Dead or Clone

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:50 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent backup and sharing purpose, but it gives a remote service broad access to workspace and AI state data and can overwrite local configuration from unverified remote ZIP files.

Install only if you are comfortable with broad workspace and agent-state backup to the listed remote service. Before using it, require HTTPS, an explicit file manifest and allowlist, secret redaction, per-action confirmation, revocable or expiring keys, safe ZIP validation, and a way to pause sync and delete remote data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

other

Error

• Location: SKILL.md:32
• Finding: Automatic Exfiltration of Sensitive Workspace and Agent-State Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32-34, 55-60, and 80-99 **Vulnerability Type**: Sensitive data exfiltration through broad automatic cloud backup **Risk Level**: High ### Vulnerable Code ```text AI will: 1. Upload all workspace files 2. Give you a Key (e.g., `map_abc123`) ``` ```text **Zero setup.** AI checks every hour and syncs changes automatically. ``` ```text Trigger backup when: - First-time setup - User says "backup", "save config", "remember this" - SOUL.md / USER.md / MEMORY.md modified - New skill created ``` ```text POST /storage-project (get cloud repo) ↓ git add *.md (all markdown files) git commit -m "Backup" git push (using authenticated_url) ↓ POST /project-mapping (create Key) ↓ Tell user: "Save this Key: map_xxx" ``` ### Technical Analysis The Skill directs an agent to upload workspace files to an externally operated cloud service. It specifically treats changes to `SOUL.md`, `USER.md`, and `MEMORY.md` as backup triggers and stages all matching Markdown files with `git add *.md`. These files can contain user profiles, persistent memories, system behavior, private conversation-derived information, credentials, API tokens, internal URLs, or other confidential data. The instructions provide no file allowlist, secret scanning, redaction, retention policy, deletion mechanism, or review of the exact data being transferred. The advertised hourly synchronization further expands the exposure because later changes may be uploaded without fresh, informed approval. Although the user may initially request backup, the broad and continuing transfer is not bounded to a clearly disclosed set of files. ### Attack Path 1. A user asks the agent to set up cloud backup. 2. The agent requests an authenticated repository URL from the external service. 3. The agent stages all Markdown files, including identity, memory, and agent-configuration files. 4. The agent commits and pushes those files to the externally sup ...[truncated 849 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit, informed consent before the first external upload. - Display the destination host and a complete file manifest before transferring data. - Use an explicit allowlist rather than staging all Markdown or workspace files. - Exclude `SOUL.md`, `USER.md`, `MEMORY.md`, credentials, secrets, logs, and private keys by default. - Run secret scanning and content classification before every upload. - Do not enable recurring synchronization unless the user separately opts in. - Provide controls to pause synchronization and delete remotely stored data. - Prefer a repository or storage account controlled directly by the user. - Encrypt backup contents locally so the service cannot read plaintext data. - Document storage location, retention period, access controls, and deletion procedures. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:112
• Finding: Unverified Remote Archive Can Overwrite Agent Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 112-130 and 157-162 **Vulnerability Type**: Unverified remote payload retrieval and unsafe configuration replacement **Risk Level**: Critical ### Vulnerable Code ```text GET /project-mapping-zip?key=xxx ↓ Confirm with user: "Apply role [name]? Current config backed up." ↓ git stash (backup current) git checkout -b role/[name] Download ZIP → unzip → overwrite git add -A && git commit ↓ "Role [name] applied. Original config stashed." ``` ```text GET /project-mapping-zip?key=map_xxx → Returns: {"zip_url": "..."