Autonomous Sync

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.1

Overview

This skill is for syncing Aicoo notes, but it gives persistent automation and authenticated remote-write instructions without enough scope controls.

Install only if you are comfortable with persistent local automation that can send selected project or conversation content to Aicoo and modify remote notes. Before using it, pin the API destination to the official HTTPS Aicoo host, use a least-privileged token, avoid the broad Write|Edit hook, inspect or provide the sync script yourself, define exactly what may be synced, redact secrets, and document how to disable any cron, loop, or hook you add.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:39

Finding

Persistent Execution Through Scheduled Tasks and Post-Tool Hooks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-62
Vulnerability Type: Persistent scheduled and event-triggered command execution
Risk Level: High

Vulnerable Code

markdown

### Cron example

```bash
# daily at 9:00
0 9 * * * /path/to/aicoo-sync.sh >> /tmp/aicoo-sync.log 2>&1

Strategy 2: Event-Driven (hooks)

Claude hooks

Add to .claude/settings.json:

json

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "./aicoo-skills/scripts/sync-detector.sh"
          }
        ]
      }
    ]
  }
}

text

### Technical Analysis

The skill directs users to establish two cross-session execution mechanisms:

1. A cron task that invokes a synchronization script every day.
2. A persistent Claude `PostToolUse` hook that invokes a command after any operation matching `Write` or `Edit`.

These mechanisms continue operating after the original skill interaction ends. The hook is especially broad because ordinary file modifications unrelated to Aicoo synchronization can trigger the command automatically. The configuration does not include per-execution confirmation, content scoping, rate limiting, an expiration mechanism, or removal instructions.

Although persistent automation is related to the stated synchronization purpose, the recommended implementation grants an external command recurring and event-driven execution beyond an individual invocation.

### Attack Path

1. A user follows the instructions and installs the cron entry or modifies `.claude/settings.json`.
2. The configuration persists after the current agent session.
3. The scheduled time arrives, or the agent performs any matching `Write` or `Edit` operation.
4. The configured script executes automatically without fresh user approval.
5. The script can process newly written
...[truncated 857 chars]

Remediation

View remediation

Remediation Suggestions

• Keep scheduled and hook-based synchronization disabled by default.
• Require explicit, informed consent before creating cron entries or modifying persistent Claude settings.
• Prefer an explicit synchronization command over a broad PostToolUse hook.
• If a hook is necessary, narrow its matcher and validate that the changed file belongs to an approved synchronization scope.
• Prompt for approval before each external transfer or remote modification.
• Add rate limits, execution timeouts, audit logs, and an expiration date for persistent automation.
• Document exact commands for disabling and removing both the cron entry and the hook.
• Run the synchronization process with a dedicated least-privileged account and narrowly scoped API credentials.
• Prevent concurrent executions with a securely implemented lock.

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:49

Finding

Automatic Execution of an Unbundled Relative-Path Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-62
Vulnerability Type: Relative-path command hijacking
Risk Level: High

Vulnerable Code

markdown

Add to `.claude/settings.json`:

```json
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "./aicoo-skills/scripts/sync-detector.sh"
          }
        ]
      }
    ]
  }
}

text

### Technical Analysis

The hook executes `./aicoo-skills/scripts/sync-detector.sh` through a relative path. The audited project contains only `SKILL.md`; the referenced script is not bundled and therefore could not be reviewed.

Relative-path resolution depends on the process's working directory. Consequently, the command may execute a different file than the user expects. An attacker who can create or replace the file at the resolved path can cause attacker-controlled code to run automatically after broad `Write` or `Edit` events.

Because the hook is persistent, a single path replacement can affect many future tool operations. No ownership check, permission check, cryptographic integrity verification, canonical-path validation, or trusted installation procedure is specified.

### Attack Path

1. The user installs the documented `PostToolUse` hook.
2. An attacker, compromised repository, or another local process creates or replaces `./aicoo-skills/scripts/sync-detector.sh` in the working-directory-relative location.
3. The agent performs a `Write` or `Edit` operation.
4. Claude resolves the relative command path and automatically executes the substituted script.
5. The script runs with the privileges and environment of the Claude process.
6. It can read accessible data, capture environment credentials, modify files, initiate network requests, or establish additional persistence.

