thedotmack/claude-mem

Why it got this result

Traced auth gates across both runtimes. (1) stdio MCP server: no network listener at all -- it communicates only over stdin/stdout, started directly by the host client (Claude Code), so OS process spawn is the access control boundary; every tool is scoped to the caller's own local worker/server. (2) Worker HTTP runtime: binds loopback by default; the only general-purpose route group has no request-level auth, but every exposed tool operates on the local user's own SQLite memory store with no shared backend identity or other-user data -- when the operator opts into a non-loopback bind, the code emits an explicit SECURITY warning and the only additional remote-readable surface is Observation TV, which IS gated (see decideRemoteAccess: token-based, constant-time compare, default-deny on missing/invalid token, allowlist-only GET paths). (3) Server-beta Postgres runtime (the one with host-side, cross-user effects: writes/reads to a shared team's Postgres-backed memory): every /v1/* route, including the MCP recall endpoint, requires requirePostgresServerAuth with explicit requiredScopes (memories:read / memories:write) -- traced the full credential path: rawKey extraction -> verifyPostgresApiKey() hashes with SHA-256 and looks up by key_hash (the secret itself, not merely an identifier, is compared via the hash match on the full key) -> checks revoked_at/expires_at -> hasRequiredScopes(). Every error/empty-identity branch (!rawKey, !verified, revoked, expired, insufficient scope) returns 401/403 (deny), never allow-on-error. The only bypass path (local-dev) requires BOTH an explicit authMode=='local-dev' AND an explicit CLAUDE_MEM_ALLOW_LOCAL_DEV_BYPASS=1 opt-in AND loopback-only request characteristics, and is explicitly rejected inside Docker (CLAUDE_MEM_DOCKER=1) per create-server-service.ts.

Why it matters

Prevents unauthorized tool use and data access.

Evidence

  if (!rawKey) {
    res.status(401).json({
      error: 'Unauthorized',
      message: 'Missing API key (Authorization: Bearer <key> or X-Api-Key: <key>)',
    });
    return;
  }

  const verified = await verifyPostgresApiKey(pool, rawKey, options.requiredScopes ?? []);
  if (!verified) {
    res.status(403).json({ error: 'Forbidden', message: 'Invalid API key or insufficient scope' });
    return;
  }
  const ctx: AuthContext = { ... mode: 'api-key' };
…

  if (!row) {
    return null;
  }
  if (row.revoked_at) {
    return null;
  }
  if (row.expires_at && row.expires_at.getTime() <= Date.now()) {
    return null;
  }
  const scopes = normalizeScopes(row.scopes);
  if (!hasRequiredScopes(scopes, requiredScopes)) {
    return null;
  }

export function decideRemoteAccess(input: {
  method: string; path: string; presentedToken: string | null; expectedToken: string;
}): RemoteAccessDecision {
  if (!REMOTE_READABLE_METHODS.has(input.method.toUpperCase())) {
    return { allow: false, status: 403, reason: 'method' };
  }
  if (!REMOTE_READABLE_PATHS.has(input.path)) {
    return { allow: false, status: 404, reason: 'path' };
  }
  if (!input.expectedToken || !input.presentedToken) {
    return { allow: false, status: 401, reason: 'token' };
  }
  if (!safeEqualSecret(input.presentedToken, input.expectedToken)) {
    return { allow: false, status: 401, reason: 'token' };
…

Why it got this result

Both MCP servers (stdio at src/servers/mcp-server.ts and the streamable-HTTP recall server at src/server/mcp/recall-mcp-server.ts) define their tool arrays as static, hardcoded TypeScript literals compiled into the shipped bundle. No runtime fetch of a tool manifest exists (grep for fetch/axios/http.get in these files returns nothing), and ListToolsRequestSchema simply serves the in-memory tools array. Tool changes ship only via a new npm release / plugin update, which goes through the normal install/update flow rather than a silent hot-reload.

Why it matters

Prevents rug-pull tool poisoning.

Evidence

const tools = [
  {
    name: 'mem_search',
    description: 'Search memory through enforced progressive disclosure. ...',
    inputSchema: { ... },
    annotations: READ_ONLY_TOOL_ANNOTATIONS,
    handler: async (args: any) => { ... }
  },

server.setRequestHandler(ListToolsRequestSchema, async () => {
  const advertisedTools = withoutDisabledWorkStateTools(
    getAdvertisedMcpToolsForRuntime(tools, selectRuntime()),
    workStateEnabled(),
  );
  return {
    tools: advertisedTools.map(tool => ({
      name: tool.name,
      description: tool.description,
      inputSchema: tool.inputSchema,
      annotations: tool.annotations
    }))
  };
});

Why it got this result

Enumerated all 27 tools across both MCP servers. Filesystem-touching tools (smart_search/smart_unfold/smart_outline) resolve every caller-supplied path through resolveWithinWorkspace(), which realpath()s both the workspace root and the target and refuses any path that escapes the workspace directory (fixing a prior unrestricted-read bug, see code comment referencing issue #3861). No tool executes OS commands, reads arbitrary files outside the workspace, or performs admin actions; corpus/observation tools are scoped to the worker's own SQLite/Postgres-backed memory store. The remote recall MCP (search/context/recent) is read-only and scoped to the caller's own team/project via the authenticated API key.

Why it matters

Limits blast radius and privilege escalation.

Evidence

export async function resolveWithinWorkspace(
  filePath: string,
  workspaceCwd: string = process.cwd(),
): Promise<string> {
  if (typeof filePath !== 'string' || filePath.trim().length === 0) {
    throw new Error('file_path is required');
  }

  const root = await realpath(resolve(workspaceCwd));
  const lexicallyResolved = resolve(root, expandLeadingTilde(filePath));
  let resolved: string;
  try {
    resolved = await realpath(lexicallyResolved);
  } catch {
…

Why it got this result

The worker's HTTP listener (local, loopback-by-default) enforces a DNS-rebinding Host-header allowlist (createWorkerHostGuard / isTrustedWorkerHost) and an Origin allowlist (createCorsMiddleware) before any route executes; both default-deny unrecognized Host/Origin values. The remote server-beta Postgres runtime does not mount CORS/Origin middleware at all (per code comment: 'the server runtime authenticates every request with an API key and is reached through public DNS names, so neither the Host check nor same-host CORS applies there') -- every /v1/* route, including /v1/mcp, requires a valid Bearer API key via requirePostgresServerAuth regardless of Origin, so there is no browser-rebinding attack surface: a rebound page cannot mint or guess the Bearer token.

Why it matters

Prevents DNS rebinding/browser hijack of local or remote MCP.

Evidence

export function createWorkerHostGuard(policy: WorkerOriginPolicy): RequestHandler {
  const trustedHostnames = trustedWorkerHostnames(policy);
  return (req: Request, res: Response, next: NextFunction): void => {
    const rawHost = req.headers.host;
    if (isTrustedWorkerHost(rawHost, trustedHostnames)) {
      next();
      return;
    }
    ...
    res.status(403).json({
      error: 'Forbidden',
      message: `Host "${host}" is not trusted. ...`,
    });
  };
…

  setupRoutes(app: Application): void {
    app.use('/v1', requestIdMiddleware());
    const baseWrite = requirePostgresServerAuth(this.options.pool, {
      authMode: this.options.authMode,
      allowLocalDevBypass: this.options.allowLocalDevBypass,
      requiredScopes: ['memories:write'],
    });
    const baseRead = requirePostgresServerAuth(this.options.pool, {
      authMode: this.options.authMode,
      allowLocalDevBypass: this.options.allowLocalDevBypass,
      requiredScopes: ['memories:read'],
    });

Why it got this result

Default binds for both runtimes are loopback-only: DEFAULT_SERVER_HOST='127.0.0.1' (server-beta) and CLAUDE_MEM_WORKER_HOST default '127.0.0.1' (worker). An operator can opt into 0.0.0.0 (documented in docker-compose.yml for containerized deployment), but in that case every /v1/* route still requires a Bearer API key (requirePostgresServerAuth) -- so 0.0.0.0 bind is never auth-less. For the worker (which has no general request auth), binding non-loopback triggers an explicit SECURITY-level warning in logs and the Observation TV feature's read-only guard is the only extra surface opened; the warning text itself flags the residual risk to operators.

Why it matters

LAN/Internet exposure enables remote exploitation.

Evidence

const SERVER_RUNTIME = 'server-beta';
const DEFAULT_SERVER_HOST = '127.0.0.1';
const DEFAULT_SERVER_PORT = 37877;

    } else if (host !== '127.0.0.1' && host !== '::1' && host !== '::ffff:127.0.0.1' && host !== 'localhost') {
      // Warn, do not refuse to bind: docs/docker.md tells people to set
      // CLAUDE_MEM_WORKER_HOST=0.0.0.0, and refusing would break that install.
      logger.warn(
        'SECURITY',
        'Worker bound to a non-loopback host with no CLAUDE_MEM_TV_TOKEN -- the full worker API, including provider API keys via GET /api/settings, is reachable from the network',
        { host }
      );
    }

Why it got this result

No CORS configuration anywhere in the codebase sets Access-Control-Allow-Origin to a wildcard '*' combined with credentials. createCorsMiddleware only ever reflects a specific validated Origin (never '*') and only after it passed the allowlist/same-host check; grep for wildcard CORS patterns across src/ returned no matches.

Why it matters

Prevents credentialed cross-origin abuse.

Evidence

export function createCorsMiddleware(policy?: WorkerOriginPolicy): RequestHandler {
  const allowedOrigins = new Set(policy?.allowedOrigins ?? []);
  return (req: Request, res: Response, next: NextFunction): void => {
    const origin = req.headers.origin;
    if (origin) {
      const allowed = isLocalhostOrigin(origin)
        || allowedOrigins.has(origin.toLowerCase())
        || (policy !== undefined && isSameHostOrigin(origin, req.headers.host));
      if (!allowed) {
        res.status(403).json({ error: 'Forbidden', message: 'CORS not allowed' });
        return;
      }
      res.setHeader('Access-Control-Allow-Origin', origin);
      res.setHeader('Vary', 'Origin');
…

Why it got this result

Tool names (mem_search, save_memory, search, timeline, get_observations, smart_search, smart_outline, smart_unfold, build_corpus, etc.) are generic verbs/nouns describing claude-mem's own domain, not near-misses or homographs of a specific widely-deployed MCP server's tool (e.g. no 'read_file'/'list_directory' collision with the reference filesystem server, no collision with common tool names from other popular servers). The rule's own negative indicator explicitly excludes generic verbs with no named collision from being a positive signal.

Why it matters

Prevents malicious tool shadowing.

Evidence

const tools = [ { name: 'mem_search', ... }, { name: 'save_memory', ... }, { name: 'search', ... }, { name: 'timeline', ... }, { name: 'get_observations', ... }, { name: 'get_tool_uses', ... }, { name: 'work_state_write', ... }, { name: 'work_state_read', ... }, { name: 'session_start_context', ... }, { name: 'observation_add', ... }, ... { name: 'smart_search', ... }, { name: 'smart_unfold', ... }, { name: 'smart_outline', ... }, { name: 'build_corpus', ... } ... ]

Why it got this result

Codepoint-scanned both MCP servers' source for zero-width/bidi/Tag-block characters (python3 regex scan over src/servers/mcp-server.ts matched 0 occurrences). All tool descriptions are plain, purpose-descriptive ASCII prose (e.g. mem_search's description explains its progressive-disclosure contract) with no embedded directives to exfiltrate data, no hidden control characters, and no operational commands aimed at the host model beyond describing the tool's own use.

Why it matters

Prevents covert model manipulation.

Evidence

description: 'Search memory through enforced progressive disclosure. Guided mode returns readable mem-search step 1 of 3 (index), a short continuation for step 2 (context), then step 3 (selected details). Follow the next-call instructions and choose only IDs shown in the previous result. Auto mode completes the same bounded pipeline in one call. Use this tool for every memory search.'

Why it got this result

The server is not an OAuth proxy: there is no code forwarding authorization to a distinct upstream IdP on behalf of dynamically-registered MCP clients, and no dynamic client-registration endpoint was found anywhere in src/ (grep for register.*client / client.*registration / DCR patterns returned no results). Auth is a single-tenant API-key model (requirePostgresServerAuth / sqlite-api-key-service) issued directly by this server's own /v1/keys route, not brokered through an upstream authorization server. The confused-deputy/per-client-consent threat model this rule targets does not apply to this architecture.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Why it got this result

The plugin.json manifest declares a memory-compression system that persists context via hooks (SessionStart/PostToolUse/Stop/etc.) that call the bundled claude-mem CLI and worker. Bundled scripts (worker-service.cjs, mcp-server.cjs, context-generator.cjs) implement exactly the declared capability: local HTTP worker (fetch calls to 127.0.0.1), SQLite storage, optional telemetry to PostHog (openly documented in docs/public/telemetry.mdx with full whitelist and opt-out). No undisclosed credential harvesting to a third-party host was found; PostHog analytics payload is whitelisted/scrubbed and documented. Network egress (cmem.ai for Pro features, PostHog for telemetry) is disclosed in README/docs and gated by consent for telemetry.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

{
  "description": "Claude-mem memory system hooks",
  "hooks": {
    "Setup": [...],
    "SessionStart": [
      {"matcher": "startup|resume|clear|compact", "hooks": [{"type": "command", "command": "claude-mem", "args": ["start"], "timeout": 60, "async": true}]}
    ]
  }
}

Claude-mem includes anonymous usage analytics (via PostHog) to help prioritize fixes and features.

