deja-search

• Outcome: Review
• Latest audit: Sep 7, 2026 · 4:41 PM UTC
• Version: 0.18.1

Overview

This skill does what it says, but it gives an agent broad access to past AI coding-session history with loose triggers and limited user control.

Install only if you are comfortable letting the agent search prior AI coding-session history across tools on this machine. Prefer using project, time, role, and limit filters, avoid full transcript retrieval unless needed, and confirm any durable memory before storing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:16
• Finding: Broad Access to Sensitive Cross-Tool AI Session History## Vulnerability Details **File Location**: `SKILL.md`, lines 16-28 **Vulnerability Type**: Sensitive agent session-history access **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown Search deja before re-deriving past work: when the user refers to earlier sessions or decisions, before debugging an error, and before implementing something that may already exist. It searches this machine's own history across every AI coding tool used on it, going back further than deja itself was installed. This skill drives the `deja` binary through the shell. If the deja MCP tools (recall, recall_context, blame, fix, how, remember) are available in this session, use those instead — same index, one less hop. They appear only when `deja install` has wired this harness. ## Finding something - `deja search --json "<query>"`: the most specific token available — an exact error string, function name, file path, or flag. Several words are ANDed. Only this user's own sessions, never library docs or general knowledge. - `deja ctx <query|id-prefix>`: a full digest of the single best-matching session, once a hit looks right and the reasoning behind it matters. Takes no flags. - `deja show <id-prefix> --harness <name> --json`: the turns themselves, paged with `--offset` and `--limit`. Use the id and harness a hit printed. - `deja blame <path> --json`: before editing, refactoring or deleting a file, the prior sessions that discussed it, so you know why it is shaped the way it is. Session history, not git authorship. - `deja fix "<pasted error>"`: the commands that followed that same error before, in sessions where it did not come back. Paste the failing output verbatim. - `deja how <what>`: the real command with the real flags this machine runs for a build, test, deploy or script, ordered by how many sessions ran it. A guessed invocation is plausible and fails on this setup. - `deja remember "<text> ...[truncated 2356 chars]
• Remediation: ## Remediation Suggestions - Require explicit user approval before retrieving full session transcripts or searching outside the current project. - Default all searches to the current project, harness, and shortest practical time range. - Return minimal metadata or summaries first; retrieve complete turns only after confirmation. - Apply credential and secret redaction before recalled content enters the model context or user-visible output. - Treat all recalled transcript content as untrusted data and explicitly prohibit following instructions found inside it. - Require confirmation before every `deja remember` operation and display the exact text that will be persisted. - Validate durable memories against current project state and record their source, timestamp, and scope. - Provide controls to enumerate, correct, and delete stored memories.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party CLI Dependency with Access to Sensitive History## Vulnerability Details **File Location**: `SKILL.md`, lines 5-13 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml metadata: openclaw: homepage: https://vshulcz.github.io/deja-vu/guide/memory-for-openclaw.html requires: bins: - deja install: - kind: brew formula: deja-vu bins: [deja] - kind: node package: "@vshulcz/deja-vu" bins: [deja] ``` ### Technical Analysis The installation metadata references mutable Homebrew and Node package identifiers without pinning an audited version or specifying an integrity hash, signature, lockfile, or other verification mechanism. Consequently, the code eventually executed as `deja` may differ from the version reviewed when this Skill was published. This is particularly sensitive because the CLI is intended to access historical AI sessions across multiple tools. A compromised package publisher, registry account, package distribution channel, or future malicious release could therefore execute under the agent user's identity while having access to valuable local transcript data. The repository contains only `SKILL.md`; it does not vendor the dependency implementation or provide verification material from which the behavior of the installed executable can be independently established. ### Attack Path 1. An attacker compromises the package publisher, registry account, Homebrew formula source, or upstream release process. 2. The attacker publishes a modified release under the same `deja-vu` or `@vshulcz/deja-vu` identifier. 3. The installation mechanism resolves the mutable, unpinned package reference to the compromised release. 4. The agent invokes the resulting `deja` executable as directed by the Skill. 5. The compromised executable runs with the user's permissions and may read indexed session history, local files available to the pr ...[truncated 750 chars]
• Remediation: ## Remediation Suggestions - Pin the Homebrew formula and Node package to a specific audited release. - Use a lockfile and registry integrity digest for the Node installation path. - Verify release signatures or cryptographic checksums before installation. - Document the authoritative source repository, expected publisher identity, and package provenance. - Review dependency changes before updating the pinned version. - Run the CLI with least privilege and restrict its filesystem and network access where sandboxing is available. - Limit the CLI to only the projects and transcript fields necessary for the active task. - Establish a response process for revoking compromised releases and rotating any secrets potentially exposed to the executable.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The skill description includes broad triggers such as searching when the user refers to earlier sessions or before re-debugging, which can match ordinary conversation and cause the agent to invoke history search more often than necessary. Because this skill queries prior AI-session history on the local machine, over-triggering can expose unrelated past-session data or cause unnecessary retrieval of sensitive context.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The instruction to search before broad categories of work like debugging or implementing something that may already exist is underspecified and likely to over-trigger in normal development flows. In this skill's context, over-triggering is more dangerous because the tool searches a corpus of past AI coding sessions across tools on the machine, increasing the chance of unnecessary access to stale, irrelevant, or sensitive historical content.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.