T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:24- Finding
Mutable Remote Instructions Can Control Agent Command Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Wip Ldm Os Private
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a real LDM OS installer, but it makes broad persistent changes to agent, shell, credential, and system tooling behavior that require careful review before installation.
Install only if you want LDM OS to manage multiple AI harnesses at a deep system level. Before running `ldm init` or `ldm install`, review the dry run, check whether you have `~/.openclaw/secrets/op-sa-token`, and be aware that installation can persistently change Claude hooks, MCP configuration, shell startup behavior, crontab entries, and local agent message/context handling.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
bin/ldm.js:466- Finding
Routine Installation Registers Persistent Agent Context-Injection and Autonomous Rewake Hooks
- Content
View full analysis
Array.isArray(group.hooks) && group.hooks.some(h => h.type === 'command' && h.command === hookCommand) ); if (!alreadyWired) { settings.hooks.UserPromptSubmit.push({ hooks: [{ type: 'command', command: hookCommand, timeout: 5, }], }); writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n'); changed = true; } } catch { // Settings file malformed or unreadable. } return changed; } ``` Autonomous rewake registration: ```js if (!alreadyWired) { settings.hooks.Sto ...[truncated 3492 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
bin/ldm.js:2080- Finding
Installer Exposes a 1Password Service-Account Token to All Future Shell Descendants
- Content
View full analysis
existsSync(p)); if (!targetPath) targetPath = isZsh ? candidates[1] : candidates[0]; let existing = ''; try { if (existsSync(targetPath)) existing = readFileSync(targetPath, 'utf-8'); } catch {} if (existing.includes(marker)) return false; if (DRY_RUN) { console.log(` [dry run] Would append OP_SERVICE_ACCOUNT_TOKEN export to ${targetPath.replace(HOME, '~')}`); return false; } try { appendFileSync(targetPath, block); const displayPath = targetPath.replace(HOME, '~'); console.log(` + Shell profile updated: appended OP_SERVICE_ACCOUNT_TOKEN export to ${displayPath}`); console.log(` Open a new terminal or run: source ${displayPath}`); return true; } catch (err) { console.log(` - Could not update ${targetPath.replace(HOME, '~')}: ${err.message}`); return false; } } ``` Routine installation invokes the behavior: ```js // Ensure 1Password SA token is exported in shell profile so Claude Code // sessions, MCPs, hooks, cron jobs all inherit it and can op read sec ...[truncated 2362 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
bin/ldm.js:1258- Finding
Initialization Installs a Recurring Task That Force-Kills Unrelated npm Processes
- Content
View full analysis
/dev/null', { encoding: 'utf8' }); if (!crontab.includes('process-monitor')) { execSync(`(crontab -l 2>/dev/null; echo "*/3 * * * * ${monitorDest}") | crontab -`); console.log(` + process monitor installed (every 3 min, kills zombie processes)`); } } catch { try { execSync(`echo "*/3 * * * * ${monitorDest}" | crontab -`); console.log(` + process monitor installed (every 3 min)`); } catch {} } } ``` Overbroad task payload: ```bash #!/bin/bash # LDM OS Process Monitor # Kills zombie npm/ldm processes, cleans stale locks. # Run via healthcheck (every 3 min) or standalone cron. LOG="/tmp/ldm-process-monitor.log" KILLED=0 log() { echo "[$(date '+%H:%M:%S')] $1" >> "$LOG"; } # 1. Kill npm view/list processes older than 30s for pid in $(ps -eo pid,etime,args | grep -E "npm (view|list)" | grep -v grep | awk '{ split($2, t, /[:-]/); if (length(t) >= 3) secs = t[1]*3600 + t[2]*60 + t[3]; else if (length(t) == 2) secs = t[1]*60 + t[2]; else secs = t[1]; if (secs > 30) print $1 }'); do kill -9 "$pid" 2>/dev/null && KILLED=$((KILLED + 1)) done ``` ### Technical Analysis `ldm init` adds a user crontab entry that executes every three minutes and persists after initialization. The payload searches all processes visible to the user for command lines containing `npm view` ...[truncated 1897 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
bin/ldm.js:1233- Finding
Initialization Changes the Global Git Hooks Path for Every Repository
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2427)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Lines L047-L056 describe querying ~/Library/Messages/chat.db to ingest conversation contents. Accessing private user communications is not an obvious or necessary capability for installing, updating, or checking status of LDM OS, making it context-inappropriate for the declared skill purpose.
- Content
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code appends an
OP_SERVICE_ACCOUNT_TOKENexport block to shell startup files so future shells, hooks, MCP servers, cron jobs, and launch agents inherit access to secrets. Persistently wiring a secrets-bearing environment variable into the user's login shell is a powerful credential-propagation capability that is not justified by a manifest limited to LDM OS install/update/status.- Content
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The registerSkillTools path turns discovered OpenClaw skills into callable MCP tools and executes their scripts via executeSkillScript. A skill whose stated purpose is installing or updating LDM OS does not obviously require broad arbitrary script execution across unrelated skills.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md Manifest-driven `ldm install` no longer appends a duplicate SessionStart boot-hook entry to `~/.claude/settings.json`. The boot hook now has a single registrar. `lib/deploy.mjs` `installClaudeCodeHookEvent()` matched existing hook entries by an extension-dir tag (`/<toolName>/` in the command). The boot hook's deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains no `/wip-ldm-os/` segment, so the ownership check never recognized the existing entry and appended a fresh one on every manifest-driven install. This was the mechanism behind the ongoing accumulation (10 entries found 2026-07-04, then re-growing 3 -> 4 -> 5 through the day as installs ran); PR #1086 fixed only the `src/boot/installer.mjs` registration path, not this one.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.destructive_delete_command, suspicious.env_credential_access (+3 more)
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/ldm.js:224
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib/bootstrap.mjs:18
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib/deploy.mjs:116
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib/state.mjs:92
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- lib/updates.mjs:131
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/test-installer-target-self-update.mjs:22
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/test-ldm-status-concurrency.mjs:59
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/test-ldm-status-timeout.mjs:19
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/bridge/core.ts:153
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/bridge/mcp-server.ts:520
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- ai/product/bugs/xai-grok/2026-04-10--cc-mini--finish-deprecating-old-xai-grok-repo.md:26
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- ai/product/plans-prds/current/2026-03-17--install-everything-enable-disable.md:249
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- bin/ldm.js:32
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/bridge/core.ts:40
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/hosted-mcp/server.mjs:42
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- ai/product/plans-prds/codex-remote-control/2026-04-28--cc-mini--codex-remote-control-live-test-runbook.md:155
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- bin/ldm.js:5180
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- src/bridge/core.ts:152
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- src/hosted-mcp/server.mjs:172
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- ai/research/2026-04-03--cc-mini--claude-md-organization-research.md:285