**It is on by default (opt-out).** Events are anonymous, identified only by a random install UUID, and every analytics property passes a strict whitelist...
npx claude-mem telemetry disable

Why it got this result

The plugin's hooks record tool use and transcript observations and send compressed summaries to the local worker for storage (declared memory function). No evidence within the plugin/ directory of ambient credential-store reads (~/.ssh, ~/.aws, cloud metadata) or undisclosed conversation exfiltration to an undocumented host; hooks only invoke the bundled claude-mem CLI/worker.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

{
  "description": "Claude-mem memory system hooks",
  "hooks": {
    "SessionStart": [
      {"matcher": "startup|resume|clear|compact", "hooks": [{"type": "command", "command": "claude-mem", "args": ["start"], "timeout": 60, "async": true}]}
    ],
    "PostToolUse": [
      {"matcher": "*", "hooks": [{"type": "command", "command": "claude-mem", "args": ["hook", "claude-code", "observation"], "timeout": 120, "async": true}]}
    ]
  }
}

Why it got this result

The plugin.json manifest declares no wildcard permission grant and exposes memory/compression functionality with hooks scoped to specific lifecycle events (SessionStart, PostToolUse, Stop, etc.) rather than an unbounded catch-all. The plugin's own skills (cloud-sync, knowledge-agent, oh-my-issues, timeline-report) each declare least-privilege or no allowed-tools restriction matching their described scope; version-bump's broad scope (git/npm publish) is intrinsic to its declared release-automation purpose (a declared, documented capability, not a hidden one) -- that skill's issue is scored under ATR-P0002 (consent bypass), not scope breadth.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Memory compression system for Claude Code - persist context across sessions",
  ...
}

Why it got this result

Reviewed plugin.json manifests and bundled SKILL.md carriers for zero-width/bidi/Tag-block concealment, homoglyph substitution, forged chat-template tokens, and HTML-comment/CSS-hidden text. None found; all model-facing fields are plain ASCII/em-dash descriptive prose.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Memory compression system for Claude Code - persist context across sessions",
  ...
}

Why it got this result

All SKILL.md and plugin.json manifests ship inside the versioned npm package / marketplace cache (version pinned, e.g. 13.39.0); the version-bump release workflow explicitly bumps and commits version strings across all manifests with git tag + GitHub release, and npm install/publish flows are human/agent-run but produce an auditable, versioned artifact rather than a silent runtime self-mutation. No evidence of the plugin's own instructions/manifest being live-fetched from a publisher-mutable endpoint at runtime.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Memory compression system for Claude Code - persist context across sessions",

Why it got this result

Plugin name claude-mem is a canonical, honestly-descriptive name consistent across all manifest variants (claude-plugin, codex-plugin, cursor-plugin, qoder-plugin, grok-plugin), published by the verified repo origin thedotmack/claude-mem. No typosquat of a third-party brand (e.g. not confusable with 'claude-code' or 'anthropic'), no trust-implying prefix, no unverified fork claims.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Memory compression system for Claude Code - persist context across sessions",
  "author": {"name": "Alex Newman"},
  "repository": "https://github.com/thedotmack/claude-mem",

Why it got this result

plugin.json declares memory/context-compression purpose and points to shared skills/hooks/mcp server. The mcp server (plugin/qoder.mcp.json) is a local stdio launcher for the same claude-mem worker used across all platform variants; hooks (qoder-repo-hooks.json) invoke the same worker-service.cjs for session/context/observation capture, consistent with the declared persistent-memory purpose. No hardcoded third-party exfil sink or undisclosed credential harvesting found in the qoder-specific wiring.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

{
  "name": "claude-mem",
  "description": "Persistent memory and context compression for Qoder sessions.",
  "skills": "./plugin/skills/",
  "mcpServers": "./plugin/qoder.mcp.json",
  "hooks": "./plugin/hooks/qoder-repo-hooks.json"
}

Why it got this result

The plugin manifest and referenced hook configuration contain only declarative JSON event bindings; there is no imperative prose directing the host to suppress confirmation, conceal actions, or assert authority over the host system prompt, so it carries no consent-suppressing instruction capable of directing a model to bypass disclosure.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

{
  "name": "claude-mem",
  "description": "Persistent memory and context compression for Qoder sessions."
}

Why it got this result

plugin.json declares no allowed-tools/OAuth scope wildcard; it only references a local stdio MCP server and hooks scoped to the plugin's own memory-worker function. No wildcard capability grant found.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{"name": "claude-mem", "skills": "./plugin/skills/", "mcpServers": "./plugin/qoder.mcp.json", "hooks": "./plugin/hooks/qoder-repo-hooks.json"}

Why it got this result

plugin.json contains only plain ASCII descriptive fields; no zero-width/bidi/Tag-block codepoints, no forged chat-template tokens, no imperative directed at the host model.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

{"name": "claude-mem", "description": "Persistent memory and context compression for Qoder sessions."}

Why it got this result

Manifest and referenced hooks/skills ship inside the pinned git checkout (no runtime fetch of the plugin's own instructions/manifest from a mutable endpoint); the plugin itself contains no self-mutation of its own manifest/instruction files after approval. version-check.js only manages npm dependency closure completeness, not instruction content.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{"name": "claude-mem", "version": "13.39.0", "skills": "./plugin/skills/", "mcpServers": "./plugin/qoder.mcp.json", "hooks": "./plugin/hooks/qoder-repo-hooks.json"}

Why it got this result

Declared name 'claude-mem' matches the genuine upstream project; source-host org (thedotmack, per git remote and repository field) is the real owner publishing this plugin variant. No near-miss/homoglyph/trust-implying prefix or version-spoofing suffix.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

"name": "claude-mem",
"version": "13.39.0",
"repository": "https://github.com/thedotmack/claude-mem"

Why it got this result

The .qoder-plugin manifest wires skills, MCP configuration, and hooks only; it does not itself establish a credential-store or conversation-context harvest step paired with an exfiltration channel, so the harvest-and-exfiltration pattern this rule targets has no subject here.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

{"name": "claude-mem", "skills": "./plugin/skills/", "mcpServers": "./plugin/qoder.mcp.json", "hooks": "./plugin/hooks/qoder-repo-hooks.json"}

Why it got this result

claude-mem-cursor's manifest (.cursor-plugin/plugin.json) and hooks.json declare a memory plugin for Cursor: hooks that call npx -y claude-mem hook cursor ... for session-init/context/observation/file-edit/summarize, plus local (stdio) and remote (streamable-HTTP, Bearer-token) MCP server entries. Every declared capability (hook commands invoking the already-reviewed claude-mem CLI, MCP tool definitions matching the already-reviewed mcp-server component, bundled skills install/agent-cost-report/mem-search) maps to the plugin's stated purpose of persistent cross-session memory for Cursor. No undisclosed network egress, credential harvest, or subprocess execution beyond what the manifest declares (hooks run the package's own CLI; the agent-cost-report sub-skill's OpenRouter calls are opt-in and declared in its own SKILL.md, already reviewed under its own component).

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

{
  "name": "claude-mem-cursor",
  "version": "13.39.0",
  "description": "Persistent memory for Cursor. Hooks ingest tool use; MCP searches past sessions. Works with a local worker or a remote cmem.ai worker, and a local host-login observer or remote inference.",
  ...
    "name": "Alex Newman"
  },
  "homepage": "https://github.com/thedotmack/claude-mem",
  "repository": "https://github.com/thedotmack/claude-mem",
  "license": "Apache-2.0",
  "keywords": [
      "CLAUDE_MEM_MCP_URL": { "type": "string", ... },
    "memory",
    "cursor",
…

{
  "version": 1,
  "hooks": {
    "beforeSubmitPrompt": [
      { "command": "npx -y claude-mem hook cursor session-init" },
      { "command": "npx -y claude-mem hook cursor context" }
    ],
    "afterMCPExecution": [
      { "command": "npx -y claude-mem hook cursor observation" }
    ],
    "afterShellExecution": [
      { "command": "npx -y claude-mem hook cursor observation" }
    ],
    "afterFileEdit": [
…

Why it got this result

Searched all manifest and skill files shipped by claude-mem-cursor for consent-suppression/oversight-bypass prose -- none found. The install skill tells the user to run an explicit npx command themselves rather than auto-executing anything covertly, and plugin.json's 'variables' block requires the user to explicitly opt into and configure remote MCP (CLAUDE_MEM_MCP_TOKEN) rather than silently defaulting to it.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Cursor: local or remote worker,
  local host-login observer or remote cmem.ai inference.
---
# Install claude-mem on Cursor

Independent of Grok Bot. Do not require the other IDE.

## Local worker (default)

```
npx claude-mem install --ide cursor
…

Why it got this result

claude-mem-cursor's plugin.json declares only MCP server endpoints (local stdio + remote with a user-supplied Bearer token) and hook commands invoking its own CLI -- no OAuth scope block, no wildcard tool grant, no filesystem/exec capability class declared beyond what the memory-capture/recall function needs. The 'variables' schema only exposes two optional, user-configured fields (CLAUDE_MEM_MCP_URL, CLAUDE_MEM_MCP_TOKEN) with no default auto-grant. Bundled sub-skills (install, mem-search) declare no allowed-tools frontmatter of their own; the bundled agent-cost-report sub-skill's scope is evaluated under its own dedicated component.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

  "variables": {
    "type": "object",
    "properties": {
      "CLAUDE_MEM_MCP_URL": { "type": "string", "title": "Remote MCP URL", "description": "Leave empty for a local worker (stdio). Set to https://cmem.ai/api/mcp (or your server) for remote." },
      "CLAUDE_MEM_MCP_TOKEN": { "type": "string", "title": "Remote MCP token", "description": "Bearer token for remote MCP. Unused for local worker." }
    },
    "required": []
  }
}

Why it got this result

Codepoint-scanned every manifest/instruction file shipped by this component (mcp.json, .cursor-plugin/plugin.json, hooks/hooks.json, skills/install/SKILL.md, skills/agent-cost-report/SKILL.md, skills/mem-search/SKILL.md) for zero-width/bidi/Tag-block chars and found none. No forged chat-template tokens, ANSI/OSC escapes, HTML-comment concealment, or homoglyph substitutions were found; all prose is plain descriptive text about claude-mem setup for Cursor.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Cursor: local or remote worker,
  local host-login observer or remote cmem.ai inference.
---

Why it got this result

All model-facing instructions (SKILL.md files, plugin.json, mcp.json, hooks.json) ship inside the plugin bundle; the plugin itself has no self-updater or runtime fetch of its own manifest/instructions from a mutable endpoint. The remote MCP connection is a user-configured endpoint (CLAUDE_MEM_MCP_URL), not the plugin fetching its OWN instructions from a publisher-controlled source -- it is the declared tool-call data path, not the trust surface. No sync/self-mutation code was found within this component's own files (the sync.py self-copy mechanism belongs to the agent-cost-report sub-skill, evaluated as its own component).

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{
  "name": "claude-mem-cursor",
  "version": "13.39.0",
  ...
  "skills": "./skills/",
  "hooks": "./hooks/hooks.json",
  "mcpServers": "./mcp.json",
  ...
}

Why it got this result

Name 'claude-mem-cursor' is the project's own canonical name plus a plain IDE-target suffix ('cursor') -- not a near-miss/homoglyph of any other brand, no trust-implying prefix, no version/tier-spoofing suffix, and no impersonation prose. README explicitly states 'Does not install Grok Bot', clarifying scope rather than claiming to be another product.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

# claude-mem for Cursor

Install from the Cursor or Grok Bot plugin store as **claude-mem-cursor**. Does not install Grok Bot.

Why it got this result

The configuration supplies an explicit token to a declared memory service but does not itself demonstrate reading host credentials or hidden conversation data for exfiltration.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

{
  "version": 1,
  "hooks": {
    "beforeSubmitPrompt": [
      { "command": "npx -y claude-mem hook cursor session-init" },
      { "command": "npx -y claude-mem hook cursor context" }
    ],
    "afterMCPExecution": [
      { "command": "npx -y claude-mem hook cursor observation" }
    ],
    "afterShellExecution": [
      { "command": "npx -y claude-mem hook cursor observation" }
    ],
    "afterFileEdit": [
…

{
  "mcpServers": {
    "claude-mem-local": { "command": "npx", "args": ["-y", "claude-mem", "mcp"] },
    "claude-mem-remote": {
      "url": "https://cmem.ai/api/mcp",
      "headers": { "Authorization": "Bearer ${CLAUDE_MEM_MCP_TOKEN}" }
    }
  }
}

Why it got this result

README.md fully discloses the hook->cmem.ai HTTPS egress model, per-event behavior table, fail-soft guarantees, and privacy notes (16KB truncation, memory-tool exclusion). Code in cmem-hook.mjs implements exactly this: redacts secrets before any network send (SECRET_PATTERNS/KEYVALUE_RE/COOKIE_RE/URI_RE), strips <private> tags first, and is a no-op without an API key. No undisclosed capability found.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

// ---------- secret redaction ----------
// Observations are memory: keep the signal (paths, code, output) but strip
// anything secret-shaped BEFORE the envelope exists, so neither the ingest
const REDACTED = '[cmem-redacted]';
// single-pass linear regexes over capped input (FIELD_CAP/PROMPT_CAP).
const REDACTED = '[cmem-redacted]';
const SECRET_PATTERNS = [

Cowork sessions run in ephemeral cloud containers, so the local claude-mem
worker/SQLite model can't persist there. This plugin replaces the worker with
thin HTTPS shims: hooks capture tool use and stream raw fragments to cmem.ai,
where **Pro runs the worker and observer server-side**...

Why it got this result

mem-setup/mem-search SKILL.md and README explicitly instruct the OPPOSITE of suppression: 'Never echo the token back in conversation...or log it', masked status output, and explicit privacy notes. No instruction tells the agent to hide actions or bypass confirmation; the hook design's silent no-op (no API key) is a fail-soft safety default, not a disclosure-suppression directive aimed at hiding a privileged action from the user.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Secret handling — non-negotiable

- Never echo the token back in conversation, put it in a shell argv, or log it.
- Move it only via file writes (Write/Edit tool) and file reads.

Why it got this result

cmem-hook.mjs reads tool-use fragments and conversation context (this is its declared memory-capture function) and sends them to cmem.ai -- the plugin's own documented backend named in README/PRO-ENDPOINT-SPEC.md, not a third-party or attacker host. Before any send, clean() strips <private>/system-instruction/system-reminder tagged regions and redactSecrets() scrubs PEM keys, bearer/JWT tokens, cloud provider key patterns, cookie/authorization headers, and URI userinfo credentials. The API key itself comes only from user-supplied config/env, never harvested from host credential stores.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

const STRIP_TAGS_RE = /<(private|claude-mem-context|system_instruction|system-instruction|persisted-output|system-reminder)\b[^>]*>[\s\S]*?<\/\1>/g;
function clean(v, cap) {
  if (v == null) return v;
  const s = (typeof v === 'string' ? v : JSON.stringify(v)).replace(STRIP_TAGS_RE, '');
  const t = truncate(s, cap);
  return redactSecrets(typeof t === 'string' ? t : JSON.stringify(t));
}

Why it got this result

plugin.json declares no scope/OAuth block at all (credentials are per-user config.json values, not plugin-requested OAuth scopes); hooks.json binds only the specific lifecycle events needed for memory capture/injection, each pointing to the same narrowly-scoped script. No wildcard or catch-all capability grant found.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{
  "name": "claude-mem-cowork",
  "description": "Claude-Mem for Cowork: captures tool use via hooks, streams fragments to cmem.ai..."
}

Why it got this result

Codepoint-scan of all SKILL.md/README/manifest/config files in this component found no zero-width/bidi/Tag-block concealment, no forged chat-template tokens, no HTML-comment hidden text. Instruction bodies are purely descriptive and defer to disclosure/consent (e.g. mem-setup's secret-handling rules).

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: mem-search
description: >
  This skill should be used when the user asks to "search memory"...
---

Why it got this result

Manifest, hooks.json and SKILL.md ship inside the bundled package; config.json is user-editable per-user credential storage (declared, disclosed function via mem-setup), not a live-fetched instruction/manifest surface. No self-rewrite of SKILL.md/hooks.json/plugin.json by any bundled code was found.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{"name": "claude-mem-cowork", "version": "0.1.4", ...}

Why it got this result

Declared name 'claude-mem-cowork' correctly identifies it as the claude-mem integration for the 'Cowork' platform; author is 'CMEM, Inc.' and repository points to the genuine thedotmack/claude-mem repo. No near-miss of 'Cowork' or any other brand.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

"name": "claude-mem-cowork",
"version": "0.1.4",
"repository": "https://github.com/thedotmack/claude-mem"

Why it got this result

openclaw's SKILL.md fully documents all behavior implemented in src/index.ts: session init (before_agent_start/session_start), system-prompt context injection (before_prompt_build), tool-use observation recording (after_tool_call, POST to local worker), session summarization (agent_end), and an opt-in observation feed that forwards to a configured messaging channel (Telegram/Discord/Slack/Signal/WhatsApp/LINE) only when observationFeed.enabled is explicitly set. All outbound network calls target the user-configured localhost worker (127.0.0.1:37777 by default, user-overridable) or the explicitly-configured messaging channel/Telegram bot token the user supplies. No undisclosed credential harvesting, no hidden exec, no obfuscation.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

api.on("after_tool_call", (event, ctx) => {
  ...
  workerPostFireAndForget(workerPort, "/api/sessions/observations", {
    contentSessionId,
    tool_name: CAPTURE_TOOL_NAMES.get(toolName) ?? toolName,
    tool_input: toolInput,
    tool_response: toolResponseText,
    cwd: workspaceDir,
  }, api.logger);
});

### Observation recording
Every tool use (Read, Write, Bash, etc.) is sent to the claude-mem worker as an observation...
### Observation feed
A background service connects to the worker's SSE stream and forwards new_observation events to a configured messaging channel.

Why it got this result

SKILL.md is a setup/operations guide for a gateway plugin; it documents automatic (but disclosed) recording of tool-use observations and system-prompt context injection as the plugin's stated function, with explicit config toggles (syncMemoryFile, syncMemoryFileExclude) for the operator to control. No prose instructs the MODEL to hide a privileged action from the user or bypass a human-in-the-loop gate; all automation is operator-configured, disclosed infrastructure behavior, not an injected directive in the model's instruction context.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Have an agent do some work. The plugin automatically records observations through these OpenClaw events:
1. before_agent_start
2. before_prompt_build
3. after_tool_call
4. agent_end
All of this happens automatically. No additional configuration needed.

Why it got this result

openclaw's before_prompt_build hook does read a form of conversation context (the observation timeline) but routes it INTO the agent's own system prompt via appendSystemContext -- the data flow is inbound (worker -> agent context), not outbound exfiltration. The after_tool_call observation recorder does send tool input/response (which could contain sensitive material the user/agent handled) to the worker, but the worker is the plugin's own declared, user-configured backend (localhost:37777 or an operator-set host), not a third-party/attacker endpoint, and is the explicit documented purpose of the plugin ('Records observations from embedded runner sessions'). No code reads env vars, ~/.ssh, ~/.aws, or other credential dotfiles; no LLM endpoint/base-URL hijack is present.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

api.on("before_prompt_build", async (_event, ctx) => {
  if (!shouldInjectContext(ctx)) return;
  const contextText = await getContextForPrompt(ctx);
  if (contextText) {
    return { appendSystemContext: contextText };
  }
});

const contextText = await workerGetText(
  workerPort,
  `/api/context/inject?projects=${encodeURIComponent(cacheKey)}`,
  api.logger
);

Why it got this result

The openclaw.plugin.json configSchema is a tightly-enumerated, least-privilege set of config fields (syncMemoryFile, syncMemoryFileExclude, workerPort, workerHost, project, observationFeed.*) with additionalProperties:false -- no wildcard capability grant. The registerService/registerCommand/on() surface it uses is the host's documented per-event plugin API, not a broad OAuth/allowed-tools escalation.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

"configSchema": {
    "type": "object",
    "additionalProperties": false,
    "properties": {

Why it got this result

Full codepoint scan of SKILL.md (462 lines) found only ordinary emoji and em-dash characters (U+1F9E0 brain emoji, U+2014 em-dash etc.) -- no zero-width/bidi-override/Tag-block codepoints, no mixed-script confusables inside ASCII tokens, no forged chat-template tokens, no ANSI/OSC escapes. Content is a legitimate setup guide.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

# Claude-Mem OpenClaw Plugin — Setup Guide
This guide walks through setting up the claude-mem plugin on an OpenClaw gateway...

Why it got this result

The documented curl|bash install command and the separate --upgrade command are explicit operator-run bootstrap and upgrade actions, not a silent runtime live-fetch or automatic mutation of the plugin's own model-facing trust surface after approval. Reproduction confirms both commands are documentation-driven and require explicit user invocation, with no automatic update path present.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

