Wdp Ctx En

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.1.2

Overview

This skill is mostly a disclosed project-context memory tool, but its documented fallback and project naming rules can expose or mix notes from unrelated projects.

Review before installing. Prefer project-local installation and project-local storage, avoid using init in empty directories until cross-project fallback is removed, and do not rely on basename-only project separation for sensitive work. Review any generated profile rules before keeping or exporting them to AGENTS.md, and inspect the optional hook before enabling it in Claude settings.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:223

Finding

Cross-Project Context Disclosure Through Automatic Snapshot Fallback

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: hooks/wdp-hook.sh:11

Finding

Project Basename Collisions Can Mix Context Between Unrelated Projects

Content

View full analysis

/dev/null 2>&1; then root="$r" break fi done ``` The storage model in `SKILL.md` states: ```markdown // ├── profile.md ├── .md └── latest.md ``` It further claims: ```markdown Use the project-level one first (check with bash which exists); create it if none exists. Per-project subdirectories are keyed by project slug; filenames carry timestamps, so multiple projects never mix. ``` ### Technical Analysis The hook derives the project identity only from `basename "$PWD"`. A basename is not globally unique. For example, both `/work/client-a/app` and `/work/client-b/app` resolve to the slug `app`. When user-level storage is used, both projects can therefore resolve to the same directory: ```text ~/.claude/wdp/summaries/app/ ``` Timestamped snapshot filenames prevent some direct filename collisions, but they do not prevent profile, snapshot history, or `latest.md` pointer mixing. The affected commands may subsequently read, export, update, list, or delete documents under the wrong project's namespace. The hook itself emits only a fixed reminder, but it demonstrates the documented slug-resolution strategy and can incorrectly detect another same-named project's snapshots as belonging to the current project. ### Attack Path 1. A legitimate project exists at `/work/client-a/app ...[truncated 1370 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:236

Finding

Repository-Controlled Rules Can Be Persisted as Authoritative Agent Memory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · README.md (reported line 86)May include surrounding context.

Plugin install (automatic): installing wdp-ai-skills as a plugin auto-registers hooks via hooks/hooks.json declared in .claude-plugin/plugin.json (defaults to the Chinese script skills/wdp-ctx/hooks/wdp-hook.sh; for English reminders, use the plain-skill install below).

Plain-skill install (manual): copy hooks/wdp-hook.sh to ~/.claude/skills/wdp-ctx-en/hooks/, then add four entries to the hooks block of ~/.claude/settings.json (or project .claude/settings.local.json):

jsonc

{

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.

Plugin install (automatic): installing wdp-ai-skills as a plugin auto-registers hooks via hooks/hooks.json declared in .claude-plugin/plugin.json (defaults to the Chinese script skills/wdp-ctx/hooks/wdp-hook.sh; for English reminders, use the plain-skill install below).

Plain-skill install (manual): copy hooks/wdp-hook.sh to ~/.claude/skills/wdp-ctx-en/hooks/, then add four entries to the hooks block of ~/.claude/settings.json (or project .claude/settings.local.json):

jsonc

{

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The init flow instructs the agent to fall back to another project's latest snapshot when the target project directory is empty, then summarize that data into the current session. This can disclose sensitive architecture notes, work state, decisions, or operational details from an unrelated project without an explicit user request or authorization boundary.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The exception-handling section repeats the same cross-project fallback behavior, normalizing disclosure of another project's stored context as a recovery path. Because snapshots are meant to preserve rich project memory, exposing them across projects can leak proprietary plans, file paths, operational details, and other sensitive internal information.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

Copy skills/wdp-ctx-en into ~/.claude/skills/:

bash

mkdir -p ~/.claude/skills
cp -r skills/wdp-ctx-en ~/.claude/skills/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The README promotes user-level installation under ~/.claude/skills and describes cross-session persistence for all projects, which increases blast radius if the skill or its optional hooks are later modified maliciously or behave unexpectedly. Because the skill stores project context and can be active across sessions, persistence at the user scope makes mistakes or compromise more durable and broadly applicable.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

Copy skills/wdp-ctx-en into ~/.claude/skills/:

bash

mkdir -p ~/.claude/skills
cp -r skills/wdp-ctx-en ~/.claude/skills/

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

md

- User-level: `~/.claude/wdp/summaries/`
- Resolution: project-level first, user-level fallback.

> **v1.1 change**: the storage root moved out of the skill install dir (`.claude/skills/wdp-ctx-en/summaries/`) into the project's own `.claude/wdp/` — **reinstalling the skill no longer wipes data**. Skill code (`skills/`) and data (`.claude/wdp/`) are fully separated.

## Commit policy (git)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description and heading state this is an "English variant" and the command name itself is /wdp-ctx-en, which imposes a language/locale constraint in the skill's natural-language interface. The file does not present this as an optional user choice within the skill or justify it as a region-specific requirement.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

## Storage root (shared with wdp-ctx)

**Data is separate from skill code**: skills install into `.claude/skills/`, data lives in the project-owned `.claude/wdp/` directory, so reinstalling/upgrading the skill never touches any snapshot.

1. Project-level: `<project path>/.claude/wdp/summaries/`
2. User-level: `~/.claude/wdp/summaries/`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md

# wdp session hooks (SessionStart / PreCompact)
# Usage: bash wdp-hook.sh <load|load-after-clear|load-after-compact|save-precompact>
# Behavior: emits a systemMessage reminder only when the current project already has wdp snapshots; otherwise exits silently (exit 0).
# Reminders only prompt, never auto-execute; there is no before-/clear hook (the CLI offers none), so the fallback is a reminder in the new session after the clear.
set -u

event="${1:-}"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · hooks/wdp-hook.sh (reported line 5)May include surrounding context.

sh

# wdp session hooks (SessionStart / PreCompact)
# Usage: bash wdp-hook.sh <load|load-after-clear|load-after-compact|save-precompact>
# Behavior: emits a systemMessage reminder only when the current project already has wdp snapshots; otherwise exits silently (exit 0).
# Reminders only prompt, never auto-execute; there is no before-/clear hook (the CLI offers none), so the fallback is a reminder in the new session after the clear.
set -u

event="${1:-}"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The text states that this is the English variant and that Chinese users should install a different skill. This imposes a language-specific constraint without presenting user choice or documenting a compliance-based justification in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The comments and emitted system messages repeatedly direct the user to use /wdp-ctx-en and present all guidance in English, which indicates a fixed language/locale assumption. The file does not offer user opt-in for language selection or explain why English is required, so this is a natural-language policy concern under the locale/language rule.

Content

No source excerpt is available for this finding.