Sync Claude Context - ensure agent files are up to date

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent project-context sync purpose, but it can directly change persistent Claude instructions, project skills, and memory with broad activation and limited user approval.

Review this skill carefully before installing. It is not showing deception or exfiltration, but it is designed to edit files that future Claude sessions may trust. Use it only in repositories you trust, review git diffs after every run, and prefer asking it to propose changes before it writes CLAUDE.md, .claude/rules, .claude/skills, or memory files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:51

Finding

Repository-Controlled Content Can Be Propagated into Persistent Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-73; sub-skills/init/SKILL.md:7-20
Vulnerability Type: Persistent agent instruction poisoning
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:51-73:

markdown

**If no `CLAUDE.md` exists**: invoke the `init` skill at `sub-skills/init/SKILL.md`, then continue.

**If CLAUDE.md exists**, read it and cross-check each section against the sources from Phase 1:

**Commands** — compare against the actual command source. Fix changed commands, add useful new ones, remove deleted ones.

**Architecture/structure** — compare described modules and key files against what exists on disk. Add new additions; remove deleted or renamed things.

**Configuration/env vars** — compare against actual config files. Add new runtime-relevant settings; remove or correct stale ones.

**Constraints and gotchas** — check whether any documented constraints have been resolved by recent work.

**Env template**: verify it lists all vars the config requires. Missing vars here break fresh setups.

**`@import` references**: scan for `@path/to/file` lines and verify each imported file still exists. A missing import silently breaks context loading.

**Size**: if the file exceeds 200 lines, flag it — beyond that, adherence degrades and context cost rises. Suggest moving detail into `.claude/rules/` topic files.

**`.claude/rules/`**: if this directory exists, check whether any path-scoped rule files reference commands, module names, or file paths that no longer match the current codebase. Fix or flag stale ones.

**`CLAUDE.local.md`**: if this exists, give it the same pass as CLAUDE.md — it's the gitignored personal supplement and can go stale too.

Be surgical: update what's stale, leave accurate content alone. It's read by a future Claude session.

sub-skills/init/SKILL.md:7-20:

markdown

Please analyze this codebase and create a CLAUDE.md file, which will be given to 
...[truncated 4240 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat README files, editor rules, Copilot instructions, existing Agent rules, and other repository content as untrusted data rather than authoritative behavioral instructions.
2. Restrict generated content to independently verifiable technical facts, such as commands present in package configuration, concrete file paths, and architecture derived from source code.
3. Explicitly reject source text that attempts to modify Agent safety policy, expand permissions, access credentials, contact external endpoints, or mandate execution of unverified commands.
4. Generate a proposed patch and show the complete diff before modifying CLAUDE.md, CLAUDE.local.md, .claude/rules/, or project skills.
5. Require explicit user approval before applying any persistent Agent-instruction change.
6. Record the provenance of each imported fact so reviewers can identify which repository file supplied it.
7. Avoid copying prose verbatim from untrusted instruction files. Normalize validated facts into a constrained schema or predefined template.
8. Warn the user when conflicting instructions are found rather than automatically selecting or merging them.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:109

Finding

Existing Persistent Agent Memory Is Consolidated Without Explicit Approval or Content Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:109-120
Vulnerability Type: Persistent Agent memory poisoning
Risk Level: Medium

Vulnerable Code Snippet

markdown

**If memory exists**: invoke `consolidate-memory`.

**If none exists**: ask before creating anything —
> "No project memory exists yet. Auto-memory is already on, so Claude will build it up over time — but want me to seed it now with key facts from this codebase so your next session starts oriented right away?"

If yes: seed with non-obvious facts a future session would otherwise waste time re-deriving:
- Surprising constraints (concurrency models, version pins, unexpected defaults)
- Current in-progress work and why
- Non-obvious decisions baked into the code

Create `MEMORY.md` as a concise one-line-per-entry index. Detailed notes go in separate topic files (e.g. `architecture.md`, `constraints.md`) — `MEMORY.md` stays under 200 lines so it fits in the session context window.

Technical Analysis

The Skill requires user consent before creating memory when none exists, but it automatically invokes consolidate-memory when persistent project memory already exists. No equivalent approval requirement is imposed for modifying existing memory.

The instructions also permit repository-derived facts, constraints, current work, and architectural decisions to be written into persistent memory. There is no validation rule that separates descriptive technical facts from imperative instructions, detects malicious prompt content, verifies provenance, or prevents secrets from being persisted.

Consolidation may increase the persistence and authority of poisoned content by summarizing it into MEMORY.md or topic files that future Agent sessions consume. A malicious statement presented as a project constraint or decision could consequently survive beyond the session in which its source was first encountered.

Attack Path

1. An attacker plac ...[truncated 1553 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before every persistent-memory write, including consolidation of existing memory.
2. Present the exact proposed additions, modifications, and deletions before invoking the memory-writing operation.
3. Restrict memory entries to concise, independently verified project facts.
4. Reject imperative instructions, permission changes, credential-handling directives, external URLs requiring execution, and attempts to override Agent safety requirements.
5. Track source provenance for each memory entry and mark facts derived from repository-controlled prose as untrusted until confirmed.
6. Prevent credentials, tokens, private keys, personal data, and environment-variable values from being written to memory.
7. Provide a rollback mechanism or versioned diff for all memory changes.
8. Ask the user to resolve contradictory or suspicious entries rather than automatically consolidating them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

The skill directs the agent to inspect and potentially modify files under the agent config area, including '.claude/rules/'. Access to agent control files is more sensitive than ordinary project docs because changing them can alter future agent behavior, permissions assumptions, or instruction loading. In this skill's context, that danger is elevated because it explicitly tells the agent to 'fix' stale rule files, not merely report them.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

**`@import` references**: scan for `@path/to/file` lines and verify each imported file still exists. A missing import silently breaks context loading.

**Size**: if the file exceeds 200 lines, flag it — beyond that, adherence degrades and context cost rises. Suggest moving detail into `.claude/rules/` topic files.

**`.claude/rules/`**: if this directory exists, check whether any path-scoped rule files reference commands, module names, or file paths that no longer match the current codebase. Fix or flag stale ones.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises activation on broad phrases like 'sync', 'catch up', 'update project docs', and 'bring yourself up to speed', which are common conversational requests and can cause the skill to run when the user did not intend a deep repository/context audit. Because this skill reads git history, inspects project files, enumerates skills, and may modify Claude project context files, over-broad triggering increases the chance of unintended sensitive context access and unreviewed workspace changes.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

ls CLAUDE.md .claude/CLAUDE.md CLAUDE.local.md .claude/rules/ 2>/dev/null

text

**If no `CLAUDE.md` exists**: invoke the `init` skill at `sub-skills/init/SKILL.md`, then continue.

**If CLAUDE.md exists**, read it and cross-check each section against the sources from Phase 1:

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

Phase 3 — Audit project skills

bash

ls .claude/skills/ 2>/dev/null

Read each skill. Two categories:

Static analysis

No suspicious patterns detected.