```bash
curl -fsSL https://install.cmem.ai/openclaw.sh | bash
```

To upgrade an existing installation (preserves settings, updates plugin):
```bash
curl -fsSL https://install.cmem.ai/openclaw.sh | bash -s -- --upgrade
```

Why it got this result

Plugin id/name 'claude-mem' / 'Claude-Mem (Persistent Memory)' matches the project's own canonical name and repo; author field is 'thedotmack', the genuine repo owner. No near-miss or trust-implying prefix.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "id": "claude-mem",
  "name": "Claude-Mem (Persistent Memory)",
  ...
  "author": "thedotmack",
  "homepage": "https://claude-mem.ai",

Why it got this result

plugin/.qoder-plugin is a pure declarative manifest (plugin.json) describing name/version/license/author and pointing at ./skills/, ./qoder.mcp.json, and ./hooks/qoder-hooks.json. No executable code lives inside this component's own directory. The manifest's declared purpose ('Persistent memory and context compression for Qoder sessions') matches its referenced artifacts.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Persistent memory and context compression for Qoder sessions.",
  "author": {"name": "Alex Newman", "url": "https://github.com/thedotmack"},
  "homepage": "https://github.com/thedotmack/claude-mem#readme",
  "repository": "https://github.com/thedotmack/claude-mem",
  "license": "Apache-2.0",
  "skills": "./skills/",
  "mcpServers": "./qoder.mcp.json",
  "hooks": "./hooks/qoder-hooks.json"
}

Why it got this result

The manifest's hooks registration includes a UserPromptSubmit hook whose launcher forwards inherited stdio into the local memory worker, placing host conversation context in scope for this component. The destination of that context is the plugin's own declared local memory system, not a third-party or attacker-controlled channel, so no credential or conversation-context exfiltration occurs.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

{"name": "claude-mem", "skills": "./skills/", "mcpServers": "./qoder.mcp.json", "hooks": "./hooks/qoder-hooks.json"}

Why it got this result

Manifest declares only skills/mcpServers/hooks pointers scoped to the memory/context function; no wildcard or catch-all capability grant.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{"name": "claude-mem", "skills": "./skills/", "mcpServers": "./qoder.mcp.json", "hooks": "./hooks/qoder-hooks.json"}

Why it got this result

No concealment codepoints found in plugin.json.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

{"name": "claude-mem", "description": "Persistent memory and context compression for Qoder sessions.", ...}

Why it got this result

Manifest and referenced hooks/skills ship inside the pinned repo tree at this commit; no runtime fetch of the plugin's own manifest/instructions from a mutable endpoint.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{"name": "claude-mem", "skills": "./skills/", "mcpServers": "./qoder.mcp.json", "hooks": "./hooks/qoder-hooks.json"}

Why it got this result

Name/author/repository fields match the genuine project identity (Alex Newman / thedotmack / github.com/thedotmack/claude-mem).

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

"name": "claude-mem",
  "version": "13.39.0",
  "author": {"name": "Alex Newman", "url": "https://github.com/thedotmack"},
  "repository": "https://github.com/thedotmack/claude-mem",

Why it got this result

The manifest's description field is neutral prose with no model-directed imperative, self-authorization language, disclosure-suppression instruction, or directive to bypass human approval. The component's executable hook registrations are structural capabilities addressed by the format-native execution rule rather than consent-suppressing instruction text, so this prose-consent rule has no applicable subject matter here.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Persistent memory and context compression for Qoder sessions.",
  ...
  "hooks": "./hooks/qoder-hooks.json"
}

Why it got this result

version-bump's frontmatter description explicitly discloses that the workflow 'Ends with the agent running npm publish itself using the maintainer's npm token.' The body details reading the token from ~/.npmrc, running npm whoami/npm publish, and a Discord notification step. All of this is declared up front in the manifest description, not a hidden/shadow capability -- a reviewer reading the one-line description already knows the skill self-publishes with a real credential. (The wisdom of granting an agent unsupervised publish authority is evaluated separately under ATR-P0002/ATR-P0005.)

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: version-bump
description: Automated semantic versioning and release workflow for Claude Code plugins. Handles version increments across package.json, marketplace.json, plugin.json manifests, build verification, git tagging, GitHub releases, and changelog generation. Ends with the agent running npm publish itself using the maintainer's npm token.
---

Why it got this result

The workflow uses npm's standard authenticated client to read ~/.npmrc and publish via the configured registry, and separately runs a maintainer-configured Discord notifier from its own directory. Neither step reads credential bytes into a payload that is transmitted elsewhere; the token is consumed by npm's own authentication mechanism in place, and the notifier reads its own webhook config to post the release announcement. No harvest-plus-exfiltration data flow is present.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

The token is a **30-day** granular npm token (read/write on `claude-mem` only, bypass 2FA)
    in the maintainer's Mac `~/.npmrc`; he issues a new one every month...
    npm whoami                    # must print thedotmack; 401 = token expired
    npm publish --access public   # prepublishOnly rebuilds the package

Then run the
    Discord notification from `~/Scripts/claude-mem/`, where the `.env` with
    webhook details lives:
    ```bash
    cd ~/Scripts/claude-mem/ && npm run discord:notify vX.Y.Z
    ```

Why it got this result

version-bump ships one bundled script (scripts/generate_changelog.js), a small, side-effect-free stdin->stdout formatter with no exec/network capability of its own. The skill's prose directs in-band shell commands (git, npm) through the host's normal tool-call flow; there is no load-time execution, no lifecycle/event hook shipped by this component, no env var hijack (GIT_EXTERNAL_DIFF/NODE_OPTIONS/LD_PRELOAD), and no LLM endpoint/base-URL substitution.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

#!/usr/bin/env node
const fs = require('fs');
function generate() {
  try {
    const input = fs.readFileSync(0, 'utf8');
    ...
    const releases = JSON.parse(input);

Why it got this result

The skill's frontmatter declares no allowed-tools enumeration, wildcard permission, OAuth scope, or other capability grant at all, so there is no self-declared manifest scope that is over-broad relative to actual behavior. The release and publish commands described in the instruction body are intrinsic to the skill's own stated publish function rather than an undeclared capability class.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: version-bump
description: Automated semantic versioning and release workflow for Claude Code plugins. Handles version increments across package.json, marketplace.json, plugin.json manifests, build verification, git tagging, GitHub releases, and changelog generation. Ends with the agent running npm publish itself using the maintainer's npm token.
---

git worktree add --detach .scratch/release-X.Y.Z vX.Y.Z
cd .scratch/release-X.Y.Z && npm install --ignore-scripts
npm whoami                    # must print thedotmack; 401 = token expired
npm publish --access public   # prepublishOnly rebuilds the package

Why it got this result

Full codepoint scan of SKILL.md and generate_changelog.js found no zero-width/bidi/Tag-block codepoints, no confusables, no forged chat-template tokens, and no ANSI/OSC escapes. The YARA scanner's Consent_Suppression match at L72-L73 (the npm-token handling section) is a genuine directive readable in plaintext, not a concealed/obfuscated one -- it is addressed separately under ATR-P0002, which is the correct rule for its open-prose consent-bypass content; no concealment mechanism (this rule's actual focus) is present.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

there. Never ask for the token in chat. Re-run `npm whoami`, then publish.
    Do not wait on `.github/workflows/npm-publish.yml` — its `NPM_TOKEN` secret
    has failed every tag since v13.26.1

Why it got this result

SKILL.md and its bundled generate_changelog.js ship inside the pinned repo; the skill's own instructions are not live-fetched from a mutable endpoint at runtime, and there is no self-updater or covert self-mutation of the skill's own manifest/instruction body. (The npm-publish authority-escalation concern is a separate ATR-P0002/ATR-P0005 finding, not a rug-pull of this artifact's own trust surface.)

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: version-bump
---

Why it got this result

Name 'version-bump' is a generic descriptive name, no brand resemblance; publishes under the legitimate 'claude-mem' npm package / thedotmack identity.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: version-bump

Why it got this result

Repo-wide review of all shipped skill/plugin manifests (SKILL.md files, plugin.json manifests across claude-code/codex/cursor/qoder/grok variants) found that every bundled capability (worker HTTP calls, SQLite storage, documented PostHog telemetry, cmem.ai Pro sync) maps to the declared memory-persistence purpose. No hidden credential harvesting, undeclared subprocess/exec capability, or obfuscated payload was found at the repo level.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

# claude-mem
Memory compression system for Claude Code - persist context across sessions

Why it got this result

The repo-level README contains only product identity information and no consent-suppression directive. The version-bump skill's 'never ask for the token in chat' instruction is secret-hygiene guidance that keeps the npm publish token out of captured chat; it does not direct the agent to bypass approval, suppress disclosure, or self-authorize publishing, so the publishing workflow remains fully visible.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

# claude-mem

Memory compression system for Claude Code - persist context across sessions.

Why it got this result

Repo-level review of all shipped skill/plugin artifacts found no instruction body directing the agent to read ambient host credential stores (~/.ssh, ~/.aws, cloud metadata) and exfiltrate them to an undisclosed third party. The one credential-handling flow in the repo (cmem.ai Pro sync token) is handled with explicit never-log/never-echo/never-argv discipline, written only to local disk with 0600 perms, and telemetry is whitelisted/scrubbed and publicly documented.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

Claude-mem includes anonymous usage analytics (via PostHog) to help prioritize fixes and features.

**It is on by default (opt-out).** Events are anonymous, identified only by a random install UUID, and every analytics property passes a strict whitelist...