Exploitation requires the attacker to contro
...[truncated 697 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle the referenced script inside the reviewed skill package so its implementation can be audited.
• Resolve the script through a canonical absolute path under a trusted, administrator- or user-controlled installation directory.
• Refuse to execute scripts located in repositories, temporary directories, or other paths writable by untrusted parties.
• Verify the script's ownership, permissions, regular-file status, and cryptographic digest before execution.
• Avoid shell interpretation where possible; invoke a fixed executable and argument array directly.
• Require explicit approval before installing the hook and before executing newly installed or changed script content.
• Restrict the hook to specific approved files or synchronization commands rather than every Write or Edit.
• Fail closed if the script is missing, changed, symbolic-linked, or outside the expected canonical directory.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:66

Finding

Authenticated Data Synchronization Uses an Undefined Destination Variable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-100
Vulnerability Type: Unvalidated external destination and potential credential disclosure
Risk Level: High

Vulnerable Code

markdown

## Strategy 3: Conversation-Driven

After substantial chat sessions:

```bash
# 1) search
curl -s -X POST "$PULSE_BASE/os/notes/search" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"database migration strategy"}' | jq .

# 2) snapshot before overwrite
curl -s -X POST "$PULSE_BASE/os/snapshots/42" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"Pre-update"}' | jq .

# 3) patch
curl -s -X PATCH "$PULSE_BASE/os/notes/42" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"# Updated content..."}' | jq .

If no matching note exists, call POST /os/notes.

What to Sync

• decisions
• preferences
• project updates
• meeting outcomes
• policy/constraint changes

text

### Technical Analysis

The prerequisite section identifies the intended base URL as `https://www.aicoo.io/api/v1`, but the executable examples send requests to `$PULSE_BASE`, which is not defined or validated in the skill.

Each request attaches `AICOO_API_KEY` as a bearer credential. If `PULSE_BASE` is incorrectly configured or manipulated, the credential is sent directly to the selected host. The suggested synchronization scope also includes potentially sensitive decisions, preferences, project information, meeting outcomes, and organizational policies.

The instructions do not require an HTTPS-only URL, an approved-host allowlist, certificate pinning, redirect restrictions, content classification, secret redaction, or confirmation before transferring information. Quoting the variable prevents shell word splitting but does not establish destination 
...[truncated 1381 chars]

Remediation

View remediation

Remediation Suggestions

• Use the declared constant endpoint https://www.aicoo.io/api/v1, or validate any configurable endpoint against a strict HTTPS hostname and port allowlist.
• Reject non-HTTPS URLs, embedded user information, unexpected ports, IP-literal hosts, and URLs outside the approved Aicoo domain.
• Disable redirects or ensure authorization headers cannot be forwarded to a different origin.
• Clearly define one consistently named base URL variable and fail closed when it is absent or invalid.
• Use a dedicated, revocable, least-privileged API token with only the note operations required for synchronization.
• Add content classification and secret-redaction controls before uploading conversation or project data.
• Require user confirmation that previews the destination and the exact content before external transfer.
• Avoid verbose diagnostics that could expose authorization headers, and ensure logs do not contain credentials or sensitive payloads.
• Rotate the API key immediately if it may have been sent to an unintended destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger description is extremely broad, matching common terms like 'schedule', 'trigger', 'hook', 'loop', and 'auto update'. This creates a high risk of unintended activation, causing the agent to suggest or initiate persistence, automation, or outbound sync behavior in contexts where the user did not clearly request such powerful actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages automated sync via cron, hooks, and post-tool triggers that can repeatedly transmit project content to an external service, but it does not prominently warn about privacy, sensitive data leakage, cost, persistence, or system-side effects. In a skill specifically about autonomous synchronization, the lack of explicit consent and scope controls makes accidental over-collection and ongoing exfiltration materially more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

bash

# 1) search
curl -s -X POST "$PULSE_BASE/os/notes/search" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"database migration strategy"}' | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

-d '{"query":"database migration strategy"}' | jq .

# 2) snapshot before overwrite
curl -s -X POST "$PULSE_BASE/os/snapshots/42" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"Pre-update"}' | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This example patches remote note content over an external API, and in the context of autonomous sync guidance it can normalize sending arbitrarily large or sensitive conversation/project content to a third party without sufficient guardrails. The danger is increased by nearby automation patterns like cron and hooks, which could cause repeated unsupervised outbound transmission and remote overwrites.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

-d '{"label":"Pre-update"}' | jq .

# 3) patch
curl -s -X PATCH "$PULSE_BASE/os/notes/42" \
  -H "Authorization: Bearer $AICOO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"# Updated content..."}' | jq .