devenv-chat-backup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs embedding a GitHub Personal Access Token directly into commands and files (e.g., git clone and ~/.git-credentials), which requires handling/outputting secret values verbatim and thus creates an exfiltration risk.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Multiple URLs use third‑party GitHub mirrors/proxies (tvv.tw, ghproxy, gh-proxy, ghps.cc, mirror.ghproxy.com) which can modify or obscure content and several entries embed GitHub tokens in clone URLs (https://YOUR_TOKEN@github.com...), both of which are high‑risk for distributing tampered files or leaking credentials.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The scripts deliberately collect and upload sensitive data (API keys, tokens, host/environment info) to a remote GitHub repository and include persistent/auto-restore mechanisms and an exposed tunnel—constituting credential exfiltration and remote-access risk.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Required runtime workflow runs scripts/chat-backup.sh/scripts/auto-restore.sh, which clones from a GitHub repo and then parses outsider-originated sessions/*.jsonl line text from that repo via import_messages_from_jsonl() (Python json.loads(line)), ingesting free text authored in the repository at restore time.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The scripts perform runtime git clones and copy/execute code from remote GitHub repositories (e.g., REPO_URL "https://github.com/88lin/ai-shell-backup.git" and the tokenized clone "https://YOUR_TOKEN@github.com/YOUR_USER/YOUR_REPO.git"), and github-accel.sh uses mirror hosts (e.g. "https://ghproxy.com/") at runtime to fetch content, so external repositories/mirrors are fetched and their code can be executed.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs persistent, privileged changes to the system (cloning into /root, copying scripts to /root and chmodding them, adding auto-restore lines to /root/.bashrc, starting background daemons and storing a plaintext token), which alters the machine state and can require/root-level access and long-lived processes.