```bash
npx claude-mem telemetry disable
```

Why it got this result

The root-level documentation (CLAUDE.md) describes only the plugin's own declared build, sync, and restart behavior; it contains no executable hook, entrypoint, or host-control primitive that this rule targets, so no attacker-controlled endpoint substitution, env-exec hijack, or covert directive persistence exists at the repo level.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

# Claude-Mem: AI Development Instructions

Claude-mem is a Claude Code plugin providing persistent memory across sessions. It captures tool usage, compresses observations using the Claude Agent SDK, and injects relevant context into future sessions.

Why it got this result

Repo-wide review of all plugin manifests (claude-plugin, codex-plugin, cursor-plugin, qoder-plugin, grok-plugin) found no wildcard/catch-all permission grant and no undeclared scope widening across versions; each sub-plugin's manifest declares only the hooks/skills/mcpServers relevant to its own platform.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{
  "name": "thedotmack",
  "owner": {
    "name": "Alex Newman"
    {"name": "claude-mem", "version": "13.39.0", "source": "./plugin", ...},
    {"name": "claude-mem-cowork", "version": "0.1.4", "source": "./cowork", ...}
    "description": "Plugins by Alex Newman (thedotmack)"
  },

Why it got this result

Repo-wide codepoint scan of the SKILL.md files and manifests in scope found no zero-width/bidi-override/Tag-block concealment codepoints, no mixed-script homoglyphs inside ASCII tokens, and no forged chat-template role tokens. The YARA agentic_metadata hit on openclaw/SKILL.md was manually reviewed: that range is plain prose describing OpenClaw gateway events and troubleshooting steps with only standard em-dash/arrow Unicode punctuation, not concealment codepoints or a host-directed imperative overriding instructions.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

1. **`before_agent_start`** — Initializes a claude-mem session when the agent starts
2. **`before_prompt_build`** — Injects the observation timeline into the agent's system prompt (cached for 60s)
3. **`after_tool_call`** — Records each tool use (Read, Write, Bash, etc.) as an observation
4. **`agent_end`** — Summarizes the session and marks it complete
...
1. Enable Developer Mode in Discord: Settings → Advanced → Developer Mode
2. Right-click the target channel → Copy Channel ID

Why it got this result

Repo-wide, all manifests ship inside the versioned package with semver bumps tracked via the version-bump release workflow (git tag + GitHub release + CHANGELOG). No evidence any shipped skill/plugin instruction body or manifest is live-fetched from a publisher-mutable endpoint at runtime or self-mutates post-approval.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Memory compression system for Claude Code - persist context across sessions"

Why it got this result

Repo-wide, all shipped artifact names (claude-mem, claude-mem-cursor, claude-mem-grok-bot, claude-mem-cowork, and all sub-skill names) are consistent, honestly-descriptive names published by the verified repo origin (git remote origin = github.com/thedotmack/claude-mem). No near-miss typosquat of a well-known tool/provider/registry name, no homoglyph substitution, no trust-implying prefix, no unverified fork/official claims.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Memory compression system for Claude Code - persist context across sessions"

Why it got this result

The .grok-plugin component is a pure declarative manifest (plugin.json) pointing at skills and an mcpServers config file. It contains no bundled executable code, no network clients, no credential reads, and no exec/eval surfaces of its own. Its declared purpose ('Persistent memory for coding agents') matches its only artifact: pointers to the skills dir and mcp.json.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Persistent memory for coding agents. Cursor and Grok Bot install independently; worker and observer can be local or remote.",
  "homepage": "https://github.com/thedotmack/claude-mem",
  "skills": "./claude-mem-grok-bot/skills/",
  "mcpServers": "./claude-mem-grok-bot/mcp.json",
  "keywords": ["claude-mem", "cmem", "grok-bot"],
  "category": "Productivity"
}

Why it got this result

Manifest declares only a skills pointer and mcpServers pointer; no allowed-tools wildcard, no OAuth scope, no capability escalation.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{"name": "claude-mem", "skills": "./claude-mem-grok-bot/skills/", "mcpServers": "./claude-mem-grok-bot/mcp.json"}

Why it got this result

Codepoint scan of plugin.json found no zero-width/bidi-override/Tag-block characters, no mixed-script confusables, no forged chat-template tokens, and no ANSI/OSC escapes. Content is purely descriptive 7-bit ASCII/UTF-8 JSON.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

{"name": "claude-mem", "version": "13.39.0", "description": "Persistent memory for coding agents..."}

Why it got this result

Manifest ships inside the bundled/pinned repo (version 13.39.0 pinned at this commit); no runtime fetch of its own manifest/scope from a publisher-mutable endpoint, no self-updater, no covert self-mutation logic present in this component.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{"name": "claude-mem", "version": "13.39.0", ...}

Why it got this result

Name 'claude-mem' is the project's own canonical name; repo_url (github.com/thedotmack/claude-mem) is the genuine owner. No near-miss/homoglyph/trust-prefix/version-spoofing naming pattern.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

"name": "claude-mem",
  "version": "13.39.0",
  "description": "Persistent memory for coding agents...",
  "homepage": "https://github.com/thedotmack/claude-mem",

Why it got this result

The file is a declarative plugin manifest with only neutral metadata and no model-directed instruction body.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

{
  "name": "claude-mem",
  "version": "13.39.0",
  "description": "Persistent memory for coding agents...",
  "skills": "./claude-mem-grok-bot/skills/",
  "mcpServers": "./claude-mem-grok-bot/mcp.json"
}

Why it got this result

This manifest only references plugin resources and contains no credential or conversation-memory harvesting behavior.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

{"name": "claude-mem", "skills": "./claude-mem-grok-bot/skills/", "mcpServers": "./claude-mem-grok-bot/mcp.json"}

Why it got this result

The manifest only references unshipped relative resources and contains no command, executable hook, or endpoint substitution.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

{"name": "claude-mem", "skills": "./claude-mem-grok-bot/skills/", "mcpServers": "./claude-mem-grok-bot/mcp.json"}

Why it got this result

SKILL.md declares the full capability surface: Bash/Read/Write/AskUserQuestion plus mem-search MCP tools, with a clearly documented pipeline (transcripts -> tokens -> dollars -> report) and explicit, named external calls: OpenRouter list-price fetch (acr/prices.py), optional OpenRouter measured-spend fetch gated on OPENROUTER_API_KEY (acr/measure.py), optional classifier calls to OpenRouter also gated on OPENROUTER_API_KEY and a hard $2 cap (acr/classify.py), read-only gh pr view/gh pr list calls (acr/wins.py), and a headless-Chrome subprocess for PDF rendering (acr/render.py). All network and subprocess capability maps 1:1 to the declared purpose; no undisclosed exec/network/credential-read capability was found.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
  - mcp__plugin_claude-mem_mcp-search__get_observations
---

def run(candidates, rate, model=DEFAULT_MODEL, cap_usd=CAP_USD, key=None, call=_call, seed=0):
    key = key if key is not None else os.environ.get("OPENROUTER_API_KEY")
    if not key: raise ClassifierError("OPENROUTER_API_KEY is not set (regular inference key, G5); classifier not run")

Why it got this result

SKILL.md explicitly requires explicit human go ('needs Alex's go', 'needs Alex's explicit go') before merge-to-main/npm publish/version-bump, device export merges, and classifier use; it directs AskUserQuestion before any tzdata pip install. No prose instructs the agent to skip confirmation, hide actions from the user, or assert authority over the host system prompt.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Each of these needs Alex's explicit go; the report shows the honest fallback until then.
- **OpenRouter key (needs Alex)** ...
- **Mac transcripts (needs Alex)** ...
- **Merge to main, npm publish, `/version-bump`** — each needs Alex's separate go.

Why it got this result

The only credential read is OPENROUTER_API_KEY, explicitly documented in SKILL.md ('never read from a settings file, never printed or written to any output') and used solely to call the OpenRouter API it is scoped for (acr/measure.py, acr/classify.py). No reads of ~/.ssh, ~/.aws, .netrc, other provider API keys, or conversation/system-prompt dumping were found; grep of the scripts directory shows no other env/credential access.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

def fetch(key, url=URL, opener=urllib.request.urlopen, timeout=30):
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}"})
...
def measure(outdir, env=None, opener=urllib.request.urlopen, now=None, url=URL):
    env = os.environ if env is None else env
    key = env.get(ENV)

Why it got this result

The skill ships a bundled Python script pipeline (scripts/acr.py and acr/*.py) invoked only via the model's normal Bash tool call after reasoning (per the Recipe section) -- no load-time execution, no lifecycle hook (no PreToolUse/PostToolUse, no activationEvents), no PATH/bin shadowing, and no exec-enabling or endpoint-substituting env assignment (LD_PRELOAD/NODE_OPTIONS/GIT_EXTERNAL_DIFF, etc.). The headless-Chrome subprocess (render.py) runs only when the agent explicitly calls acr.py pdf as a declared step.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=err)
...
except subprocess.TimeoutExpired: proc.kill(); proc.wait()

Why it got this result

allowed-tools enumerates a specific, least-privilege set (Bash, Read, Write, AskUserQuestion, and three named mem-search MCP tools) rather than a wildcard. Bash is justified by the documented Python pipeline; Write is justified by the documented report/CSV/JSON output files. No OAuth scopes, no filesystem-delete, no broader network/admin grant requested.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
  - mcp__plugin_claude-mem_mcp-search__get_observations

Why it got this result

Codepoint scan of SKILL.md found no zero-width, bidi-override, or Tag-block characters, no mixed-script homoglyph substitutions, no forged chat-template tokens, and no ANSI/OSC escapes. All prose is purely descriptive of the pipeline's own function; no imperative directed at the host model to read/transmit data outside the declared scope.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

Codepoint scan over the full file found em-dashes (U+2014) and ellipses (U+2026) only -- no zero-width/bidi/Tag-block codepoints (U+200B-200D/2060/FEFF, U+202A-202E, U+2066-2069, U+E0000-E007F) were present.

Why it got this result

The skill's instructions and scripts ship entirely inside the bundled plugin directory (no runtime fetch of SKILL.md or the scripts from a remote/mutable endpoint). A CHECKSUMS.txt (sha256sum-compatible) accompanies the skill, and scripts/acr/sync.py's sync-check compares SKILL.md/CHECKSUMS.txt/scripts against mirror copies and exits 1 on drift -- this is a one-way, explicitly-invoked (--write) copy from the plugin source of truth to mirrors, not a self-mutating or silently-auto-updating artifact. No post-approval self-mutation of the on-disk manifest was found.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

40b6e0045dbe7343d649bfddc313afc7f11f3ee5b44036ddebc73832635f0a8c  SKILL.md
355d152df9cb889dc9b81544341e7ac52032016c0106f67aae42176ef8ab5b1e  scripts/acr.py
...

Why it got this result

The skill's declared name 'Agent Cost Report' / slug agent-cost-report is a plain descriptive name, not a near-miss, homoglyph, or trust-implying/version-spoofing variant of any well-known tool, provider, or registry name. No impersonation prose claiming to be an 'official'/updated version of another named tool was found.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: Agent Cost Report
description: >-
  Believable agent cost report for any period...

Why it got this result

SKILL.md declares installing claude-mem for Cursor (local/remote worker, local or remote observer). The only actions described are npx claude-mem install --ide cursor [...] invocations and setting a documented plugin variable (CLAUDE_MEM_MCP_TOKEN). No undeclared network egress, credential read, or exec capability beyond what is openly described (npx install flow, local loopback worker). All host contact (cmem.ai, localhost worker) is disclosed and matches the stated purpose.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Cursor: local or remote worker,
  local host-login observer or remote cmem.ai inference.
---
# Install claude-mem on Cursor

Independent of Grok Bot. Do not require the other IDE.

## Local worker (default)

```
npx claude-mem install --ide cursor
…

Why it got this result

No prose in this skill instructs the agent to skip confirmation, hide actions from the user, or assert authority over the host system prompt. It is purely descriptive of install commands and provider options.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

---
name: claude-mem-install
description: Use this when setting up claude-mem on Cursor...
  Use this when setting up claude-mem on Cursor: local or remote worker,
  local host-login observer or remote cmem.ai inference.
---

Why it got this result

This SKILL.md carries no allowed-tools frontmatter restriction (inherits host defaults) but its described actions are limited to running the documented npx installer and setting one documented plugin variable -- no wildcard/catch-all declared grant, no bundled executable, and no install-lifecycle hook shipped with the artifact itself.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Cursor: local or remote worker,
  local host-login observer or remote cmem.ai inference.
---

Why it got this result

Codepoint scan found no zero-width/bidi-override/Tag-block characters, no mixed-script homoglyphs inside ASCII tokens, no forged chat-template tokens, and no HTML-comment/CSS-hidden concealment. All text is purely descriptive 7-bit-ASCII-plus-em-dash prose with no host-directed imperative masquerading as description.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Cursor: local or remote worker,
  local host-login observer or remote cmem.ai inference.
---
# Install claude-mem on Cursor

Why it got this result

SKILL.md ships inside the pinned npm/marketplace package; no runtime fetch of the artifact's own instructions, no self-updater, and no silent auto-update of scope was found.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Cursor...
---

Why it got this result

Skill name claude-mem-install declared in this skill's own SKILL.md frontmatter is canonical and honestly self-identified, matching the containing plugin's own documented purpose. No near-miss of a third-party brand, no trust-implying prefix, no version/tier-spoofing suffix.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Cursor: local or remote worker,
  local host-login observer or remote cmem.ai inference.
---

Why it got this result

The installation instructions mention a user-configured token but do not direct harvesting credentials or conversation memory, so no harvest step exists for this rule's harvest-plus-exfiltration pattern to apply.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

npx claude-mem install --ide cursor
...
Set plugin variable `CLAUDE_MEM_MCP_TOKEN` for `claude-mem-remote`

Why it got this result

This component is instruction-only Markdown and ships no executable, hook, or load-time carrier of its own, so no format-native execution primitive exists in this artifact to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: claude-mem-install
description: Use this when setting up claude-mem on Cursor...
  Use this when setting up claude-mem on Cursor: local or remote worker,
  local host-login observer or remote cmem.ai inference.
---

Why it got this result

mem-search is a pure prose instruction set directing the model to call four already-registered memory tools (search/timeline/get_observations/get_tool_uses) in a progressive-disclosure order. No bundled code, no network clients, no credential/env reads beyond the declared memory domain. Behavior matches the declared description exactly.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: mem-search
description: >-
  Use this when the user asks to search memory...
  "how did we do X last time?", or wants work from previous sessions.
---
# mem-search

3. `get_observations(ids=[...])` — full details for those IDs only
4. `get_tool_uses(ids=[...])` — the ORIGINAL tool_input/tool_response
...

Why it got this result

The instruction body is scoped strictly to a progressive memory-search workflow (search -> timeline -> get_observations -> get_tool_uses). No language directs the agent to skip confirmation, hide an action from the user, or assert authority over host rules.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Layered workflow. Do not dump full observations until IDs are filtered...

1. `search(query)` — index with IDs
3. get_observations(ids=[...])
4. get_tool_uses(ids=[...])
4. `get_tool_uses(ids=[...])` — the ORIGINAL `tool_input` / `tool_response` for specific tool calls. Last resort: these are unsummarized and can run to thousands of tokens each.

Why it got this result

The skill retrieves prior observations and original tool inputs/responses (get_observations, get_tool_uses), which are reads of previously stored memory/context data rather than host credential stores or live conversation context. There is no outbound channel beyond the memory tool contract itself, so this host-memory read is secure rather than out of scope for the rule.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

1. search(query)
2. timeline(anchor=ID)
3. get_observations(ids=[...])
4. get_tool_uses(ids=[...])

