workbuddy-icloud-sync

• Outcome: Review
• Latest audit: Aug 1, 2026 · 6:52 AM UTC
• Version: 0.1.0

Overview

The skill is for a real iCloud sync use case, but it enables persistent automatic syncing and shell startup execution with some overbroad setup actions.

Review the scripts before installing. Only use this if you are comfortable with WorkBuddy identity, memory, skills, and settings being continuously synced through iCloud and with shell startup files launching WorkBuddy sync code. Back up ~/.workbuddy first, avoid running the one-click installer on important local state, and consider removing the terminal hook or daemon if you want manual-only sync.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs users to run shell commands that modify files, initialize Git repositories, install scripts, and start a background daemon, yet it declares no permissions. That mismatch prevents informed consent and weakens security review because users are not clearly told that the skill performs persistent shell and file-write actions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script appends aliases and an auto-sync hook to the user's shell profile, causing code in ~/.workbuddy to run on every terminal startup. Because ~/.workbuddy is later populated from an iCloud-backed Git repository, this creates persistence and repeatedly executes repository-controlled scripts beyond the one-time setup the user likely expects.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script changes global Git identity settings for the entire user account, affecting all Git repositories on the machine rather than just ~/.workbuddy. This is unnecessary for local iCloud-based sync setup and can create unintended side effects or overwrite a user's existing Git configuration.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script fetches from the iCloud-backed bare repository and then forcefully resets or checks out ~/.workbuddy to the remote branch, discarding local changes. Since the remote repository contents are treated as trusted and may include executable scripts later run by the profile hook, this can both destroy local state and replace it with attacker-controlled content if the iCloud repo is compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The terminal hook causes every new shell session to potentially start or revive a daemon and trigger background Git activity, but the guidance does not present this as persistent behavior with operational and security consequences. Users may unknowingly enable repeated execution, networked sync, and repository changes simply by opening a terminal.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The script is explicitly designed to run unattended every 5 minutes and silently performs git pull, commit, and push operations against a remote repository. Even though the remote is iCloud-backed and the skill is about synchronization, this still causes automatic network/data transmission and local repository modification without user confirmation, making accidental sync of sensitive WorkBuddy contents or unwanted merges more likely.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script silently modifies the user's global git configuration, setting user.name, user.email, and init.defaultBranch for all repositories on the system. This is dangerous because it changes behavior outside the skill's scope, can overwrite a user's intended identity defaults, and does so without notice or consent.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The shell profile is modified to automatically run start-sync-daemon.sh and auto-sync.sh whenever a terminal opens, but the script does not require explicit consent at the moment it makes this persistent change. This is dangerous because it turns repository-sourced scripts into automatically executed login/session code, increasing the blast radius of any compromise of ~/.workbuddy.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script starts a background daemon immediately after setup, creating persistent behavior that continues after the one-time install flow. Although the script mentions automatic background sync later in its output, it does not obtain explicit consent before launching a long-running subprocess sourced from ~/.workbuddy content that was just pulled from iCloud.

Session Persistence

Medium

• Category: Rogue Agent

Content

- **LaunchAgent** (`launchctl load`) often fails with "Input/output error" on
  macOS 12+ under sandbox. The Python subprocess daemon approach is more reliable.
- **Automations** (scheduled tasks) are stored in `workbuddy.db` and do NOT sync.
  Recreate them on each machine using the `automation_update` tool.
- **Project workspace memory** (`<project>/.workbuddy/memory/`) is NOT inside
  `~/.workbuddy/` and must be synced separately.
- **Daemon recovery**: After reboot, the daemon restarts when the user opens

• Confidence: 88% confidence
• Finding: create them on each machine using the `automation_update` tool. - **Project workspace memory** (`<project>/.workbuddy/memory/`) is NOT inside `~/.workbuddy/` and must be synced separately. - **Daemo

Session Persistence

Medium

• Category: Rogue Agent

Content

PROFILE="$HOME/.zshrc"
fi

# Write aliases + auto-sync hook (skip if already present)
if grep -q "wbsync" "$PROFILE" 2>/dev/null; then
  echo ">> Aliases already present, skipping"
else

• Confidence: 97% confidence
• Finding: Write aliases + auto-sync hook (skip if already present) if grep -q "wbsync" "$PROFILE" 2>/dev/null; then echo ">> Aliases already present, skipping" else cat >> "$PROFILE" << 'PROFILE_EOF' # Wor

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git remote remove icloud 2>/dev/null
  git remote add icloud "$ICLOUD_DIR/WorkBuddy-sync.git"
  git fetch icloud
  git reset --hard icloud/main
else
  git init
  git remote add icloud "$ICLOUD_DIR/WorkBuddy-sync.git"

• Confidence: 91% confidence
• Finding: git reset --hard

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git remote remove origin 2>/dev/null || true
  git remote add "$REMOTE_NAME" "$BARE_REPO"
  git fetch "$REMOTE_NAME"
  git reset --hard "$REMOTE_NAME/$BRANCH"
else
  echo ">> Initializing git and pulling from iCloud..."
  git init

• Confidence: 99% confidence
• Finding: git reset --hard

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.