byterover

clawhub:byterover

View source
D
45/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

6

Score

45/100

HIGH 1
MEDIUM 5

Findings (6)

HIGH
External context or knowledge sync
L23

Detects CLI tools that upload project context, code, or knowledge to external services

curate "JWT 24h expiry" -f auth.ts
FIX

Block the ability to package multiple files into archives (zip, tar) and transmit them. If archiving is needed, restrict it to specific directories and require user confirmation.

FP?

Likely FP if the skill is a backup or deployment tool where creating and transmitting archives is the documented core functionality.

MEDIUM
External context or knowledge sync
L44

Detects CLI tools that upload project context, code, or knowledge to external services

curate "Auth uses JWT 24h expiry, tokens in httpOnly cookies" -f src/auth.ts
FIX

Block the ability to package multiple files into archives (zip, tar) and transmit them. If archiving is needed, restrict it to specific directories and require user confirmation.

FP?

Likely FP if the skill is a backup or deployment tool where creating and transmitting archives is the documented core functionality.

MEDIUM
External context or knowledge sync
L59

Detects CLI tools that upload project context, code, or knowledge to external services

curate "Auth implementation details" -f src/auth.ts -f src/middleware/jwt.ts
FIX

Block the ability to package multiple files into archives (zip, tar) and transmit them. If archiving is needed, restrict it to specific directories and require user confirmation.

FP?

Likely FP if the skill is a backup or deployment tool where creating and transmitting archives is the documented core functionality.

MEDIUM
External context or knowledge sync
L76

Detects CLI tools that upload project context, code, or knowledge to external services

curate "OUTDATED: Previous auth used sessions. NEW: Now uses JWT with refresh tokens. Clean up old session-based auth context." -f
FIX

Block the ability to package multiple files into archives (zip, tar) and transmit them. If archiving is needed, restrict it to specific directories and require user confirmation.

FP?

Likely FP if the skill is a backup or deployment tool where creating and transmitting archives is the documented core functionality.

MEDIUM
External context or knowledge sync
L82

Detects CLI tools that upload project context, code, or knowledge to external services

curate "Create separate topics for: 1) JWT validation, 2) refresh token flow, 3) logout handling" -f
FIX

Block the ability to package multiple files into archives (zip, tar) and transmit them. If archiving is needed, restrict it to specific directories and require user confirmation.

FP?

Likely FP if the skill is a backup or deployment tool where creating and transmitting archives is the documented core functionality.

MEDIUM
External context or knowledge sync
L85

Detects CLI tools that upload project context, code, or knowledge to external services

curate "Document the error handling patterns in detail (at least 30 lines covering all error types)" -f
FIX

Block the ability to package multiple files into archives (zip, tar) and transmit them. If archiving is needed, restrict it to specific directories and require user confirmation.

FP?

Likely FP if the skill is a backup or deployment tool where creating and transmitting archives is the documented core functionality.