Why it got this result

No allowed-tools frontmatter at all (unscoped by omission rather than wildcard); the skill only references the four narrow, purpose-built memory tools it describes, no shell/network/filesystem capability class requested.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: mem-search
description: >-
  Use this when the user asks to search memory...
---

Why it got this result

No concealment codepoints, confusables, forged chat tokens, or ANSI escapes found in a full codepoint scan of the SKILL.md. Content is purely descriptive prose.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: mem-search
description: >-
  Use this when the user asks to search memory...
---

Why it got this result

SKILL.md ships inside the pinned repo tree; no runtime instruction fetch from a mutable endpoint, no auto-update/hot-reload logic in this component.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: mem-search
description: >-
  Use this when the user asks to search memory, "did we already solve this?",
  "how did we do X last time?", or wants work from previous sessions.
...

Why it got this result

Skill name 'mem-search' is a generic, descriptive name with no resemblance to a known brand/tool.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: mem-search

Why it got this result

The component is prose invoking already-registered tools and, optionally, another install skill; it ships no script, hook, executable, config rewrite, or load-time execution primitive of its own.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

1. search(query)
2. timeline(anchor=ID)
3. get_observations(ids=[...])
4. get_tool_uses(ids=[...])

Why it got this result

README and SKILL.md files for install/mem-search/host-observer/agent-cost-report disclose exactly what the plugin does: local worker + remote MCP memory, OpenRouter-based observer when --provider host is chosen, and an explicit opt-in warning ('--provider host is an explicit local loopback-shim opt-in'). Declared network endpoints (cmem.ai, OpenRouter) match code behavior; no hidden credential harvesting beyond the documented CLAUDE_MEM_MCP_TOKEN bearer auth.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

# claude-mem for Grok Bot

Install from the Grok Bot or Cursor plugin store as **claude-mem-grok-bot**. Does not install Cursor.

Grok Bot has no hooks. After install: `npx claude-mem install --ide grok-bot` for a local worker plus CMEM Pro observer. `--provider host` is an explicit local loopback-shim opt-in. Set `CLAUDE_MEM_MCP_TOKEN` for remote MCP.

Why it got this result

Reviewed all SKILL.md bodies (install, mem-search, host-observer, agent-cost-report) and README.md: no prose instructs the agent to skip confirmation, hide privileged actions from the user, or assert authority over the host. 'host-observer' SKILL.md explicitly constrains the model's reply format (skip_summary/observation XML only) but this is output-format discipline, not consent suppression.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Write only `outbox/{id}.txt` for inbox jobs, or return the XML as the chat-completions body.
**Idle / init / no tool results:** `<skip_summary reason="noise" />`
**Finished searchable unit:** one `<observation>`...

Why it got this result

The component does read conversation/session context (observations, tool-use history) and routes it to a configured MCP server (local stdio, or remote cmem.ai with explicit CLAUDE_MEM_MCP_TOKEN bearer auth declared as a plugin variable). This is the component's disclosed core function (persistent memory), the destination is the plugin's own documented backend, and no host credential store (~/.ssh, ~/.aws, keychain) is read. The token itself is user-supplied via an explicit plugin variable, not harvested from the environment.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

{"mcpServers": {"claude-mem-local": {"command": "npx", "args": ["-y", "claude-mem", "mcp"]}, "claude-mem-remote": {"url": "https://cmem.ai/api/mcp", "headers": {"Authorization": "Bearer ${CLAUDE_MEM_MCP_TOKEN}"}}}}

Why it got this result

The .cursor-plugin/plugin.json declares only two user-supplied string variables (CLAUDE_MEM_MCP_URL, CLAUDE_MEM_MCP_TOKEN) and references skills/mcpServers narrowly scoped to memory search/install. No wildcard allowed-tools or broad OAuth scope. The agent-cost-report SKILL.md allowed-tools list (Bash, Read, Write, AskUserQuestion, 3 named mcp search tools) is an enumerated, narrow set matching its stated cost-report function -- not a wildcard.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
  - mcp__plugin_claude-mem_mcp-search__get_observations

Why it got this result

Codepoint-scanned all SKILL.md/README/manifest files in this component for zero-width/bidi-override/Tag-block characters and mixed-script confusables: only ordinary typographic em-dashes/ellipses (U+2014/U+2026) were found, no concealment codepoints. No forged chat-template tokens, HTML-comment concealment, or ANSI escapes present. All instruction text is purely descriptive of the plugin's own function.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: host-observer
description: >-
  Use this when fulfilling claude-mem observer jobs on Grok Bot: reply only
  skip_summary or one full observation XML, never prose.
---

Why it got this result

SKILL.md instruction bodies and manifest ship inside the pinned package; no runtime fetch of the artifact's own instructions from a publisher-mutable endpoint, and no self-mutation of its on-disk manifest/instruction files observed.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{"name": "claude-mem-grok-bot", "version": "13.39.0", "skills": "./skills/", "mcpServers": "./mcp.json"}

Why it got this result

Declared name 'claude-mem-grok-bot' is a legitimate platform-variant naming of the genuine 'claude-mem' project by its own publisher (thedotmack), not a typosquat of 'Grok'/'xAI'/'Cursor'. Repository/homepage fields point to the real upstream repo.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

"name": "claude-mem-grok-bot",
"version": "13.39.0",
"homepage": "https://github.com/thedotmack/claude-mem",
"repository": "https://github.com/thedotmack/claude-mem"

Why it got this result

This platform variant has no hooks and exposes installation and MCP operations only through invoked flows, rather than through a format-native lifecycle primitive.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

Grok Bot has no hooks. After install: `npx claude-mem install --ide grok-bot` for a local worker plus CMEM Pro observer. `--provider host` is an explicit local loopback-shim opt-in.

Why it got this result

Declared purpose (SKILL.md) is reading local Claude Code/Codex transcript JSONL files (~/.claude/projects, ~/.codex/sessions) plus the claude-mem SQLite DB (read-only via sqlite3 backup API) to build a cost/failure report, with optional OpenRouter price-list and spend lookups. Verified each capability maps to the declared purpose: (1) transcripts.py reads only ~/.claude/projects/**/*.jsonl and ~/.codex/sessions/**/*.jsonl, which IS the stated token-measurement source; (2) snapshot.py opens the claude-mem DB read-only (mode=ro) and never writes to the live DB; (3) classify.py / measure.py / prices.py only call the OpenRouter API using an explicit, user-supplied OPENROUTER_API_KEY read from the environment -- exactly the disclosed, opt-in classifier/measurement feature (SKILL.md states 'uses only a regular inference OPENROUTER_API_KEY' and 'never read from a settings file, never printed or written to any output'); (4) excerpts sent to the classifier are redacted via behavior.scrub() (regex strips sk-/ghp_/xox/AKIA/Bearer tokens and key=value secret patterns) before leaving the machine; (5) wins.py only runs read-only git remote get-url origin and gh pr view/list (no gh auth/token harvesting, no writes); (6) sync.py copies the skill's own files to a documented, disclosed set of destinations (the house copy and the 4 mirror plugin dirs named in SKILL.md's 'Keeping copies in sync' section) -- not a hidden write. No bundled capability exceeds the declared purpose and no concealment (obfuscation, remote payload exec) signal is present.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

def run(candidates, rate, model=DEFAULT_MODEL, cap_usd=CAP_USD, key=None, call=_call, seed=0):
    """candidates: [{id, kind, text, before, after}]. Returns (labels {id: {...}}, summary).
    Prints the estimate first; over the cap it classifies a stratified random sample and scales up."""
    key = key if key is not None else os.environ.get("OPENROUTER_API_KEY")
    if not key: raise ClassifierError("OPENROUTER_API_KEY is not set (regular inference key, G5); classifier not run")
    if not rate: raise ClassifierError(f"no list price for {model}; classifier not run")

def scrub(text, n=EXCERPT_CHARS):
    """Excerpts: at most 160 chars after the secret scrubber (plan 2B.1)."""
    t = KV_SECRET_RE.sub(lambda m: f"{m.group(1)}{m.group(2)}[redacted]", (text or "").replace("\n", " ").strip())
    t = SECRET_RE.sub("[redacted]", t)
    return t[:n]

    # copied from /workspace/weekly-cost-workflow/weekly_report.py:17
    # src = sqlite3.connect(f"file:{LIVE}?mode=ro", uri=True); dst = sqlite3.connect(SNAP); src.backup(dst); dst.close(); src.close()
    src = sqlite3.connect(f"file:{live}?mode=ro", uri=True)
    try:

Why it got this result

No consent-suppression prose. The skill explicitly gates several steps behind 'needs Alex's explicit go' (operator approval) -- e.g. installing tzdata, the Mac device export, merging to main / npm publish -- and the OpenRouter classifier/measure steps require an explicit environment variable the operator supplies, never read from a settings file or silently assumed.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Gaps and gates

Each of these needs Alex's explicit go; the report shows the honest fallback until then.

- **OpenRouter key (needs Alex)** — a regular inference `OPENROUTER_API_KEY` supplied as an environment variable through the house's secure secret flow; never a management or provisioning key, never read from a settings file, never printed or written to any output. ...
- **Mac transcripts (needs Alex)** — sessions from Alex's Mac have no transcript on the box, so their cost is EXTRAPOLATED (low confidence) until a device export is merged. ...

Why it got this result

This skill DOES read conversation-context material -- Claude Code/Codex transcript JSONL files (assistant replies, tool inputs/outputs) -- and, when the opt-in --classify flag is used, sends short excerpts of flagged turns to the OpenRouter chat-completions API (a third-party host) for classification. This is a harvest+exfil pair, but it is heavily mitigated: (1) the destination (OpenRouter) is the artifact's own declared, documented backend for this feature, named explicitly in SKILL.md; (2) every excerpt passes through behavior.scrub() first, which regex-redacts API-key-shaped strings (sk-, ghp_, gho_, xox[abp]-, AKIA, Bearer tokens, 32+ char opaque strings) and key=value secret patterns (password/token/api_key/credentials/etc) before transmission; (3) the feature is OFF by default, requires an explicit --classify flag and an explicit OPENROUTER_API_KEY the operator supplies (never read from a settings file); (4) spend is hard-capped at $2.00/run and reported separately; (5) the measure-openrouter / prices features only fetch/report price and usage data, never conversation content. This is the rule's negative-indicator pattern (declared destination, redacted payload, opt-in, capped) rather than the positive pattern (unredacted harvest to an undisclosed host).

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

SECRET_RE = re.compile(r"(sk-or-[\w-]+|sk-[\w-]{8,}|Bearer\s+\S+|ghp_\w+|gho_\w+|xox[abp]-[\w-]+|AKIA\w{12,}|[A-Za-z0-9+/=_-]{32,})")
KV_SECRET_RE = re.compile(r"\b(pass(?:word|wd|phrase|code)?|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|auth|credentials?)\b(\s*[:=]\s*)[\"']?[^\s\"',;]+[\"']?", re.I)


def scrub(text, n=EXCERPT_CHARS):
    """Excerpts: at most 160 chars after the secret scrubber (plan 2B.1)."""
    t = KV_SECRET_RE.sub(lambda m: f"{m.group(1)}{m.group(2)}[redacted]", (text or "").replace("\n", " ").strip())
    t = SECRET_RE.sub("[redacted]", t)
    return t[:n]

"""Optional cheap classifier pass (plan 2B.4; G5 and G8 settled): OFF by default, enabled per run with
--classify, hard cap $2.00 per run, regular inference OPENROUTER_API_KEY only (never a management key,
never read from a settings file). It only sees candidates the heuristics could not settle. Its own
spend is reported separately ("classifier cost (separate)") and never added to agent cost.

Run path: OpenRouter chat completions (OpenAI-compatible, https://openrouter.ai/docs/api-reference/chat-completion),
candidates: [{id, kind, text, before, after}]. Returns (labels {id: {...}}, summary)."""

Why it got this result

This skill ships bundled Python scripts (scripts/acr.py + scripts/acr/*) that spawn subprocess.run for git/gh (read-only) and shutil.which/subprocess.Popen for an optional headless-Chrome PDF render -- all of these execute only when the orchestrator (the model, via its own Bash tool) explicitly invokes the acr.py CLI as directed by SKILL.md's Recipe section; none run at skill-load/install time, none are lifecycle/event hooks, and none are triggered by merely having the skill present. No env-var weaponization (GIT_EXTERNAL_DIFF/NODE_OPTIONS/LD_PRELOAD) or LLM-endpoint substitution exists anywhere in the scripts. The sync.py self-mutation writes only to a disclosed, enumerated destination list (house copy + 4 named mirror plugin dirs), not a covert host control-plane file.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

def pdf(outdir, chrome="google-chrome"):
    """google-chrome --headless=new ... --print-to-pdf; if Chrome is missing: 'PDF skipped, HTML is canonical' (SKILL.md:165).
    An explicit `chrome` is used as given; only the default also looks where Chrome is installed (_default_chrome)."""
    exe = _default_chrome() if chrome == "google-chrome" else shutil.which(chrome)
    if not exe: return None, "PDF skipped, HTML is canonical (google-chrome not found)"
    profile = os.path.join(os.path.abspath(outdir), ".chrome-profile")

def git_remote(cwd):
    """Read-only: `git -C cwd remote get-url origin`; None when cwd is gone or not a repo."""
    try:
        r = subprocess.run(["git", "-C", cwd, "remote", "get-url", "origin"], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=5)
        return parse_repo(r.stdout) if r.returncode == 0 else None
    except Exception: return None

## Recipe (orchestrator)

All commands from the skill directory; `OUT` is one run directory (for example `/tmp/acr-weekly/run`). Every step is idempotent.

1. **Prices** — `python3 scripts/acr.py prices --out $OUT` ...
2. **Collect** — `python3 scripts/acr.py collect --out $OUT` ...
3. **Rollup** — `python3 scripts/acr.py rollup --out $OUT` ...

