Little7 BC/DR

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI06: Memory and Context Poisoning

What this means

Backups may contain private agent memory, identity files, and operational context that should be protected and restored carefully.

Why it was flagged

The skill intentionally persists agent identity and memory material into backup archives. This is purpose-aligned, but restored memory or identity files can carry sensitive or stale context forward.

Skill content

The intent is to preserve:
- core identity files
- curated memory
- learnings
- local scripts
- local skills

Recommendation

Review archive contents, store backups only in a trusted location, and verify memory/identity files before restoring them into a live workspace.

Note

ASI03: Identity and Privilege Abuse

What this means

If you provide a secrets allowlist, credential or key files may be copied into a backup archive under the destination folder.

Why it was flagged

The skill can include arbitrary user-selected secret paths in a separate archive when this environment variable is provided. This is explicit and opt-in, but it can include high-impact credentials if configured.

Skill content

`LITTLE7_SECRET_PATHS_FILE` — newline-delimited absolute paths to include in the separate secrets archive

Recommendation

Only include secret paths you truly intend to back up, protect the destination folder, and keep secret archives separate with strict access controls.

Note

ASI02: Tool Misuse and Exploitation

What this means

Running the script will create or overwrite backup files and prune older Little7 backup archives in the selected destination.

Why it was flagged

The script uses local file tools to create archives, overwrite latest backup copies, and delete old matching archives during retention pruning. These actions are central to the backup purpose and are scoped to the configured backup directories.

Skill content

( cd "$STAGE_STATE" && tar czf "$STATE_OUT" . )
cp -f "$STATE_OUT" "$LATEST_STATE"
...
rm -f "${files[$i]}"

Recommendation

Check LITTLE7_GDRIVE_BASE before running, and verify that the destination folder is the intended backup location.