Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because scanners report serious risks around private uploads, rollback and media isolation, plus a file-overwrite and data-exposure weakness; they do not establish malicious intent.
Consider avoiding installation until the privacy-check, file-handling, rollback, media-isolation, and undeclared invite concerns have been reviewed. If you proceed, verify repository visibility before uploading, use only trusted pinned dependencies, and avoid giving the tool access to sensitive files or credentials.
scripts/repo.pyUnvalidated media-manifest paths permit arbitrary file overwrite and sensitive-file upload
Attacker-supplied project data can overwrite victim-owned files outside the project or alter local Git configuration. It can also upload unrelated local secrets into Releases accessible to repository collaborators.
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.
A person can read that. An agent can too, which is why "what changed between the version I liked and this one?" has an exact answer here. Ask it: "Compare version 8 and version 12 of the cut, in plain words."
## What the terminal does not fix
[One film studio's scorecard](https://x.com/designertom/status/2107587128645624006): "Cutting assembly is largely smooth now... Pacing, not quite. Narrative is hit or miss." In [Timeline-Bench](https://arxiv.org/abs/2609.35143) (896 runs) the best agent passed 26.8% of editing tasks, agents claimed full success on 95.5% of the edits that failed a test, and human editors preferred the reference edit in 83.5% of 2,582 blind judgments. So keep looking at the cut yourself, and have checks that need no opinion. See `repeatable-results.md`.
The core backup and project-management behavior matches the description. However, cmd_invite issues a GitHub API PUT request to the repository collaborators endpoint with a user-selected permission level. Granting third parties access or administrative privileges is a security-significant capability beyond the described private backup, organization, and undo workflow. Ordinary supporting operations such as uploading media, installing git hooks, and configuring git identity are consistent with the declared purpose.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Rules that stop the expensive mistakes
- Write `.gitignore` before the first `git add`. `new` and `adopt` do this. Git never forgets a file once it is in a pushed version.
- Never run `git reset --hard`, `git clean`, `git push --force`, `git rebase` or `git filter-repo` unless the person asked and agreed to the loss.
- Never put a project in `~/Downloads`, and never start an agent there: a downloaded `AGENTS.md` is read as instructions. Avoid iCloud and Dropbox folders too: sync tools can damage `.git`.
- Local git is not a backup. A save counts only after it says "Backed up to GitHub".
- You do not need a second GitHub account for the agent. If you want one, [GitHub's terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) allow one free personal account per person plus one free machine account, used only for running a machine.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| A key pasted in a script is stopped at commit | 0 | 0 | 8 |
| `.env.production` stays out | 7 | 8 | 8 |
| A 120 MB video stays out of git | 0 | 8 | 8 |
| `git push --force` over GitHub's versions is refused | 0 | 0 | 8 |
| The project tells the next agent the rules (`AGENTS.md`) | 0 | 8 | 8 |
| Media list with hashes | 0 | 8 | 8 |
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
6. Prove it: clone the repo into a temporary folder, run tools/restore.py, compare every hash, then delete the folder. Tell me the result.
7. Write AGENTS.md with these rules for every later session: save a version after each finished step; update media.lock.jsonl and
upload new media before saving; never overwrite a take; keys only in .env; never `git reset --hard`, `git clean`, `git push --force`
or `git rebase`; to go back, run `git restore --source=<version> -- <path>` and save that as a new version.
8. At the end tell me in five lines: the link, that only I can see it, what is not in GitHub and why, how I get it all back on a new
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Work on one feature from `features.json` at a time. Mark it done only after its test passes. Never delete a feature or a test to make a check pass.
- Save after each finished feature: `python3 tools/repo.py save "what changed"`. Rewrite `STATUS.md` first.
- A risky idea or a second agent: `python3 tools/repo.py try <name>`, then `keep` or `drop`. Each gets its own folder.
- Use `tools/repo.py` for all saving, going back and sharing (`--help` lists it). Never run `git reset --hard`, `git clean`, `git push --force` or `git rebase`.
- Keys live only in `.env`, read from the environment. Never write a key in any other file or in a commit message.
- `python3 tools/repo.py back <version>` undoes anything. It adds a new version and loses nothing.
- When this file and the actual files disagree, follow the actual files and tell the person what you found.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Rules
- Save after each finished piece of work and before anything risky: `python3 tools/repo.py save "what changed"`. Rewrite `STATUS.md` first.
