workbuddy-multi-machine-sync

• Outcome: Review
• Latest audit: Aug 1, 2026 · 6:52 AM UTC
• Version: 0.1.0

Overview

This sync skill has a coherent purpose, but it asks users to run and persist high-impact automation that can store credentials, overwrite local config, and run automatically.

Review before installing. Prefer a local, inspected setup script instead of curl-to-bash; avoid storing GitHub tokens in ~/.git-credentials; back up ~/.workbuddy completely before running setup; and only enable the daemon/profile hook if you are comfortable with automatic remote sync and remote conflict outcomes affecting your WorkBuddy configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill performs privileged actions such as writing files under ~/.workbuddy and instructing users to run shell commands, yet it declares no permissions or safety boundaries. This creates a trust gap: users and platforms may underestimate the skill's capabilities, making potentially risky filesystem and shell behavior less visible and less reviewable.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior understates and misrepresents what the skill does, including persistent daemon management, broader Git configuration changes, and features claimed but not actually implemented. Security-relevant behavior mismatches are dangerous because users may consent to a simple sync helper while actually installing background persistence and global environment changes they did not expect.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The setup flow tells users to fetch a script from a remote URL and execute it immediately, which hands code execution to whatever content is served at that location at runtime. If the repository, account, token, network path, or referenced script is compromised, an attacker can run arbitrary commands on the user's machine with the user's privileges.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Piping curl output directly into bash removes the opportunity for review and normalizes unsafe execution of untrusted remote code. In the context of a sync/setup skill that already modifies dotfiles and launches background daemons, this pattern significantly increases the chance of full host compromise through social engineering or supply-chain tampering.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The migration section instructs users to append to ~/.bash_profile and to kill a process using a PID file without clearly warning about persistence and process-management side effects. While these are common admin actions, they can unexpectedly alter a user's shell environment or terminate the wrong process if the PID file is stale, incorrect, or attacker-controlled, which is risky in a skill meant to be followed verbatim.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script performs unattended `git pull`/`push` operations every 5 minutes with output suppressed and automatically resolves some conflicts by preferring the remote version (`git checkout --theirs .`). This can overwrite local state, accept unexpected remote changes, and hide synchronization failures or tampering from the user, which is risky for configuration files that may influence agent behavior.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script writes a GitHub token directly into ~/.git-credentials and enables Git's plaintext credential helper. This stores reusable credentials on disk in a broadly discoverable location, increasing the chance of token theft by local malware, backups, other user processes, or accidental disclosure. In a multi-machine sync setup, embedding secrets into a setup template is especially risky because users may reuse or distribute the script.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The script performs git reset --hard against the remote branch without an explicit confirmation step. That operation irreversibly discards local tracked changes in ~/.workbuddy, which can cause silent data loss if the user has unsynced edits or if the remote is misconfigured or maliciously controlled. Because this skill manages personal config/state, destructive sync behavior is more dangerous than in a disposable checkout.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script appends commands to the user's shell profile so that WorkBuddy sync scripts run automatically on terminal startup. This creates persistence and automatic execution of code pulled from the synced repository, which could be abused if the remote content is compromised or if auto-sync scripts are modified unexpectedly. The lack of explicit warning or opt-in makes the behavior materially riskier.

Credential Access

High

• Category: Privilege Escalation

Content

# === Step 4: Store credentials (GitHub only) ===
if [ "$REMOTE_NAME" = "origin" ] && [ -n "$GITHUB_TOKEN" ]; then
  echo "https://${GITHUB_USERNAME}:${GITHUB_TOKEN}@github.com" > "$HOME/.git-credentials"
  chmod 600 "$HOME/.git-credentials"
  git config --global credential.helper store
  echo ">> GitHub credentials stored"

• Confidence: 99% confidence
• Finding: /.git-credentials

Credential Access

High

• Category: Privilege Escalation

Content

# === Step 4: Store credentials (GitHub only) ===
if [ "$REMOTE_NAME" = "origin" ] && [ -n "$GITHUB_TOKEN" ]; then
  echo "https://${GITHUB_USERNAME}:${GITHUB_TOKEN}@github.com" > "$HOME/.git-credentials"
  chmod 600 "$HOME/.git-credentials"
  git config --global credential.helper store
  echo ">> GitHub credentials stored"
fi

• Confidence: 90% confidence
• Finding: /.git-credentials

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

git remote remove icloud 2>/dev/null || true
  git remote add "$REMOTE_NAME" "$REMOTE_URL"
  git fetch "$REMOTE_NAME"
  git reset --hard "$REMOTE_NAME/$BRANCH"
else
  echo ">> Initializing git and pulling from remote..."
  git init

• Confidence: 96% confidence
• Finding: git reset --hard

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.