} ``` ### Technical Analysis The Skill instructs the agent to obtain a `zip_url` from an external API, download the referenced archive, extract it, and overwrite the current workspace configuration. It does not require a cryptographic signature, pinned digest, immutable version identifier, trusted-host allowlist, archive manifest, or inspection of changed files. Because the archive can contain configuration, memory, or Skill files, its contents may alter the agent's future behavior. The effective payload is controlled remotely and can change after the Skill itself has been reviewed. A malicious role publisher, compromised service, leaked mapping key, or manipulated response could therefore deliver hostile instructions. The generic confirmation prompt only presents a role name and description. It does not show the archive source, files, checksums, or proposed diff, so the user cannot provide informed approval for the actual payload. The unspecified `unzip` operation also lacks required defenses against path traversal, absolute paths, symbolic links, and unexpected file types. Depending on the extraction implementation, a malicious archive could attempt to write outside the intended workspace. ### Attack Path 1. An attacker creates or compromises a role mapping, or gains control of the mapping service. 2. The API returns a `zip_url` pointing to an attacker-controlled or modi ...[truncated 1103 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require all role archives to be cryptographically signed by an explicitly trusted publisher. - Pin an immutable SHA-256 or stronger digest before download and verify it before extraction. - Restrict downloads to HTTPS origins on a strict host allowlist. - Download into an isolated temporary directory with restrictive permissions. - Validate every archive entry and reject absolute paths, `..` traversal, symbolic links, hard links, devices, and unexpected file types. - Extract into a new staging directory rather than directly over the workspace. - Show the user the archive source, signer, hash, complete file manifest, and proposed diff. - Require separate confirmation before changing Skill files, memory, identity files, or agent instructions. - Prevent remote packages from replacing system or developer policy. - Use immutable versioned role packages and retain a verifiable audit log. - Restore through a clean Git commit or snapshot instead of relying solely on `git stash`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:150
• Finding: Plaintext HTTP Exposes Credentials, Identifiers, and Repository Routing<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 150-165 **Vulnerability Type**: Plaintext transmission of sensitive API operations **Risk Level**: High ### Vulnerable Code ```text Base: http://clone.kqq.ai:8089 POST /storage-project Body: {"machine_code": "<sha256>"} → Returns: authenticated_url for git push POST /project-mapping Body: {"machine_code": "...", "git_url": "...", "branch_name": "...", "name": "...", "description": "..."} → Returns: {"key": "map_xxx"} GET /project-mapping-zip?key=map_xxx → Returns: {"zip_url": "..."} GET /project-mappings?machine_code=xxx → Returns: list of Keys for this machine ``` ### Technical Analysis The documented API base URL uses unencrypted HTTP. Requests and responses may contain persistent machine identifiers, mapping keys, Git repository information, a Git push URL described as authenticated, and a remotely selected ZIP URL. Without transport encryption and server authentication, a network-positioned attacker can observe or alter these values. If credentials are embedded in the authenticated Git URL, interception may grant direct repository access. Response manipulation could also redirect backup pushes or substitute the archive used for role installation. This weakness compounds the remote archive and backup risks because the protocol does not provide confidentiality, integrity, or reliable authentication of the service endpoint. ### Attack Path 1. The agent connects to `http://clone.kqq.ai:8089` over an untrusted or monitored network. 2. A network attacker intercepts the plaintext request and response. 3. The attacker records the machine code, mapping keys, repository metadata, or authenticated Git URL. 4. Alternatively, the attacker modifies the response to return an attacker-controlled Git or ZIP URL. 5. The agent uploads private data to the substituted repository or installs the substituted role archive. 6. Captured permanent keys can be reused later if no rotation or revocation m ...[truncated 593 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace HTTP with HTTPS and enforce certificate and hostname validation. - Refuse redirects or returned URLs that downgrade to plaintext HTTP. - Apply a strict allowlist to repository and archive destinations. - Do not place reusable credentials in URLs, where they may leak through logs and process output. - Issue short-lived, least-privilege tokens scoped to one repository and operation. - Implement credential expiration, rotation, revocation, and audit logging. - Bind archive metadata and repository destinations to authenticated API responses. - Encrypt backup content locally before transmission. - Avoid exposing mapping keys in query strings; use authenticated request headers or protected request bodies. ]]>