- Use `tools/repo.py` for all saving, going back and sharing (`--help` lists it). Never run `git reset --hard`, `git clean`, `git push --force` or `git rebase`.
- Keys live only in `.env`, read from the environment. Never write a key in any other file or in a commit message.
- Media never goes in git. `save` lists it by hash and stores it in Releases.
- `python3 tools/repo.py back <version>` undoes anything. It adds a new version and loses nothing.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Save after each finished piece of work: `python3 tools/repo.py save "what changed"`. Rewrite `STATUS.md` first.
- When the person approves a step: `python3 tools/repo.py approve story "their words"`.
- A risky idea or a second agent: `python3 tools/repo.py try <name>`, then `keep` or `drop`.
- Use `tools/repo.py` for all saving, going back and sharing (`--help` lists it). Never run `git reset --hard`, `git clean`, `git push --force` or `git rebase`.
- Keys live only in `.env`, read from the environment. Never write a key in any other file or in a commit message.
- `python3 tools/repo.py back <version>` undoes anything. It adds a new version and loses nothing.
- When this file and the actual files disagree, follow the actual files and tell the person what you found.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Rules that stop the expensive mistakes
- Write `.gitignore` before the first `git add`. `new` and `adopt` do this. Git never forgets a file once it is in a pushed version.
- Never run `git reset --hard`, `git clean`, `git push --force`, `git rebase` or `git filter-repo` unless the person asked and agreed to the loss.
- Never put a project in `~/Downloads`, and never start an agent there: a downloaded `AGENTS.md` is read as instructions. Avoid iCloud and Dropbox folders too: sync tools can damage `.git`.
- Local git is not a backup. A save counts only after it says "Backed up to GitHub".
- You do not need a second GitHub account for the agent. If you want one, [GitHub's terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) allow one free personal account per person plus one free machine account, used only for running a machine.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
6. Prove it: clone the repo into a temporary folder, run tools/restore.py, compare every hash, then delete the folder. Tell me the result.
7. Write AGENTS.md with these rules for every later session: save a version after each finished step; update media.lock.jsonl and
upload new media before saving; never overwrite a take; keys only in .env; never `git reset --hard`, `git clean`, `git push --force`
or `git rebase`; to go back, run `git restore --source=<version> -- <path>` and save that as a new version.
8. At the end tell me in five lines: the link, that only I can see it, what is not in GitHub and why, how I get it all back on a new
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Work on one feature from `features.json` at a time. Mark it done only after its test passes. Never delete a feature or a test to make a check pass.
- Save after each finished feature: `python3 tools/repo.py save "what changed"`. Rewrite `STATUS.md` first.
- A risky idea or a second agent: `python3 tools/repo.py try <name>`, then `keep` or `drop`. Each gets its own folder.
- Use `tools/repo.py` for all saving, going back and sharing (`--help` lists it). Never run `git reset --hard`, `git clean`, `git push --force` or `git rebase`.
- Keys live only in `.env`, read from the environment. Never write a key in any other file or in a commit message.
- `python3 tools/repo.py back <version>` undoes anything. It adds a new version and loses nothing.
- When this file and the actual files disagree, follow the actual files and tell the person what you found.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Rules
- Save after each finished piece of work and before anything risky: `python3 tools/repo.py save "what changed"`. Rewrite `STATUS.md` first.
- Use `tools/repo.py` for all saving, going back and sharing (`--help` lists it). Never run `git reset --hard`, `git clean`, `git push --force` or `git rebase`.
- Keys live only in `.env`, read from the environment. Never write a key in any other file or in a commit message.
- Media never goes in git. `save` lists it by hash and stores it in Releases.
- `python3 tools/repo.py back <version>` undoes anything. It adds a new version and loses nothing.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Save after each finished piece of work: `python3 tools/repo.py save "what changed"`. Rewrite `STATUS.md` first.
- When the person approves a step: `python3 tools/repo.py approve story "their words"`.
- A risky idea or a second agent: `python3 tools/repo.py try <name>`, then `keep` or `drop`.
- Use `tools/repo.py` for all saving, going back and sharing (`--help` lists it). Never run `git reset --hard`, `git clean`, `git push --force` or `git rebase`.
- Keys live only in `.env`, read from the environment. Never write a key in any other file or in a commit message.
