | jq -Rs .)
        
        # Call gateway's OpenAI-compatible endpoint
        RESULT=$(curl -s -X POST "$GATEWAY_URL/v1/chat/completions" \
            -H "Authorization: Bearer $GATEWAY_TOKEN" \
            -H "Content-Type: application/json" \
            -H "x-clawdbot-agent-id: main" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

In AI mode, the script sends repository-derived metadata including commit messages, author, branch, filenames, and recent history to a gateway service without explicit runtime notice or consent. Even if the default target is localhost, that gateway may forward data onward, and the script provides no clear warning that potentially sensitive repository context is being transmitted.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The heading comment at L139 says the function 'calls gateway API for smart summaries', which implies a narrow network action. In practice, the function also accesses local user-scoped configuration at $HOME/.clawdbot/clawdbot.json and falls back to environment variables to obtain credentials and connection details before contacting the gateway.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.