workbuddy-multi-device-sync

• Outcome: Review
• Latest audit: Aug 1, 2026 · 6:51 AM UTC
• Version: 0.1.0

Overview

This skill is meant to sync WorkBuddy across Macs, but it asks users to run persistent background sync code, store GitHub tokens in plaintext, and execute remote setup scripts with too little containment.

Review before installing. Use a fine-grained repo-only token, avoid plaintext ~/.git-credentials if possible, do not run the curl | bash setup blindly, inspect the generated setup script first, and disable or remove the daemon/profile hooks if you do not want continuous background sync of WorkBuddy identity, memory, skills, and settings.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill clearly instructs users to run shell commands that write files, modify shell startup profiles, store credentials, and start background processes, yet it declares no permissions. This mismatch hides the true execution and file-modification scope of the skill and reduces a user's ability to make an informed trust decision.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Piping a remotely fetched script directly into bash gives the remote content immediate arbitrary code execution on the local machine with no review step. Because the script is retrieved from a mutable network location and authenticated with a token, compromise of the repo, token, or delivery path could lead to full takeover of the user's WorkBuddy environment or broader user account context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly tells the user to bypass the sandbox using `osascript` or `dangerouslyDisableSandbox` to launch a daemon. Encouraging sandbox escape for a convenience feature expands execution privileges beyond what is necessary for configuration sync and creates a path for persistent uncontrolled code execution.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script modifies the user's shell profile to install persistent aliases and auto-executed hooks, then starts a background daemon automatically. In a setup skill, persistence materially increases risk because future terminal sessions will execute repository-sourced scripts (`start-sync-daemon.sh`, `auto-sync.sh`) without renewed consent, expanding the blast radius if the synced repo is compromised or tampered with.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: The script writes GitHub credentials to `$HOME/.git-credentials` and enables `git config --global credential.helper store`, affecting all future Git operations for the user, not just WorkBuddy. This broadens exposure of the token and can cause unintended credential reuse or leakage through other repositories and tools on the machine.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The one-click setup executes unreviewed remote code and modifies local configuration, credentials, and startup behavior without an explicit warning or review checkpoint. Even if intended for convenience, omitting a strong warning materially increases the chance that users will execute unsafe code they do not understand.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The document explicitly instructs users to write a GitHub access token into `~/.git-credentials` in URL form, which stores the secret in plaintext on disk and may also expose it through backups, local compromise, shell history, or accidental disclosure. In a multi-device sync skill that manages identity, memory, skills, and settings, compromise of that token can grant access to the sync repository and all sensitive synced agent data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script silently performs `git pull`, stages all changes, creates commits, and pushes to the remote every five minutes without any user-facing confirmation or review. In the context of syncing `~/.workbuddy` identity, memory, skills, and settings across devices, this can propagate sensitive or unintended local changes to other machines and to the remote repository, reducing the user's ability to detect mistakes, secrets exposure, or malicious modifications.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script stores the GitHub token in plaintext in `$HOME/.git-credentials` and gives no warning that the secret will persist on disk. Even with `chmod 600`, plaintext secrets are accessible to the user account, backups, endpoint tooling, and any malware or malicious local process running as that user.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: `git reset --hard origin/main` forcibly discards local tracked changes with no confirmation. In this context, the script operates on `~/.workbuddy`, which may contain identity, memory, skills, and settings, so silent destructive overwrite can irreversibly remove user data or local customizations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script launches an infinite-loop background daemon via nohup that survives terminal closure and runs every 5 minutes without any user-facing prompt, notice, or explicit opt-in at execution time. In a skill that syncs identity, memory, skills, and settings across devices, undisclosed persistence materially increases risk because it creates continuous autonomous execution that could repeatedly process or transmit sensitive configuration data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Python branch uses start_new_session=True to fully detach a long-running loop and writes a PID file, again without visible disclosure to the user. This is a true persistence mechanism, and in the context of multi-device sync it can continuously invoke auto-sync.sh in the background, making any future misconfiguration, token leakage, or script modification repeatedly actionable without user awareness.

Credential Access

High

• Category: Privilege Escalation

Content

- **Project workspace memory** (`<project>/.workbuddy/memory/`) is NOT inside
  `~/.workbuddy/` and must be synced separately (via the project's own Git repo
  or cloud storage).
- **Token security**: The GitHub token is stored in `~/.git-credentials` (chmod 600).
  For shared machines, consider using a token with limited scope and expiration.
- **Daemon recovery**: After a machine reboot, the daemon restarts automatically
  when the user opens a terminal (via the `.bash_profile` hook) or when WorkBuddy

• Confidence: 97% confidence
• Finding: ~/.git-credentials

Credential Access

High

• Category: Privilege Escalation

Content

**Approach B: Manual setup**

1. User creates a private repo at https://github.com/new (name: `wb-sync`, private, no README)
2. User creates a Personal Access Token at https://github.com/settings/tokens/new (scope: `repo`)
3. Store credentials as shown above

#### Step 4: Push to GitHub

• Confidence: 89% confidence
• Finding: Access Token

Credential Access

High

• Category: Privilege Escalation

Content

fi

# Store GitHub credentials (HTTPS passwordless)
echo "https://${GITHUB_USERNAME}:${GITHUB_TOKEN}@github.com" > "$HOME/.git-credentials"
chmod 600 "$HOME/.git-credentials"
git config --global credential.helper store
echo ">> GitHub credentials stored"

• Confidence: 99% confidence
• Finding: /.git-credentials

Credential Access

High

• Category: Privilege Escalation

Content

# Store GitHub credentials (HTTPS passwordless)
echo "https://${GITHUB_USERNAME}:${GITHUB_TOKEN}@github.com" > "$HOME/.git-credentials"
chmod 600 "$HOME/.git-credentials"
git config --global credential.helper store
echo ">> GitHub credentials stored"

• Confidence: 95% confidence
• Finding: /.git-credentials

Session Persistence

Medium

• Category: Rogue Agent

Content

## Important Notes

- **GitHub SSH port 22 may be blocked** in China. Use HTTPS + token instead.
- **LaunchAgent** (`launchctl load`) often fails with "Input/output error" on macOS 12+
  under sandbox. The Python subprocess daemon approach in `start-sync-daemon.sh`
  is more reliable.
- **Automations** (scheduled tasks) are stored in `workbuddy.db` and do NOT sync.

• Confidence: 90% confidence
• Finding: launchctl load

Session Persistence

Medium

• Category: Rogue Agent

Content

PROFILE="$HOME/.zshrc"
fi

# Write aliases + auto-sync hook (skip if already present)
if grep -q "wbsync" "$PROFILE" 2>/dev/null; then
  echo ">> Aliases already present, skipping"
else

• Confidence: 95% confidence
• Finding: Write aliases + auto-sync hook (skip if already present) if grep -q "wbsync" "$PROFILE" 2>/dev/null; then echo ">> Aliases already present, skipping" else cat >> "$PROFILE" << 'PROFILE_EOF' # Wor

Session Persistence

Medium

• Category: Rogue Agent

Content

if [ -z "$PYTHON" ]; then
  # No Python available, use pure bash background mode
  nohup /bin/bash -c "
    while true; do
      /bin/bash '$WB_DIR/auto-sync.sh' 2>/dev/null
      sleep 300

• Confidence: 89% confidence
• Finding: nohup

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git remote remove icloud 2>/dev/null || true
  git remote add origin "$GITHUB_REPO"
  git fetch origin
  git reset --hard origin/main
else
  echo ">> Initializing git and pulling from GitHub..."
  git init

• Confidence: 97% confidence
• Finding: git reset --hard

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.