- `python3 tools/repo.py back <version>` undoes anything. It adds a new version and loses nothing.
- When this file and the actual files disagree, follow the actual files and tell the person what you found.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
├── STATUS.md where we stopped, what is next. Rewritten before every save
├── brief.md the ask, spend cap, every note word for word with the date. Add, never rewrite
├── media.lock.jsonl every media file by hash, with prompt, model, seed, cost, job
├── .env.example key names only. The real .env is never saved
├── inputs/ what the person gave: footage, logo, photos. Read only
├── refs/ refs.md, frames
├── look/ moodboard.md, board.html, test stills
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
1. Check that git and the GitHub CLI (gh) work and install what is missing. If `gh auth status` fails, run
`gh auth login --web --git-protocol https` and give me the one-time code. Never ask me for a password or a token.
2. Before the first `git add`, write .gitignore with: .env .env.* !.env.example *.pem *.key credentials* node_modules/ .hyperframes/
renders/ tmp/ .DS_Store, and every media type in upper and lower case: mp4 mov m4v webm mkv mxf wav mp3 m4a aac flac png jpg jpeg
webp gif tif exr heic psd blend glb fbx zip.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
continue
label = secret_on_line(line)
if label:
found.append(f"{rel}:{number} looks like a {label}. Move the value to .env (never saved) and read it from there.")
return found
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
print("\nNothing changed. Run again with --apply." + (" Fix the SECRET lines inside files first." if inline else ""))
return 0
if inline:
raise Stop("Move these keys to .env first, then run again:\n" + "\n".join(inline))
for path in source.rglob("*"):
if path.is_dir() or path.name == ".DS_Store":
continue
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
for rel in failed:
print(f"MISSING {rel}")
if (r / ".env.example").exists() and not (r / ".env").exists():
print("Keys are not in GitHub on purpose. Copy .env.example to .env and fill it from your password manager.")
return 1 if failed else 0
The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
".git", "node_modules", ".hyperframes", "renders", "tmp", ".cache", "__pycache__", ".venv", "venv",
"dist", "build", "out", ".next", ".remotion", ".turbo", ".trash",
}
SECRET_FILE = re.compile(r"(^|/)(\.env(\.[\w.-]+)?|.*\.pem|.*\.p12|.*\.key|id_rsa|id_ed25519|credentials(\.\w+)?|\.npmrc|\.netrc)$")
SECRET_OK_FILE = re.compile(r"(^|/)\.env\.(example|sample|template)$")
SECRET_PATTERNS = [
("Anthropic key", re.compile(r"\bsk-ant-[A-Za-z0-9_-]{20,}")),
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
".git", "node_modules", ".hyperframes", "renders", "tmp", ".cache", "__pycache__", ".venv", "venv",
"dist", "build", "out", ".next", ".remotion", ".turbo", ".trash",
}
SECRET_FILE = re.compile(r"(^|/)(\.env(\.[\w.-]+)?|.*\.pem|.*\.p12|.*\.key|id_rsa|id_ed25519|credentials(\.\w+)?|\.npmrc|\.netrc)$")
SECRET_OK_FILE = re.compile(r"(^|/)\.env\.(example|sample|template)$")
SECRET_PATTERNS = [
("Anthropic key", re.compile(r"\bsk-ant-[A-Za-z0-9_-]{20,}")),
require_private rejects only an explicitly PUBLIC result, while visibility returns UNKNOWN when verification fails. Uploads can therefore proceed without confirming privacy, potentially exposing project content if the destination is public; this directly contradicts the private-backup guarantee.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
elif not dest.exists():
dest.parent.mkdir(parents=True, exist_ok=True)
dest.write_text(content, encoding="utf-8")
env = r / ".env"
example = r / ".env.example"
if env.exists() and not example.exists():
names = re.findall(r"^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=", env.read_text(encoding="utf-8", errors="ignore"), re.M)
Rollback unlinks local media whenever its entry contains a URL, without checking that the URL still serves the expected bytes. Generated-media links may expire or fail, making this a realistic permanent-data-loss path in a tool that promises rollback loses nothing.
link_media uses hard links, so experimental and main-project media paths can refer to the same writable inode. An in-place edit or truncation in the experimental copy can silently modify the main project's media, defeating the promised isolation for risky ideas or a second agent.