Precc Token Saver

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:21 PM UTC
• Version: 0.1.8

Overview

This skill has a coherent token-saving purpose, but it gives an external hook broad control over every shell command and uses under-scoped setup and history-ingestion flows.

Install only if you trust the PRECC project and are comfortable with it seeing and rewriting every shell command your agent runs. Avoid the curl-to-bash installer unless you can pin and verify it, do not run precc ingest --all without understanding exactly what history will be processed, and review update behavior before relying on this in sensitive repositories.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:68

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:89

Finding

External Hook Can Rewrite and Hijack Every Shell Command

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:74

Finding

Optional Unscoped Ingestion of All Existing Session History

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping fetched network content directly into bash is a classic chaining-abuse pattern because it removes any inspection boundary between untrusted input and shell execution. The danger is amplified here because the skill already promotes pervasive shell mediation, so users may be conditioned to trust complex command pipelines that can execute attacker-controlled content immediately.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash

# Install PRECC
curl -fsSL https://raw.githubusercontent.com/yijunyu/precc-cc/main/scripts/install.sh | bash

# Initialise (one-time)
precc init

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that every shell command is intercepted and may be rewritten, including changing directories and prepending wrappers, but it does not present this as a prominent safety warning or require confirmation. In this context, silent command transformation is dangerous because the agent is instructed to apply it universally, making unintended execution context changes or altered command semantics more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup and behavior sections instruct the user/agent to run initialization and ingest commands but do not clearly disclose that these actions may write local databases and process existing session history. That omission matters because the skill markets token savings for shell rewriting, while these commands materially change local state and may collect sensitive historical context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill goes beyond command rewriting by directing initialization and optional ingestion of prior session history, which can create persistent local state and process historical data unrelated to the immediate shell-wrapping function. In an agent context, this expands the trust boundary and may expose sensitive prior commands, paths, or secrets captured in shell history without explicit user consent or scoping.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Including a self-update command for PRECC binaries introduces software modification capability that is not necessary for the stated runtime purpose of routing commands through a hook. In a skill that already influences every shell invocation, update functionality increases supply-chain and execution risk if triggered casually or by a compromised upstream release.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The installation command fetches a remote script from GitHub and executes it locally, which exposes users to arbitrary code execution if the source repository, network path, or referenced branch content is compromised. In a skill file, this is especially risky because it normalizes direct execution of unreviewed remote content as part of setup.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash

# Install PRECC
curl -fsSL https://raw.githubusercontent.com/yijunyu/precc-cc/main/scripts/install.sh | bash

# Initialise (one-time)
precc init

Static analysis

No suspicious patterns detected.