Byterover 2.0.0

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:20 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed project-memory tool, but it tells agents to run external LLM-backed commands before broadly any work and to persist new memory after implementation without a clear user consent boundary.

Review this before installing in sensitive repositories. Use it only when you intentionally want project memory queried or updated, avoid sending secrets or regulated data to LLM providers, inspect proposed `.brv/context-tree/` entries before relying on them, and prefer a pinned or otherwise verified CLI installation over the documented global latest install.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Mandatory Skill Workflow Hijacks Unrelated Agent Tasks

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:8

Finding

Mandatory Curation Can Poison Persistent Agent Memory

Content

View full analysis

Remediation

View remediation

other

Error

• Location: SKILL.md:143

Finding

Project Context and File Contents May Be Disclosed to an External LLM Provider

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill explicitly guides users to connect third-party model providers, including supplying API keys on the command line. This creates security risk because it normalizes secret handling in shell history/process arguments and enables project context handled by brv to be routed to external providers with different data retention and governance properties.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

bash

brv providers list
brv providers connect openai --api-key sk-xxx --model gpt-4.1

4. Cloud Sync (Optional)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 98% confidence

Finding

The skill states that brv query and brv curate send user-supplied text and included file contents to a configured LLM provider, and that cloud sync commands send knowledge to ByteRover's cloud service. In a knowledge-management skill that encourages frequent use, these are direct exfiltration pathways for local project data, making the context materially more dangerous than a purely local tool.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

**File access**: The `-f` flag on `brv curate` reads files from the current project directory only. Paths outside the project root are rejected. Maximum 5 files per command, text and document formats only.

**LLM usage**: `brv query` and `brv curate` send context to a configured LLM provider for processing. The LLM sees the query or curate text and any included file contents. No data is sent to ByteRover servers unless you explicitly run `brv push`.

**Cloud sync**: `brv push` and `brv pull` require authentication (`brv login`) and send knowledge to ByteRover's cloud service. All other commands operate without ByteRover authentication.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs agents to use ByteRover "before any work," creating an unconditional pre-action dependency that can cause unnecessary disclosure of project context to an external LLM provider. Because brv query may transmit queries and local knowledge to a configured provider, this broad trigger expands exposure well beyond user-authorized or task-necessary use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are overly broad, including ordinary situations like recalling something or checking for rules "before performing any action." In this skill's context, that broadness is dangerous because it encourages routine transmission of prompts and stored context to an external model provider, potentially leaking internal policies, source details, or sensitive operational context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.