Data Moat Plugin

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 2.0.9

Overview

This skill is purpose-aligned for installing DataMoat, but it downloads and runs software that immediately starts background capture of sensitive AI records with weak install verification and limited consent controls.

Review carefully before installing. Only use this if you are comfortable with a remotely downloaded DataMoat app immediately scanning and encrypting local AI conversation records in the background before desktop setup is complete. Prefer an installer that pins or signs releases, fails closed on missing checksums, and asks you to explicitly choose data sources before capture starts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install-datamoat-linux.sh:33

Finding

Unpinned Linux Repository Code Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

/dev/null 2>&1 || true else git clone --depth 1 "$REPO_URL" "$SRC_DIR" >/dev/null 2>&1 || gentle_site_exit fi cd "$SRC_DIR" || gentle_site_exit echo "Installing DataMoat and starting background protection (no screen needed)..." if ! bash install.sh --remote-no-screen; then gentle_site_exit fi ``` ### Technical Analysis The installer clones or updates the current default branch of a remote GitHub repository and immediately executes its `install.sh`. The repository is not pinned to an immutable commit or release tag, and the downloaded source is not authenticated with a checksum or cryptographic signature. As a result, the effective code executed by this Skill can change after the Skill itself has been reviewed. The local source directory also remains mutable between executions. A compromised upstream repository, maintainer account, or release process could replace `install.sh` with arbitrary commands. This behavior also conflicts with the documentation in `SKILL.md`, which states that installers obtain releases from an official manifest and verify SHA-256 checksums. The Linux installer does neither. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its default branch. 2. The attacker modifies `install.sh` or another component invoked by it. 3. A user follows the Skill instructions and runs `scripts/install-datamoat-linux.sh`. 4. The script clones the compromised repository or performs `git pull -- ...[truncated 1057 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install-datamoat-macos.sh:45

Finding

macOS and Windows Installers Permit Native Code Execution When the Manifest Omits a Checksum

Content

View full analysis

/dev/null)" || MANIFEST="" if [ -z "$MANIFEST" ]; then gentle_site_exit fi VERSION="$(printf '%s\n' "$MANIFEST" | grep -o '"version":[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"version":[[:space:]]*"//; s/"$//')" BLOCK="$(printf '%s\n' "$MANIFEST" | awk -v key="\"$BLOCK_KEY\": {" 'index($0, key){f=1} f{print; if (!/\{/ && /\}/) exit}')" DMG_URL="$(printf '%s\n' "$BLOCK" | grep -o '"url":[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"url":[[:space:]]*"//; s/"$//')" DMG_SHA="$(printf '%s\n' "$BLOCK" | grep -o '"sha256":[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"sha256":[[:space:]]*"//; s/"$//')" FALLBACK_URL="$(printf '%s\n' "$BLOCK" | grep -o '"githubFallbackUrl":[[:space:]]*"[^"]*"' | head -1 | sed 's/.*"githubFallbackUrl":[[:space:]]*"//; s/"$//')" ``` ```bash if [ -n "$DMG_SHA" ]; then ACTUAL_SHA="$(shasum -a 256 "$DMG_PATH" | awk '{print $1}')" if [ "$ACTUAL_SHA" != "$DMG_SHA" ]; then if [ -n "$FALLBACK_URL" ] && curl -fL --max-time 600 "$FALLBACK_URL" -o "$DMG_PATH" 2>/dev/null; then ACTUAL_SHA="$(shasum -a 256 "$DMG_PATH" | awk '{print $1}')" fi [ "$ACTUAL_SHA" = "$DMG_SHA" ] || gentle_site_exit fi echo "Download verified (SHA-256 match)." fi ``` ```bash rm -rf "$DEST_APP" ditto "$APP_SOURCE" "$DEST_APP" || gentle_site_exit APP_EXEC="${DEST_APP}/Contents/MacOS/DataMoat" [ -x "$APP_EXEC" ] || gentle_site_exit echo "Starting background protection (no screen needed)..." nohup "$APP_EXEC" --datamoat-remote-no-screen >"$LAUNCH_LOG" 2>&1 & ``` Windows: ```powershell $manifest = Invoke-RestMethod -Uri $ManifestUrl -TimeoutSec 30 $artifact ...[truncated 3785 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:54

Finding

Sensitive AI Records Are Captured Automatically Before Interactive Consent and Security Setup