Why it got this result

SKILL.md's allowed-tools frontmatter enumerates exactly 7 capabilities (Bash, Read, Write, AskUserQuestion, and the 3 claude-mem search MCP tools), no wildcard/catch-all. Each maps directly to the declared runtime: Bash runs the bundled scripts/acr.py pipeline (which itself invokes git/gh/python3/chrome, all declared in SKILL.md), Read/Write handle the report artifacts, AskUserQuestion gates the one interactive step (tzdata install consent), and the 3 MCP tools are the declared 'progressive Mem Search' review pass. No OAuth scopes, service-account config, or ambient credential/control-plane access is requested beyond this enumerated, purpose-matched set.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
  - mcp__plugin_claude-mem_mcp-search__get_observations
---

Why it got this result

Codepoint-scanned SKILL.md and found no zero-width/bidi/Tag-block characters, forged chat tokens, or ANSI escapes. The frontmatter and body are plain descriptive prose about the report pipeline; no directives aimed at overriding host behavior beyond describing the tool's own workflow.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: Agent Cost Report
description: >-
  Believable agent cost report for any period, default the last 7 full days PT, not counting today.
  Measured tokens from Claude Code transcripts priced at OpenRouter list prices (ESTIMATED), measured
  provider spend when a sanctioned source exists, note-taker cost separate, Timing-style HTML/PDF plus
  report.json, line-items.csv, evidence.json.
allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
…

Why it got this result

This skill's OWN model-facing instructions (SKILL.md) ship inside the bundle with no runtime fetch. It DOES contain a self-mutation-adjacent mechanism (sync.py: sync-check/--write copies this skill's files to 4 named mirror plugin directories plus a house copy) -- but this is the opposite direction of the rug-pull threat: it is an explicit, disclosed, checksum-verified (CHECKSUMS.txt, sha256sum-compatible) mechanism to keep the mirrors IN SYNC with this skill (the declared 'source of truth'), run manually by name (sync-check, --write), not a silent runtime self-rewrite that activates without the reviewer noticing, and drift is reported rather than silently applied by default (sync-check only writes with explicit --write). No live-fetch of instructions from a publisher-mutable endpoint was found.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

"""Phase 7.2: copy + checksum sync of the skill (SKILL.md, CHECKSUMS.txt and every file under scripts/)
from the plugin dir (source of truth) to the house copy and the four mirror plugins (G2: mirrors carry
the skill as byte copies, tracked in git). `sync-check` reports drift and exits 1; `--write` copies
plugin -> destinations and re-checks. Destinations live in one place (DESTINATIONS) and can be
overridden with --dest. Nothing outside that list is ever written."""

## Keeping copies in sync

The plugin directory is the source of truth. `python3 scripts/acr.py sync-check` compares `SKILL.md`, `CHECKSUMS.txt` and `scripts/**` against the house copy (`~/agent-data/workflows/agent-cost-report/`) and the four mirror plugins ... and exits 1 on drift; `--write` copies plugin → destinations and re-checks (G2). `CHECKSUMS.txt` is `sha256sum -c` compatible.

Why it got this result

Skill name 'Agent Cost Report' is a plain descriptive name, not a near-miss of any known brand/tool/registry. No trust-implying prefix, no version/tier-spoofing suffix, no impersonation prose claiming official status of another named tool.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: Agent Cost Report

Why it got this result

This is a pure prose instruction artifact with no bundled scripts, no allowed-tools grant, and no capability declaration at all -- it only tells the model what text format to reply with (skip_summary XML or observation XML) inside claude-mem's generator loop. There is no code to audit for hidden capability; the entire artifact is the instruction text itself.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: host-observer
description: >-
  Use this when fulfilling claude-mem observer jobs on Grok Bot: reply only
  skip_summary or one full observation XML, never prose.
---
# Host observer (Grok Bot)

You are the model inside claude-mem's generator loop (OpenRouter HTTP agent to the local shim).

Write only `outbox/{id}.txt` for inbox jobs, or return the XML as the chat-completions body.

Why it got this result

No prose in this skill instructs the model to bypass confirmation, hide an action, or assert authority over the host system prompt. The only directive ('Do not POST /api/memory/save except last-resort') narrows, not expands, write behavior, and is a formatting/output-shape constraint, not a consent-bypass.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

**Idle / init / no tool results:** `<skip_summary reason="noise" />`

**Finished searchable unit:** one `<observation>` with real title...

Prose is dropped (`outputClass=prose`). Do not mix skip_summary and observation. Do not POST `/api/memory/save` except last-resort.

Why it got this result

The frontmatter declares no allowed-tools at all -- no wildcard, no shell, no network grant. The skill's function (reply-format constraint for an LLM generator loop) needs no tool grant and declares none.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: host-observer
description: >-
  Use this when fulfilling claude-mem observer jobs on Grok Bot...
---

Why it got this result

Codepoint scan of the short SKILL.md found only standard ASCII/typographic punctuation (en/em dash); no zero-width, bidi-override, Tag-block, or forged chat-template tokens; no homoglyph substitution in any token.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

Full-file codepoint scan: only ASCII + standard en-dash/curly-quote punctuation present.

Why it got this result

The instruction body ships inside the bundled SKILL.md file with no runtime fetch from a remote/mutable endpoint, no self-updater, and no code that rewrites its own manifest.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

Static file, no fetch/update code present anywhere in this skill directory.

Why it got this result

The name 'host-observer' is a plain descriptive slug, not a near-miss or homoglyph of any known brand/tool/registry name, and makes no impersonation claims.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: host-observer
...

Why it got this result

The skill only formats already-supplied observer results and directs no credential-store read or conversation/system-prompt memory harvesting, so the harvest half of the harvest-plus-exfiltration pair this rule requires is absent.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

Entire skill body reviewed; no reference to env vars, credential files, or conversation/system-prompt dumping.

Why it got this result

Only an instruction file is present, with no script, hook, entrypoint, or control-plane assignment for this rule to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

Only a SKILL.md file exists in this skill directory; no scripts/ subdirectory, no hooks, no env assignments.

Why it got this result

SKILL.md declares installing claude-mem on Grok Bot (worker + CMEM Pro observer, optional host-login observer, remote worker). All actions are disclosed npx claude-mem install --ide grok-bot [...] invocations; the env vars set (CLAUDE_MEM_PROVIDER, CLAUDE_MEM_OPENROUTER_*, CLAUDE_MEM_MCP_TOKEN) are all documented and map to the stated install purpose. No undisclosed credential harvesting or exec capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Grok Bot: local worker plus CMEM Pro
  observer (default), optional host-login observer, or remote cmem.ai. No Cursor
  required.
---
# Install claude-mem on Grok Bot

Independent of Cursor. Grok Bot has no session-start / file-read / tool-use hooks.

## Local worker + CMEM Pro observer (default)

```
…

Why it got this result

No prose in this skill instructs the agent to skip confirmation, hide actions, or override host authority. Purely descriptive of install commands.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

---
name: claude-mem-install
description: Use this when setting up claude-mem on Grok Bot...
  Use this when setting up claude-mem on Grok Bot: local worker plus CMEM Pro
  observer (default), optional host-login observer, or remote cmem.ai. No Cursor
  required.

Why it got this result

No wildcard/catch-all declared grant; frontmatter only declares name/description. Described actions match the stated install purpose.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Grok Bot: local worker plus CMEM Pro
  observer (default), optional host-login observer, or remote cmem.ai.
---

Why it got this result

Codepoint scan found no concealment characters; text is purely descriptive with no forged control tokens or hidden directives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Grok Bot...
---
# Install claude-mem on Grok Bot

Why it got this result

SKILL.md ships inside the pinned package; no runtime fetch or self-mutation of the artifact's own instructions found.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Grok Bot...
---

Why it got this result

Skill name claude-mem-install declared in this skill's own SKILL.md frontmatter is canonical and honestly self-identified. No typosquat or impersonation signal.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: claude-mem-install
description: >-
  Use this when setting up claude-mem on Grok Bot: local worker plus CMEM Pro
  observer (default), optional host-login observer, or remote cmem.ai. No Cursor
  required.
---

Why it got this result

The installer instructions contain no directive to read credentials or persistent conversation content for transmission.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

npx claude-mem install --ide grok-bot
...

Why it got this result

The skill is prose directing an explicit npx flow and does not itself bundle an automatic execution mechanism.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: claude-mem-install
description: Use this when setting up claude-mem on Grok Bot...
  Use this when setting up claude-mem on Grok Bot: local worker plus CMEM Pro
  observer (default), optional host-login observer, or remote cmem.ai. No Cursor
  required.

Why it got this result

Identical to the cursor variant plus one extra disclosed line about a live-written ID index file at agents/<seat>/memory/log/zz-claude-mem-inject.md, with a documented opt-out env var. The extra behavior is disclosed in-line, not concealed, and is consistent with the declared memory-search purpose.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

The worker also live-writes a growing ID INDEX to `agents/<this-seat-uuid>/memory/log/zz-claude-mem-inject.md` (host Memory mid-attach). Use those IDs with `get_observations`. Thin seat diaries are filled from newest house observations. Disable with `CLAUDE_MEM_GROK_BOT_INJECT_ENABLED=false`.

Why it got this result

Same scoped memory-search workflow as the cursor variant with one additional disclosed note about a live-written ID index file and its opt-out env var. No consent-bypass or disclosure-suppression language present.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Layered workflow...
The worker also live-writes a growing ID INDEX to agents/<this-seat-uuid>/memory/log/zz-claude-mem-inject.md ... Disable with CLAUDE_MEM_GROK_BOT_INJECT_ENABLED=false.

Why it got this result

The skill reads persistent memory and raw prior tool records, making the harvesting rule applicable, but it directs no external exfiltration channel; results remain within the user's in-band memory-search flow.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

1. search(query)
2. timeline(anchor=ID)
3. get_observations(ids=[...])
4. get_tool_uses(ids=[...])
The worker also live-writes a growing ID INDEX to agents/<seat>/memory/log/zz-claude-mem-inject.md

Why it got this result

Same minimal scope as cursor variant -- no allowed-tools wildcard or broad capability class declared.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: mem-search
description: >-
  Use this when the user asks to search memory...
---

Why it got this result

No concealment codepoints, confusables, forged chat tokens, or ANSI escapes found. Content is purely descriptive prose.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: mem-search
description: >-
  Use this when the user asks to search memory...
---

Why it got this result

Same as cursor variant -- ships inside pinned repo tree, no runtime manifest/instruction fetch or self-mutation.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: mem-search
description: >-
  Use this when the user asks to search memory, "did we already solve this?",
...

Why it got this result

Same generic name as cursor variant; no brand resemblance.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: mem-search

Why it got this result

The skill documents a separate worker's memory-index write, which is an in-scope disclosed behavior; the skill itself ships no script or executable hook and contains no lifecycle carrier.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

The worker also live-writes a growing ID INDEX to agents/<this-seat-uuid>/memory/log/zz-claude-mem-inject.md (host Memory mid-attach). ... Disable with CLAUDE_MEM_GROK_BOT_INJECT_ENABLED=false.

Why it got this result

Byte-identical structural clone of claude-mem-grok-bot/skills/agent-cost-report (confirmed via diff -rq). Same analysis applies: all capabilities (transcript reads, read-only DB snapshot, opt-in OpenRouter calls with redacted excerpts, read-only gh/git calls, disclosed sync writes) map to the declared purpose.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

def run(candidates, rate, model=DEFAULT_MODEL, cap_usd=CAP_USD, key=None, call=_call, seed=0):
    """candidates: [{id, kind, text, before, after}]. Returns (labels {id: {...}}, summary).
    Prints the estimate first; over the cap it classifies a stratified random sample and scales up."""
    key = key if key is not None else os.environ.get("OPENROUTER_API_KEY")
    if not key: raise ClassifierError("OPENROUTER_API_KEY is not set (regular inference key, G5); classifier not run")
    if not rate: raise ClassifierError(f"no list price for {model}; classifier not run")

Why it got this result

Byte-identical structural clone of claude-mem-grok-bot/skills/agent-cost-report (confirmed via diff -rq). Same analysis applies: no consent-suppression prose; several steps are explicitly gated behind operator ('Alex') approval.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Gaps and gates

Each of these needs Alex's explicit go; the report shows the honest fallback until then.

- **OpenRouter key (needs Alex)** — a regular inference `OPENROUTER_API_KEY` supplied as an environment variable through the house's secure secret flow; never a management or provisioning key, never read from a settings file, never printed or written to any output. ...
- **Mac transcripts (needs Alex)** — sessions from Alex's Mac have no transcript on the box, so their cost is EXTRAPOLATED (low confidence) until a device export is merged. ...

Why it got this result

Byte-identical structural clone of claude-mem-grok-bot/skills/agent-cost-report (confirmed via diff -rq). Same analysis applies: conversation-transcript harvest + opt-in, redacted, capped, disclosed-destination exfil to OpenRouter only when --classify is explicitly invoked.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

SECRET_RE = re.compile(r"(sk-or-[\w-]+|sk-[\w-]{8,}|Bearer\s+\S+|ghp_\w+|gho_\w+|xox[abp]-[\w-]+|AKIA\w{12,}|[A-Za-z0-9+/=_-]{32,})")
KV_SECRET_RE = re.compile(r"\b(pass(?:word|wd|phrase|code)?|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|auth|credentials?)\b(\s*[:=]\s*)[\"']?[^\s\"',;]+[\"']?", re.I)


def scrub(text, n=EXCERPT_CHARS):
    """Excerpts: at most 160 chars after the secret scrubber (plan 2B.1)."""
    t = KV_SECRET_RE.sub(lambda m: f"{m.group(1)}{m.group(2)}[redacted]", (text or "").replace("\n", " ").strip())
    t = SECRET_RE.sub("[redacted]", t)
    return t[:n]

Why it got this result

Byte-identical structural clone of claude-mem-grok-bot/skills/agent-cost-report (confirmed via diff -rq). Same analysis applies: all subprocess execution is orchestrator-invoked CLI usage per SKILL.md's Recipe, not load-time or lifecycle-hook execution; no env weaponization.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

def pdf(outdir, chrome="google-chrome"):
    """google-chrome --headless=new ... --print-to-pdf; if Chrome is missing: 'PDF skipped, HTML is canonical' (SKILL.md:165).
    An explicit `chrome` is used as given; only the default also looks where Chrome is installed (_default_chrome)."""
    exe = _default_chrome() if chrome == "google-chrome" else shutil.which(chrome)
    if not exe: return None, "PDF skipped, HTML is canonical (google-chrome not found)"
    profile = os.path.join(os.path.abspath(outdir), ".chrome-profile")

Why it got this result

Byte-identical structural clone of claude-mem-grok-bot/skills/agent-cost-report (confirmed via diff -rq). Same enumerated, purpose-matched allowed-tools list with no wildcard.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
  - mcp__plugin_claude-mem_mcp-search__get_observations
---

Why it got this result

Byte-identical structural clone of claude-mem-grok-bot's agent-cost-report (confirmed via diff -rq). Codepoint-scanned SKILL.md directly and found no concealment codepoints, forged tokens, or ANSI escapes.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: Agent Cost Report
description: >-
  Believable agent cost report for any period, default the last 7 full days PT, not counting today.
  Measured tokens from Claude Code transcripts priced at OpenRouter list prices (ESTIMATED), measured
  provider spend when a sanctioned source exists, note-taker cost separate, Timing-style HTML/PDF plus
  report.json, line-items.csv, evidence.json.
allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
…

Why it got this result

Byte-identical structural clone of claude-mem-grok-bot/skills/agent-cost-report (confirmed via diff -rq). Same analysis applies: explicit, checksum-verified, manually-invoked sync mechanism rather than a silent runtime self-mutation or live-fetch.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

"""Phase 7.2: copy + checksum sync of the skill (SKILL.md, CHECKSUMS.txt and every file under scripts/)
from the plugin dir (source of truth) to the house copy and the four mirror plugins (G2: mirrors carry
the skill as byte copies, tracked in git). `sync-check` reports drift and exits 1; `--write` copies
plugin -> destinations and re-checks. Destinations live in one place (DESTINATIONS) and can be
overridden with --dest. Nothing outside that list is ever written."""

Why it got this result

Same generic, non-brand-colliding name as claude-mem-grok-bot's agent-cost-report (confirmed byte-identical clone). No typosquat/impersonation signal.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: Agent Cost Report

Why it got this result

SKILL.md declares the skill runs the bundled cmem-hook.mjs CLI to search cmem.ai memory using the plugin's configured API key, and the README (cowork/README.md) documents every hook/CLI behavior (capture, inject, ingest, spool) in detail. cmem-hook.mjs's actual behavior matches: it sends only tool-use/prompt data to the documented cmem.ai endpoints, redacts secret-shaped values before any network send (SECRET_PATTERNS/KEYVALUE_RE/COOKIE_RE/URI_RE), and is a no-op when a local claude-mem install already owns memory capture. No undisclosed network/credential capability was found.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

## How to search

Run the bundled CLI (no dependencies, uses the plugin's configured API key):

