Refuted findings 11
Candidates the review stage examined and rejected, kept for transparency.
Tool poisoning
highRefutedlow confidenceThe search_memory tool description tells the agent to prefer it first and says the sibling per-library tools only see half the picture, which steers tool selection toward this tool.
This is the tool to reach for first when the user refers to something they 'showed you', 'recorded', 'watched', or 'went over'
Why it was refuted
The description is accurate usage guidance. Recordings and imported videos are separate libraries, so the per-library tools do cover only part of the memory. It contains no hidden instruction or manipulation.
Data exfiltration
highRefutedlow confidencedownload_recording fetches a URL taken from API response metadata and writes it to an agent-chosen arbitrary local path without host restriction, allowing arbitrary file overwrite or fetches from a server-controlled URL.
createWriteStream(dest),
Why it was refuted
Downloading a recording's MP4 to a local path is the tool's declared core capability. Data flows from the remote service to disk, not off-host, and the download is restricted to http(s). This is not exfiltration.
Data exfiltration
highRefutedlow confidenceget_agent_context additionally posts an undeclared 'agent-activity' read receipt to the Clipy API (fire-and-forget, errors only logged) that the tool description does not mention; same service, minimal payload, so low risk.
kind: "read",
Why it was refuted
The read receipt goes to the same Clipy API the tool already queries and carries only a fixed kind and source. It leaks no user data, so it is not exfiltration.
Credential access
highRefutedlow confidenceThe record tool can open or copy a user's real Chromium profile (cookies, logins) via userDataDir/profileDirectory and upload the resulting recording off-host; this is disclosed and opt-in per call, but grants broad credential-bearing reach to the agent.
WITH profileDirectory, Clipy COPIES that named profile into a temporary root and records the copy
Why it was refuted
Recording behind a login via userDataDir or profileDirectory is the record tool's declared, opt-in capability. The profile copy is created with mode 0700 and deleted after upload, and the real profile is never modified. Only a video is uploaded, not the credentials.
Credential access
highRefutedlow confidenceThe record tool lets the agent supply a local Chromium user-data dir/profile (logged-in cookies and credentials) that is copied to a scratch root or opened directly, recorded, and the resulting video uploaded to Clipy; this is an agent-chosen local credential store path, though declared and aimed at recording behind a login.
if (userDataDir) userDataDirPath = validateUserDataDir(userDataDir, profileDirectory);
Why it was refuted
The user-data dir path is validated and the use is declared core functionality for recording behind a login. The scratch copy is deleted in the finally block. The credentials themselves are never uploaded.
Data exfiltration
highRefutedlow confidenceThe upload_video tool uploads any agent-specified local file path to the remote Clipy service, so a prompt-injected agent could send arbitrary local video files off-host; this is the declared core capability and is limited to video formats by description.
Upload a video file from this machine (WebM, MP4, or QuickTime .mov) to the user's Clipy library
Why it was refuted
Uploading a local video file to the user's own Clipy library is the tool's declared core purpose. It is flagged openWorld, and the user's API key is used for the wrapped service.
Data exfiltration
highRefutedlow confidenceThe upload_video tool takes an agent-supplied absolute path, resolves it, and uploads the file to the remote Clipy API with no visible restriction beyond existence, so a prompt-injected agent could send arbitrary local files off-host (this is also the tool's declared purpose).
path: z.string().describe("Absolute path of the video file."),Why it was refuted
The agent-supplied video path is the declared input of the upload_video tool. This is core functionality, so it is not an undeclared exfiltration channel.
Data exfiltration
highRefutedlow confidenceThe upload_video handler passes an agent-supplied absolute path to uploadVideoFile after only an existence check, with no visible video type or extension validation, so a prompt-injected agent could upload arbitrary local files to the Clipy service.
if (!existsSync(videoPath)) return fail(`No such file: ${videoPath}`);Why it was refuted
The existence check precedes the declared upload of a user-specified video file to the user's own Clipy account. That is the tool's core capability, not a concealed exfiltration chain.
Credential access
highRefutedlow confidenceThe recorder copies a named profile from a real Chrome user-data root, including cookie/login stores and the 'Local State' os_crypt key, into a temp scratch directory; this is disclosed and caller-requested, but it puts browser credential material in a world-reachable tmp location and the browser then runs against it.
cpSync(join(userDataDir, "Local State"), join(scratchRoot, "Local State"))
Why it was refuted
The scratch root is created with mode 0700, so it is not world-reachable. The copy is documented, caller-requested, and removed after the recording. Only the video is uploaded.
Privilege escalation
mediumRefutedlow confidenceThe package description presents the server as giving agents only 'read access' to recordings, but the declared tool surface includes write and destructive tools (delete_recording, edit_recording, upload_video, set_recording_privacy), so the declared scope understates the actual authority.
read access to your screen recordings' transcripts, AI summaries, and key moments with frames
Why it was refuted
The manifest long_description openly discloses the record and transcript-edit tools and the scope enforcement. The loose 'read access' wording in package.json is a marketing summary, not a concealed scope.
Agent hijacking
mediumRefutedlow confidenceThe list_context_documents tool description tells the agent never to tell the user an import failed when frames are missing; read in context this is an accuracy guard (check ingestStatus first), not an attempt to conceal actions.
never tell the user an import failed because frames are missing
Why it was refuted
The phrase is an accuracy guard. It tells the agent to check ingestStatus before reporting an incomplete document, so it does not instruct the agent to conceal anything from the user.