Content

View full analysis

"$LAUNCH_LOG" 2>&1 & BOOTSTRAP_FILE="${HOME}/.datamoat/state/bootstrap-capture.json" HEALTH_FILE="${HOME}/.datamoat/state/health.json" for _ in $(seq 1 60); do if [ -f "$BOOTSTRAP_FILE" ] && [ -f "$HEALTH_FILE" ] \ && grep -q '"bootstrapCapture":[[:space:] ...[truncated 3357 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This second mismatch finding highlights undeclared network and filesystem behaviors: the skill fetches software from remote servers, installs an application, executes binaries, and starts background protection rather than directly performing the stated user task. In security-sensitive agent environments, hidden install-and-run behavior materially increases the chance of unauthorized persistence or overbroad data access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This second mismatch finding highlights undeclared network and filesystem behaviors: the skill fetches software from remote servers, installs an application, executes binaries, and starts background protection rather than directly performing the stated user task. In security-sensitive agent environments, hidden install-and-run behavior materially increases the chance of unauthorized persistence or overbroad data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill states that installation starts pre-setup protection/capture immediately, even before desktop setup is finished, but this is not surfaced as an upfront warning in the primary description. That is dangerous because users may authorize what appears to be a normal installer without understanding that background monitoring begins immediately and may collect local conversation records before full informed consent.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

bash scripts/datamoat-status.sh

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

bash scripts/install-datamoat-macos.sh

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The installer invokes install.sh --remote-no-screen, and later confirms that it is already watching local ChatGPT, Claude, Codex, Cursor, DeepSeek, Qwen, and OpenClaw conversation records in the background. Enabling surveillance-like collection of local conversation artifacts before explicit disclosure and consent creates a serious privacy risk, especially because these records may contain credentials, proprietary data, or sensitive personal information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The installer copies an application into ~/Applications and then starts its executable unattended with '--datamoat-remote-no-screen', creating active background behavior without an interactive approval step. In the context of a skill advertised for backing up and analyzing local AI data, silently deploying and executing a resident process is more dangerous because users are primed to expect passive local tooling rather than a persistent agent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script launches DataMoat with a '--datamoat-remote-no-screen' argument and waits for state files indicating background capture/protection is active. Starting hidden or unattended monitoring/collection behavior is highly sensitive, especially because the skill description does not justify covert background execution or pre-setup capture of user conversation records.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes shell commands for status checks, installation, and launching the app, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a trust and review gap: an agent may execute system-modifying commands without the user or platform having a clear, machine-readable declaration of shell/network/install capabilities.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

Never complete password, authenticator, recovery phrase, recovery code,
Touch ID, or any unlock step inside a chat, SSH transcript, screenshot, or
remote relay. The agent may install the app and start pre-setup capture; the
human finishes password and recovery setup locally in the desktop GUI. Never
ask the user to paste DataMoat passwords, TOTP secrets, recovery phrases, or
recovery codes into chat.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The example requests are broad enough to match generic backup requests, which could cause the skill to activate in situations beyond DataMoat-managed AI data. In context, that is risky because activation can lead to installation and background capture behavior, so ambiguous triggering expands the chance of unexpected system changes or collection of unintended local data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script clones and updates code from a remote GitHub repository and immediately executes its install script with --remote-no-screen, which starts background protection without any interactive consent step. This is dangerous because it combines remote code installation and execution with activation of persistent monitoring, giving users no meaningful chance to review what will run or what local data will be watched first.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The unconditional 'rm -rf' of an existing ~/Applications/DataMoat.app removes any prior installation without warning, backup, or version check. This can destroy a working or trusted installation, erase locally modified app state bundled inside the app package, and makes rollback or user review impossible.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script does not merely install a local backup or analysis utility; it immediately launches the app in a hidden/background 'no-screen' mode and waits for state files indicating active protection. That behavior establishes unattended ongoing collection/encryption activity on the host, which materially exceeds the narrow expectation of a backup/analysis skill and reduces user awareness and consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

Using 'nohup ... &' detaches the process from the terminal and leaves it running after the installer exits, creating stealthy persistence-like behavior even if not registered as a formal startup item. In a data-management skill, detached background execution is especially risky because it enables continued monitoring or processing outside the user's immediate visibility.

Content

Scanner excerpt · scripts/install-datamoat-macos.sh (reported line 98)May include surrounding context.

sh

[ -x "$APP_EXEC" ] || gentle_site_exit

echo "Starting background protection (no screen needed)..."
nohup "$APP_EXEC" --datamoat-remote-no-screen >"$LAUNCH_LOG" 2>&1 &

BOOTSTRAP_FILE="${HOME}/.datamoat/state/bootstrap-capture.json"
HEALTH_FILE="${HOME}/.datamoat/state/health.json"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The introductory comments describe 'pre-setup no-screen protection,' framing the behavior as protective while the script actually installs software and attempts to silently enable background activity. This kind of misleading framing increases social-engineering risk because users may not realize they are consenting to installation and immediate monitoring-related behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The installer retrieves a remote manifest and binary, then proceeds to install and run software as part of a chat-delivered skill workflow. Although it verifies SHA-256 when provided, trust is anchored to the same remote manifest service, and the behavior exceeds the stated local backup/analysis/reuse purpose by introducing software installation and autonomous execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script starts background protection and checks for bootstrap/health indicators without any explicit confirmation gate from the user at the moment monitoring begins. Automatically enabling processing of local conversation records or related user data without informed opt-in creates privacy and consent risks, even if the software is intended for backup or security use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.