```bash
node "${CLAUDE_PLUGIN_ROOT}/scripts/cmem-hook.mjs" search "your query" --limit 20
```

function redactSecrets(s) {
  let out = s;
  for (const re of SECRET_PATTERNS) out = out.replace(re, REDACTED);
  out = redactUriCredentials(out);
  out = out.replace(COOKIE_RE, `$1$2${REDACTED}`);
  return out.replace(KEYVALUE_RE, `$1${REDACTED}`);
}

Why it got this result

SKILL.md contains no directive to skip confirmation, hide an action from the user, or claim authority over the host system prompt. Its only guidance is a progressive-search discipline (cheap passes first) and a warning not to dump raw output -- both benign UX guidance, not consent-bypass.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Progressive search method

Follow claude-mem's Index → Timeline → Transcript discipline — cheap passes
first, expensive detail only for confirmed hits...
Do not dump raw search output at the user; extract the relevant observations
and answer in plain language.

Why it got this result

The skill (via cmem-hook.mjs, which it invokes) reads only its own plugin-scoped API key (CMEM_API_KEY / config.json / local claude-mem cloud-sync token) to authenticate to the single documented cmem.ai destination it is paired with -- this is the artifact's OWN declared credential, not a harvest of unrelated host secrets. SKILL.md explicitly instructs 'Never write secrets into search queries; queries are sent to cmem.ai', and cmem-hook.mjs redacts secret-shaped values (private keys, bearer tokens, JWTs, cloud provider keys, cookies, URI userinfo) from every outbound payload before sending. No read of ~/.ssh, ~/.aws, .netrc, unrelated provider API keys, or conversation/system-prompt dumping was found.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Notes

- Some filters (date ranges, type) may be silently ignored by the cloud API
  until MCP parity ships — prefer keyword narrowing over filter flags.
- Never write secrets into search queries; queries are sent to cmem.ai.

const cfg = {
    apiBase: (pick(process.env.CMEM_API_BASE, file.apiBase, local.apiBase) || 'https://cmem.ai').replace(/\/+$/, ''),
    apiKey: pick(process.env.CMEM_API_KEY, file.apiKey, local.CLAUDE_MEM_CLOUD_SYNC_TOKEN, local.syncToken, local.apiKey, local.token),
    userId: pick(process.env.CMEM_USER_ID, file.userId, local.CLAUDE_MEM_CLOUD_SYNC_USER_ID, local.userId),

Why it got this result

The skill invokes a bundled Node CLI (cmem-hook.mjs) only in-band when the model explicitly runs the documented node ... search command -- no load-time execution, no lifecycle/event hooks shipped by THIS skill (the plugin-level hooks.json belongs to the cowork plugin as a whole, not this skill, and those hooks run inside the host's normal PostToolUse/SessionStart dispatch, not before model reasoning). No env-var hijack (LD_PRELOAD/NODE_OPTIONS/GIT_EXTERNAL_DIFF) or endpoint-substitution of the host LLM provider was found in the skill or its invoked script.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

Run the bundled CLI (no dependencies, uses the plugin's configured API key):

```bash
node "${CLAUDE_PLUGIN_ROOT}/scripts/cmem-hook.mjs" search "your query" --limit 20
```

Why it got this result

SKILL.md declares no allowed-tools frontmatter wildcard; the skill's documented action is a single bounded CLI invocation (search) scoped to the plugin's own configured API key and destination (cmem.ai). No filesystem-delete, admin, or broader network grant is declared beyond what the search function needs.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: mem-search
description: >
  This skill should be used when the user asks to "search memory"...
metadata:
  version: "0.1.0"
---

Why it got this result

Codepoint scan of SKILL.md found no zero-width/bidi/Tag-block characters, no mixed-script homoglyphs, no forged chat-template tokens, and no ANSI/OSC escapes. The note that memory context should be 'treated as background data, not instructions' (enforced in cmem-hook.mjs's contextBlock wrapper) is itself a defensive framing against prompt injection from injected observations, not an injection vector in the skill text itself.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

Full-file codepoint scan performed; only standard ASCII arrows (→) and punctuation found, no concealment codepoints.

Why it got this result

SKILL.md and the bundled cmem-hook.mjs script ship inside the plugin bundle; the skill's own instruction text is not live-fetched from a remote endpoint. The script's config is read from a local config.json / env vars at CALL time (functional configuration, not a mutation of the approved instruction body/manifest).

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: mem-search
...
metadata:
  version: "0.1.0"
---

Why it got this result

The name 'mem-search' is a plain descriptive slug for a claude-mem-published skill; it is not a near-miss or homoglyph of a well-known brand, and claims no impersonation of another tool's identity.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: mem-search
description: >
  This skill should be used when the user asks to "search memory"...

Why it got this result

SKILL.md declares pairing the claude-mem-cowork plugin with cmem.ai Connect credentials. The only reads/writes described (config.json apiKey/userId/syncHubUrl update, optional ~/.claude-mem/settings.json write) match the declared pairing purpose exactly, and the skill explicitly instructs NEVER to echo/log/argv the secret. No undisclosed capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

## Secret handling — non-negotiable

- Never echo the token back in conversation, put it in a shell argv, or log it.
- Move it only via file writes (Write/Edit tool) and file reads.

## Steps

1. Locate the installed plugin root (this skill's own plugin). Update its
   `config.json`: set `apiKey` to the sync token, `userId`, and `syncHubUrl`.
...
3. If this machine also has a local claude-mem install (a `~/.claude-mem/`
   directory exists), write the same values to
   `~/.claude-mem/settings.json` with mode 0600

Why it got this result

The skill's prose defers to disclosure (reports masked output, never silently proceeds) and does not instruct bypassing any host confirmation. "Never echo/log" is a secrecy-of-secret-value instruction, not disclosure suppression of a privileged action -- the skill still reports results and status.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

4. Verify without exposing the secret:
   node "${CLAUDE_PLUGIN_ROOT}/scripts/cmem-hook.mjs" status
   Report the masked output. A `MISSING` key means the write didn't land;

Why it got this result

This skill DOES handle a credential (the cmem.ai sync token) but it is user-supplied in this session (not read from an ambient host credential store), and the skill explicitly forbids echoing/logging/argv-ing it, routing it only through file writes with mode 0600, and a masked status check via a verify script. The verify step explicitly reports only a masked output. No conversation/context harvesting is directed, and the only network check is a local worker status call, not an exfil sink for the secret itself.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Secret handling — non-negotiable
- Never echo the token back in conversation, put it in a shell argv, or log it.
- Move it only via file writes (Write/Edit tool) and file reads.
...
4. Verify without exposing the secret:
   node "${CLAUDE_PLUGIN_ROOT}/scripts/cmem-hook.mjs" status
   Report the masked output.

Why it got this result

The skill does direct a write to a config.json and optionally ~/.claude-mem/settings.json, but this is the artifact's declared, disclosed purpose (pairing credentials) executed through the normal in-band tool flow (Write/Edit tool), not a covert control-plane mutation or load-time execution. No lifecycle hook, env-var hijack, or endpoint substitution is present.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

1. Locate the installed plugin root (this skill's own plugin). Update its
   `config.json`: set `apiKey` to the sync token, `userId`, and `syncHubUrl`.
   Leave other settings unless the user asks (`inject` toggles).

Why it got this result

Frontmatter declares only name/description/version metadata, no allowed-tools wildcard. The described file-write scope (config.json, ~/.claude-mem/settings.json) is intrinsic to the declared pairing/credential-configuration function.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: mem-setup
description: >
  This skill should be used when the user asks to "set up claude-mem"...
metadata:
  version: "0.1.0"
---

Why it got this result

Codepoint scan found no concealment characters; the body is purely descriptive guidance for the model with explicit security rules, no hidden directives or forged chat-template tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: mem-setup
description: >
  This skill should be used when the user asks to "set up claude-mem"...
metadata:
  version: "0.1.0"
---

Why it got this result

SKILL.md ships inside the pinned package; the skill writes USER credentials to config, not its own instruction body/manifest, so no self-mutation of the trust surface occurs.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: mem-setup
description: >
  This skill should be used when the user asks to "set up claude-mem"...
metadata:
  version: "0.1.0"
---

Why it got this result

Skill name mem-setup declared in this skill's own SKILL.md frontmatter is generic/descriptive, not a near-miss of any known third-party brand.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: mem-setup
description: >
  This skill should be used when the user asks to "set up claude-mem",
  "pair claude-mem", "connect cmem", "add my cmem key", "set up cloud sync in
  Cowork"...
metadata:
  version: "0.1.0"
---

Why it got this result

SKILL.md explicitly documents every capability: reading local Claude Code/Codex transcripts, OpenRouter pricing (declared as ESTIMATED), optional OpenRouter measured spend ('needs Alex's go'), optional gh pr list (read-only), and a capped $2 classifier using only OPENROUTER_API_KEY. All network egress and file reads documented in 'Gaps and gates' section with explicit consent requirements.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

## Gaps and gates

Each of these needs Alex's explicit go; the report shows the honest fallback until then.

- **OpenRouter key (needs Alex)** — a regular inference `OPENROUTER_API_KEY` supplied as an environment variable through the house's secure secret flow; never a management or provisioning key, never read from a settings file, never printed or written to any output.

Why it got this result

SKILL.md repeatedly requires explicit human ('Alex') go-ahead before any sensitive/billable action (OpenRouter measured spend, Mac device export, merge to main, npm publish) via AskUserQuestion, and the classifier step is opt-in and capped. No prose instructs skipping confirmation or hiding actions.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Each of these needs Alex's explicit go; the report shows the honest fallback until then... Merge to main, npm publish, `/version-bump` — each needs Alex's separate go.

Why it got this result

The skill reads local Claude Code/Codex transcripts (conversation context, its declared purpose) and OPENROUTER_API_KEY (env var only, never a settings file) to measure spend, scrubbing secret-shaped content before any text is sent to OpenRouter for the optional classifier. SKILL.md explicitly forbids printing/writing the key anywhere. No host credential store beyond the declared OpenRouter key is read, and the destination (OpenRouter's own API) is the artifact's documented, disclosed backend.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

inference OPENROUTER_API_KEY only, env var only, never a settings file, never a management key).
GET https://openrouter.ai/api/v1/key with `Authorization: Bearer <key>` returns data.usage (lifetime),
ENV = "OPENROUTER_API_KEY"

Why it got this result

allowed-tools list is an enumerated, narrow set (Bash, Read, Write, AskUserQuestion, 3 named MCP search tools) matching the declared cost-reporting function; no wildcard, and OpenRouter/gh access is scoped to a single documented key/read-only command.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
  - mcp__plugin_claude-mem_mcp-search__get_observations

Why it got this result

Codepoint-scanned SKILL.md: no zero-width/bidi/Tag-block codepoints, no forged chat-template tokens, no HTML-comment or CSS-hidden concealment. All imperatives in the body ('ALWAYS', 'never') are directed at the skill's own reporting behavior, not at suppressing host oversight or injecting a hidden directive.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: Agent Cost Report
description: >-
  Believable agent cost report for any period...
allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion

Why it got this result

This variant ships its own CHECKSUMS.txt (sha256sum-compatible) tracking every shipped file (SKILL.md + scripts/**). sync.py's sync-check compares this copy's hashes against the house copy and all mirror plugins and flags drift, giving this instance an explicit integrity-verification mechanism beyond the baseline rule requirement. No runtime instruction fetch; everything ships in the bundle.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

40b6e0045dbe7343d649bfddc313afc7f11f3ee5b44036ddebc73832635f0a8c  SKILL.md
355d152df9cb889dc9b81544341e7ac52032016c0106f67aae42176ef8ab5b1e  scripts/acr.py

Why it got this result

Skill name 'Agent Cost Report' / slug 'agent-cost-report' is a generic descriptive name, not a near-miss of any known brand/tool/registry. No impersonation prose or install-instruction replacement of a legitimate tool.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: Agent Cost Report
description: >-
  Believable agent cost report for any period...
---

Why it got this result

No bundled lifecycle/event hooks, no entry scripts auto-executed at load, no host-config/dotenv/git-hook writes, and no exec-enabling or endpoint-substituting env assignments. All scripts are invoked explicitly, in-band, by the orchestrator following the documented Recipe steps (python3 scripts/acr.py ...). No format-native control-plane primitive is shipped.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Recipe (orchestrator)
1. **Prices** — `python3 scripts/acr.py prices --out $OUT`...
2. **Collect** — `python3 scripts/acr.py collect --out $OUT`...

Why it got this result

Declared purpose is orchestrating subagents to execute an implementation plan (verification, anti-pattern checks, code quality review, commit-gating). No bundled scripts, no network/credential access, no undisclosed capability -- it is pure orchestration prose directing the host's own subagent-deployment mechanism, consistent with its stated purpose.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: do
description: Execute a phased implementation plan using subagents. Use when asked to execute, run, or carry out a plan — especially one created by make-plan.
---

# Do Plan

You are an ORCHESTRATOR. Deploy subagents to execute *all* work. Do not do the work yourself except to coordinate, route context, and verify that each subagent completed its assigned checklist.

Why it got this result

No consent-suppression prose. The skill explicitly REQUIRES human-visible verification gates before any commit: 'Commit only if verified -- Deploy a Commit subagent only after verification passes; otherwise, do not commit' and 'Don't commit before verification passes (or without explicit orchestrator approval)'.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

### After Each Phase

Deploy subagents for each post-phase responsibility:
1. **Run verification checklist** — Deploy a "Verification" subagent to prove the phase worked
2. **Anti-pattern check** — Deploy an "Anti-pattern" subagent to grep for known bad patterns from the plan
3. **Code quality review** — Deploy a "Code Quality" subagent to review changes
4. **Commit only if verified** — Deploy a "Commit" subagent *only after* verification passes; otherwise, do not commit

Why it got this result

Codepoint-scanned SKILL.md and found no zero-width/bidi/Tag-block characters, forged chat-template tokens, or ANSI escapes. The body is orchestration guidance for an agentic 'execute a plan via subagents' workflow with no concealment mechanism and no directive aimed at suppressing host oversight (that axis is separately evaluated under ATR-P0002).

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: do
description: Execute a phased implementation plan using subagents. Use when asked to execute, run, or carry out a plan — especially one created by make-plan.
---

# Do Plan

You are an ORCHESTRATOR. Deploy subagents to execute *all* work. Do not do the work yourself except to coordinate, route context, and verify that each subagent completed its assigned checklist.

Why it got this result

SKILL.md ships inside the plugin bundle with no runtime fetch of its own instructions from a publisher-mutable endpoint, and no self-mutation code.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: do
description: Execute a phased implementation plan using subagents. Use when asked to execute, run, or carry out a plan — especially one created by make-plan.
---

Why it got this result

Name 'do' is a single generic verb, not a near-miss of any known brand/tool.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: do

Why it got this result

The skill's subagent orchestration routes plan context among subagents but does not read host credentials or persistent memory, nor does it couple any such read to an attacker-controlled external sink.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

# Do Plan

You are an ORCHESTRATOR. Deploy subagents to execute *all* work. Do not do the work yourself except to coordinate, route context, and verify that each subagent completed its assigned checklist.

Why it got this result

The skill contains only declarative orchestration instructions; it ships no executable attachment, lifecycle hook, or environment-mutating code.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: do
description: Execute a phased implementation plan using subagents. Use when asked to execute, run, or carry out a plan — especially one created by make-plan.
---

Why it got this result

The SKILL.md frontmatter declares no permissions or allowed-tools surface, leaving no manifest scope for the over-privilege rule to evaluate.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: do
description: Execute a phased implementation plan using subagents. Use when asked to execute, run, or carry out a plan — especially one created by make-plan.
---

Why it got this result

The skill is a pure-prose orchestration artifact (no bundled scripts, no declared allowed-tools frontmatter) that only instructs the model how to structure an implementation plan via subagent delegation. No network, exec, filesystem, or credential capability is exercised beyond what the host's own tool-use (already consent-gated elsewhere) provides.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: make-plan
description: Create a detailed, phased implementation plan with documentation discovery...
---

# Make Plan

You are an ORCHESTRATOR. Create an LLM-friendly plan in phases...

Why it got this result

No prose in this skill instructs the agent to skip confirmation, hide a privileged action, or assert authority over the host system prompt. All directives concern plan structure, subagent reporting rigor, and presentation formatting.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Delegation Model

Use subagents for *fact gathering and extraction*...

### Subagent Reporting Contract (MANDATORY)
...
Reject and redeploy the subagent if it reports conclusions without sources.

Why it got this result

The frontmatter declares no allowed-tools at all, and the skill's function (plan-document authoring) needs no explicit tool grant beyond whatever the host's normal subagent/file-write flow already consent-gates.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: make-plan
description: Create a detailed, phased implementation plan with documentation discovery...
---

Why it got this result

Codepoint scan found only standard ASCII, emoji (section markers explicitly described as part of the output format), and em-dash punctuation; no zero-width/bidi/Tag-block characters, no mixed-script homoglyphs, no forged chat-template tokens, no ANSI/OSC escapes.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

