Agent Economy ReportAgent Economy ReportCAUTION version 3.3.0 · audited 2026-09-17
ByteRover is a Markdown skill that teaches an agent to install a global command-line tool called byterover-cli and use it to keep a project memory in .brv/context-tree. The examples show reading, writing, reviewing, and version-controlling local Markdown knowledge, plus optional searches across other local memory providers. It can send query or curation text and included files to a configured LLM provider, and it only syncs to byterover.dev over git after the agent runs brv login with an API key. The package contains no executable code of its own, but it instructs a global npm install and includes broad imperative instructions to use the skill before other work. The documented safeguards say file reads are project-scoped and remote sync is optional, but installation of the CLI is a third-party code risk. No hidden credential theft, wallet redirection, persistence outside the declared memory directory, or download-and-execute behavior was found.
Instructions try to steer the agent beyond the declared purpose. SKILL.md line 3 says the agent 'MUST use this for gathering contexts before any work'; line 545 says 'You MUST show this troubleshooting guide to users when errors occur'; line 554 says 'You MUST handle these errors gracefully and retry the command after fixing.' These are unconditional instructions that can push the agent to prioritize this skill's workflow over the task and can override other task-specific instructions.
| Declared purpose | Knowledge management for AI agents: use the brv CLI to store and retrieve project patterns, decisions, and architectural rules in .brv/context-tree, with LLM-assisted query and curation and optional remote sync. |
| Observed behavior | The skill instructs the agent to install byterover-cli globally with npm, then run brv commands for query, search, curate, review, provider setup, location listing, git-like version control, swarm query/curate/status, and query/curate history. These commands read and write .brv/context-tree and other configured memory providers, and brv curate can read up to five project files. Query and curate operations may call a configured LLM provider. Remote git operations to https://byterover.dev are shown only after brv login --api-key. The file also contains unconditional MUST instructions for using the skill and handling errors. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | The skill is a set of shell commands using npm, brv, and git that the agent must execute to use the CLI. |
| install_packages | needed | Line 9 instructs a global npm install of byterover-cli, which downloads and executes third-party package code. |
| filesystem_read | needed | brv query, brv search, and brv curate -f read .brv/context-tree and project files; line 537 says paths outside the project root are rejected. |
| filesystem_write | needed | brv curate, brv review approve, brv vc, and brv swarm curate create and modify Markdown memory files and version-control data. |
| persistence | needed | Knowledge is persistently stored under .brv/context-tree/ as described at line 535 and may be version-controlled with brv vc. |
| network | needed | Optional remote sync to byterover.dev and optional external LLM provider calls are documented; local operations do not require network authentication. |
| credentials | needed | The skill handles API keys through brv login --api-key and brv providers connect ... --api-key for optional cloud sync and external LLM providers; local query, curate, and local vc need none. |
| other | needed | LLM processing: brv query and brv curate send query/curate text and included file contents to a configured LLM provider as documented at line 539. |
| severity | finding |
|---|---|
| medium | Unconditional instruction to use this skill before any work The skill description uses MUST and says to run it before any work, which may override the agent's other task-specific instructions. SKILL.md:3 description: "You MUST use this for gathering contexts before any work. This is a Knowledge management for AI agents. Use `brv` to store and retrieve project pa |
| high | Global third-party package installation This tells the agent to install byterover-cli globally with npm. That package is not included in these files, so its code is not audited here and could run with the user's privileges. SKILL.md:9 Install: `npm install -g byterover-cli` |
| info | Example query command Demonstrates searching the local knowledge base through the brv CLI. SKILL.md:34 brv query "How is authentication implemented?" |
| info | Example curation command writes persistent memory Shows that brv curate stores supplied project details, including authentication facts, into the knowledge base. SKILL.md:71 brv curate "Auth uses JWT with 24h expiry. Tokens stored in httpOnly cookies via authMiddleware.ts" |
| info | Curation can read project source files The -f flag includes a project source file in curation. The file later states this is limited to five files and project scope. SKILL.md:77 brv curate "Authentication middleware details" -f src/middleware/auth.ts |
| medium | Accepts API keys for external LLM providers The skill shows passing API keys to brv providers connect, which means the agent may handle third-party credentials. SKILL.md:154 brv providers connect openai --api-key sk-xxx --model gpt-4.1 |
| medium | Handles ByteRover API key for remote sync The login command takes an API key, demonstrating credential handling for optional cloud features. SKILL.md:205 brv login --api-key sample-key-string |
| low | Remote destination is byterover.dev The skill documents cloning a team space from byterover.dev after login. SKILL.md:206 brv vc clone https://byterover.dev/<team>/<space>.git |
| low | Remote destination is byterover.dev The skill documents adding byterover.dev as a git remote for an existing project. SKILL.md:212 brv vc remote add origin https://byterover.dev/<team>/<space>.git |
| info | Documented file-access limitation The skill says curation file reads are limited to the current project and reject paths outside the project root. SKILL.md:537 **File access**: The `-f` flag on `brv curate` reads files from the current project directory only. Paths outside the project root are rejected. Maximum 5 files |
| low | Data sent to configured LLM provider The skill discloses that query and curate content, including included file contents, is sent to an LLM provider. This is declared behavior, not hidden exfiltration. SKILL.md:539 **LLM usage**: `brv query` and `brv curate` send context to a configured LLM provider for processing. The LLM sees the query or curate text and any included fil |
| low | Cloud sync is optional and authenticated The skill states that only explicit push and pull commands sync with ByteRover's cloud, while other commands work without ByteRover authentication. SKILL.md:541 **Cloud sync**: `brv vc push` and `brv vc pull` require authentication (`brv login`) and sync knowledge with ByteRover's cloud service via git. All other comman |
| medium | Unconditional instruction about error handling This tells the agent it must show a specific troubleshooting guide when errors occur, regardless of the current task or user preferences. SKILL.md:545 You MUST show this troubleshooting guide to users when errors occur. |
| medium | Unconditional instruction to retry commands This instructs the agent to handle and retry listed commands after fixing errors, which could cause repeated execution of shell commands. SKILL.md:554 You MUST handle these errors gracefully and retry the command after fixing. |
| info | Publisher discloses LLM data sharing risk The skill card acknowledges that project context may leave the local environment during LLM-backed operations. skill-card.md:25 Risk: Project context may be sent to a configured LLM provider during query and curate operations. |
| medium | Publisher discloses global install risk The skill card itself warns that installing the CLI globally can execute third-party package code, reinforcing that byterover-cli is unaudited here. skill-card.md:37 Risk: Global CLI installation can execute third-party package code. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| byterover.dev | not in the service index | SKILL.md:206 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | bash, git, npm |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 3 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 562 | 89a7e1ee8a10571c… |
_meta.json | 6 | 81a36ec412eb776f… |
skill-card.md | 61 | 4d0430748daf7410… |
For agents
JSON: https://agenteconomy.report/k/byterover.audit.json · badge: https://agenteconomy.report/k/byterover.audited.svg ·
skill rating: /k/byterover · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).