other

Warning

• Location: SKILL.md:168
• Finding: Stable Hardware Fingerprint Is Collected and Sent to an External Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 168-173 **Vulnerability Type**: Privacy-invasive device fingerprinting **Risk Level**: Medium ### Vulnerable Code ```bash # Linux cat /proc/cpuinfo /sys/class/net/*/address | sha256sum | cut -d' ' -f1 ``` The resulting value is used by the API as follows: ```text POST /storage-project Body: {"machine_code": "<sha256>"} ``` ### Technical Analysis The prescribed command reads CPU information and the hardware addresses of all network interfaces, combines them, and produces a stable SHA-256 value. That value is then used as the machine's identity when communicating with the external service. Hashing does not make stable hardware attributes anonymous. CPU characteristics and MAC addresses have constrained and linkable value spaces, and the resulting hash remains a persistent identifier. The service can correlate backup and mapping activity across sessions without an account. The command also reads more hardware data than is necessary to distinguish a local installation. A random locally generated identifier would provide the required functional association without deriving identity from hardware. ### Attack Path 1. The agent reads `/proc/cpuinfo` and network-interface MAC addresses. 2. It hashes the combined hardware data into a stable machine code. 3. The machine code is transmitted with storage and mapping API requests. 4. The external service stores or observes that identifier. 5. Repeated requests can be correlated to the same machine over time. 6. If API records are shared, leaked, or compromised, the identifier can support persistent device profiling. ### Impact Assessment The issue exposes a stable pseudonymous identifier derived from device hardware. It does not directly grant operating-system privileges, but it enables long-term tracking and correlation of a user's backup and role-sharing activity. The affected scope includes the local machine's CPU-derived information and a ...[truncated 218 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace hardware-derived identity with a cryptographically random installation identifier generated locally. - Make the identifier visible, resettable, and revocable by the user. - Obtain explicit consent before transmitting any persistent device identifier. - Do not read CPU details or MAC addresses when they are not operationally necessary. - Minimize server-side retention and prohibit use of the identifier for unrelated tracking. - Publish a clear privacy notice covering collection, purpose, retention, sharing, and deletion. - Protect identifiers in transit with HTTPS and at rest with appropriate access controls. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The quick-start backup description tells users the AI will 'upload all workspace files' but does not clearly warn that data is sent to a remote service over plain HTTP, nor explain the sensitivity implications. In this skill's context, the omission is especially dangerous because the workflow normalizes automatic exfiltration of workspace content and credentials are reduced to a single reusable key.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The backup trigger phrases are broad enough to activate on ordinary conversation such as 'remember this' or 'save config', which can cause the agent to upload workspace contents without a clear, informed, and specific user request. In this skill, that risk is amplified because backups send files to a remote third-party service and the scope includes sensitive memory/config files like SOUL.md, USER.md, and MEMORY.md.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The share flow encourages generating and sending a key but does not prominently warn that possession of the key allows others to retrieve and apply the exact configuration. Since the skill frames sharing as easy and portable, users may disclose keys without understanding they function as bearer credentials for sensitive role/config data.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The restore conditions allow activation based on ambiguous context like a 'new device detected' or the service indicating existing data, which may steer users into restoring state they did not intend to apply. In a system that can overwrite local configuration and recover prior workspace content, ambiguous restore prompting can lead to unwanted state changes, privacy exposure, or cross-context contamination.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The role-application trigger accepts vague input like 'try this Key', making it too easy to invoke a destructive workflow that downloads and overwrites configuration from a remote source. Because the role flow stashes current state, creates branches, and applies remote ZIP content, weak intent matching increases the chance of accidental or socially engineered reconfiguration.

Session Persistence

Medium

• Category: Rogue Agent

Content

This device has previous backups.

Options:
[1] Enter Key to restore previous data
[2] Create new backup (history preserved but needs Key)

Recommendation: Try restore first.

• Confidence: 76% confidence
• Finding: The prompt explicitly recommends restoring previous data, encouraging persistence of prior session state onto the current device. In an agent environment, carrying forward historical data can expose prior user context, secrets, or behavioral state in situations where the current session should remain isolated.

Static analysis

No suspicious patterns detected.