```
## 🎯 Goal
<the primary goal, one sentence>

## 🧨 Now
...
```

Why it got this result

The instruction body ships entirely inside the bundled SKILL.md; no runtime fetch of instructions from a remote endpoint and no self-mutating code exist in this skill.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: make-plan
description: Create a detailed, phased implementation plan...
---

Why it got this result

The name 'make-plan' is a plain descriptive slug, not a near-miss of any known brand/tool, and makes no impersonation claim.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: make-plan
...

Why it got this result

The skill reads documentation and code for planning but does not access protected credentials or conversation memory.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

Full skill body reviewed; references only documentation/code reads for plan authoring, no credential or conversation-context access.

Why it got this result

Only instruction Markdown is present, without scripts, hooks, environment mutation, or host-control writes.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

Only SKILL.md exists in this skill directory (no scripts/, no hooks).

Why it got this result

The MCP tool list is a static array compiled into the shipped plugin bundle (plugin/scripts/mcp-server.cjs, minified build of src/servers/mcp-server.ts lines 486-1071). There is no runtime fetch of tool definitions and no hot-reload mechanism; the tool list, including names/descriptions/schemas, only changes when a new plugin version is installed (plugin/.claude-plugin/plugin.json carries a pinned version and plugin/bun.lock is generated for a reproducible dependency closure, per scripts/gen-plugin-lockfile.cjs). A client must re-approve the server on each version bump via the host's normal plugin-update flow.

Why it matters

Prevents rug-pull tool poisoning.

Evidence

var Ve={readOnlyHint:!0},Tv=[{name:"mem_search",description:"Search memory through enforced progressive disclosure...",inputSchema:{...

{
  "name": "claude-mem",
  "version": "13.39.0",
  ...

Why it got this result

Tools are scoped to their declared purpose: memory search/save/observation tools talk only to the local worker's HTTP API (127.0.0.1 by default) or the server runtime via an API key; file-reading tools (smart_search/smart_unfold/smart_outline) call resolveWithinWorkspace() which realpath-resolves and rejects any path escaping the current workspace directory (src/services/smart-file-read/workspace-path.ts). No tool executes shell commands or grants filesystem write outside the worker's own data directory. This is a single-user local developer tool (stdio transport) without multi-tenant RBAC, which is appropriate for its threat model.

Why it matters

Limits blast radius and privilege escalation.

Evidence

handler:async e=>{let t=await La(e.path||process.cwd()),r=await Kw(t,e.query,{maxResults:e.max_results||20,filePattern:e.file_pattern});return{content:[{type:"text",text:Gw(r,e.query)}]}}

Why it got this result

Tool names (mem_search, save_memory, search, timeline, get_observations, work_state_write/read, observation_*, smart_search/unfold/outline, *_corpus, important_workflow) are generic verbs scoped to this server's own memory/corpus domain. None is a known near-homograph or exact collision with a widely-deployed MCP server's named tool (e.g. filesystem server's read_file, github server's create_issue). No aliasing/registration-order trickery is used to win collisions.

Why it matters

Prevents malicious tool shadowing.

Evidence

Tv=[{name:"mem_search",...},{name:"save_memory",...},{name:"search",...},{name:"timeline",...} ...

Why it got this result

All 24 tool descriptions in src/servers/mcp-server.ts were reviewed for hidden directives, ANSI escapes, bidi/zero-width control characters, or instructions to exfiltrate data/bypass confirmation. Descriptions are plain, neutral operational text describing parameters and expected behavior (e.g. 'Search memory through enforced progressive disclosure...'). No control characters or imperative host-directed injection phrases were found.

Why it matters

Prevents covert model manipulation.

Evidence

description:"Search memory through enforced progressive disclosure. Guided mode returns readable mem-search step 1 of 3 (index)..." -- plain descriptive text, no hidden directives

Why it got this result

mcp-server/plugin exposes only stdio -- no remote authorization surface exists on this component, so the MCP Authorization spec's OAuth 2.1 requirement does not apply to it per the false_positive_guard for stdio-ONLY components.

Why it matters

Misconfig enables token theft and confused-deputy attacks.

Evidence

StdioServerTransport only; the component registers no HTTP/SSE endpoint and performs no OAuth flow itself.

Why it got this result

mcp-server/plugin itself is a stdio-only process spawned by the MCP client (Claude Code) and never binds a network listener -- requires_remote_transport is not met for this component's own surface. The server it talks to (the local worker, or the hosted server-beta runtime) is a separate process/component with its own auth story (worker defaults to loopback bind with no auth; server-beta requires API keys verified via requirePostgresServerAuth). Those are evaluated conceptually below as context, but the registered stdio component itself exposes no network-reachable endpoint requiring authn/authz.

Why it matters

Prevents unauthorized tool use and data access.

Evidence

main() constructs only a StdioServerTransport and calls server.connect(transport); no HTTP listener is created by this component.

Why it got this result

mcp-server/plugin is not an OAuth proxy: it does not forward authorization requests to a distinct upstream IdP on behalf of dynamically-registered MCP clients. It is a single stdio MCP server used directly by one Claude Code instance per process; there is no MCP client registration endpoint or upstream /authorize bridging code in this component.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Evidence

No OAuth-proxy / authorization-server-forwarding code exists in src/servers/mcp-server.ts.

Why it got this result

The registered mcp-server/plugin component (src/servers/mcp-server.ts) communicates with its MCP client exclusively over stdio (StdioServerTransport) -- it has no HTTP/SSE/streamable-HTTP listener of its own. Per applicability.requires_remote_transport this rule is NOT_APPLICABLE to this component.

Why it matters

Prevents DNS rebinding/browser hijack of local or remote MCP.

Evidence

StdioServerTransport is the only transport constructed and connected in this component's main(); no app.listen/http.createServer exists in src/servers/mcp-server.ts.

Why it got this result

mcp-server/plugin is stdio-only; it never binds a network listener of its own. (The companion local worker process it talks to over loopback HTTP is a separate code path, src/services/server/Server.ts, evaluated as a related architectural concern but not a 'component' registered for this scan.)

Why it matters

LAN/Internet exposure enables remote exploitation.

Evidence

No listen()/createServer() call exists in the mcp-server.ts source; the only transport is StdioServerTransport.

Why it got this result

mcp-server/plugin is stdio-only and sets no CORS headers of its own; requires_remote_transport is not met for this component.

Why it matters

Prevents credentialed cross-origin abuse.

Evidence

No Access-Control-Allow-Origin handling exists in mcp-server.ts; this is a stdio component.

Why it got this result

This component exposes only a local stdio transport and has no HTTP listener to which an HTTPS-only transport rule could apply.

Why it matters

MitM can steal tokens and tamper responses.

Evidence

StdioServerTransport only; no HTTP/HTTPS listener in this component.

Why it got this result

Identical SKILL.md/scripts to openclaw variant (true structural clone apart from VERIFICATION.md). Same disclosed capability set, same gated OpenRouter key usage, same explicit consent requirements for device exports and PR merges.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

## Gaps and gates

Each of these needs Alex's explicit go; the report shows the honest fallback until then.

- **OpenRouter key (needs Alex)** — a regular inference `OPENROUTER_API_KEY` supplied as an environment variable through the house's secure secret flow...

Why it got this result

Same consent-respecting language as openclaw variant: gated actions require Alex's explicit go via AskUserQuestion.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Each of these needs Alex's explicit go; the report shows the honest fallback until then... Merge to main, npm publish, `/version-bump` — each needs Alex's separate go.

Why it got this result

Identical to openclaw variant: env-var-only OPENROUTER_API_KEY, scrubbing before any classifier network call, no host credential-store reads.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

inference OPENROUTER_API_KEY only, env var only, never a settings file, never a management key).
GET https://openrouter.ai/api/v1/key with `Authorization: Bearer <key>` returns data.usage (lifetime),
ENV = "OPENROUTER_API_KEY"

Why it got this result

The skill ships bundled executable scripts under scripts/acr/, so the rule applies, but those scripts are invoked only through explicit post-decision recipe commands listed in SKILL.md's Recipe section; no lifecycle hook or load-time execution causes them to run automatically.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Recipe (orchestrator)
1. **Prices** — `python3 scripts/acr.py prices --out $OUT`...
2. **Collect** — `python3 scripts/acr.py collect --out $OUT`...

Why it got this result

Same enumerated allowed-tools list as openclaw/grok-bot variants; no wildcard capability grant.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools:
  - Bash
  - Read
  - Write
  - AskUserQuestion
  - mcp__plugin_claude-mem_mcp-search__search
  - mcp__plugin_claude-mem_mcp-search__timeline
  - mcp__plugin_claude-mem_mcp-search__get_observations

Why it got this result

Identical content to openclaw variant; no concealment codepoints or forged directives found.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: Agent Cost Report
description: >-
  Believable agent cost report for any period...
---

Why it got this result

This is the plugin directory designated 'source of truth' by sync.py; CHECKSUMS.txt + VERIFICATION.md/verification/ provide integrity tracking and drift detection against the house copy and mirror plugins (claude-mem-cursor, claude-mem-grok-bot, cowork, openclaw). No runtime fetch of its own instructions/manifest.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

"""Phase 7.2: copy + checksum sync of the skill (SKILL.md, CHECKSUMS.txt and every file under scripts/)
from the plugin dir (source of truth) to the house copy and the four mirror plugins (G2: mirrors carry
the skill as byte copies, tracked in git). `sync-check` reports drift and exits 1..."""

Why it got this result

Same generic descriptive name as the other variants; no impersonation signal.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: Agent Cost Report
description: >-
  Believable agent cost report for any period...
---

Why it got this result

Declared purpose is monitoring a PR via gh CLI until checks/comments/threads are resolved. All commands shown (gh pr view, gh api graphql for review threads, gh api graphql mutation to resolve threads) map directly to the stated GitHub PR-monitoring function; jq is used only to parse gh's own JSON output. No credential harvesting, no undisclosed network egress to third-party hosts.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

## GitHub CLI Checks

Use `gh pr view` for the coarse status:

```bash
gh pr view <number> --json \
  number,state,isDraft,mergeable,mergeStateStatus,reviewDecision,headRefOid,statusCheckRollup,url
```

Why it got this result

Searched for consent-suppression/oversight-bypass prose (never ask, auto-approve, do not tell, silently, bypass consent, autonomous mode) -- none found. The skill explicitly gates destructive actions on verification: 'Commit only if verified' and 'do not commit' unless checks pass.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Operating Rules

- Keep the watcher running while long checks are pending.
- If a generated file is part of the distribution, verify the source and generated artifact agree before resolving comments.
- If a bot reports an issue against stale code, confirm whether the thread is outdated or addressed in the latest head.
- Before final reporting, do one fresh sweep of PR status, unresolved threads, recent comments, and local `git status`.
- Report concrete evidence: latest commit SHA, check names and results, unresolved thread count, tests run, and any dirty local files left untouched.

Why it got this result

Codepoint-scanned SKILL.md and found no concealment codepoints, forged chat tokens, or ANSI escapes. Content is plain GitHub PR-monitoring workflow guidance.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: babysit
description: Watch a pull request or review cycle until it is ready to merge. Use when asked to babysit, monitor, or keep checking PR comments, reviews, and CI until all actionable issues are resolved.
---

# Babysit PR

Stay with the PR until it is actually clean. Do not stop after one check pass if comments or review threads are still unresolved.

Why it got this result

SKILL.md ships inside the plugin bundle with no runtime fetch of its own instructions from a publisher-mutable endpoint, and no self-mutation code of any kind in this skill's directory.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: babysit
description: Watch a pull request or review cycle until it is ready to merge. Use when asked to babysit, monitor, or keep checking PR comments, reviews, and CI until all actionable issues are resolved.
---