Refuted findings 19
Candidates the review stage examined and rejected, kept for transparency.
Code execution
criticalRefutedmedium confidenceThe plugin's MISSING text returned to the model/user directs them to run a curl|sh installer fetched from a mutable main-branch URL, a remote-code instruction outside the pinned commit.
Install it with: curl -fsSL https://raw.githubusercontent.com/vshulcz/deja-vu/main/install.sh | sh
Why it was refuted
This is the project's own vendor installer, offered in a plain not-installed message for the wrapped tool; it is the standard install carve-out, not a hidden or concealed instruction.
Persistence
criticalRefutedlow confidenceThe skill instructs the agent, after user selection, to run `deja rules sync`, which copies a rules file into every installed agent's global rules file; this is a cross-agent control-plane write that goes beyond a read-only history search, though it is user-gated and disclosed.
run `deja rules sync`, which copies the file into every installed agent's global rules file
Why it was refuted
The rules sync only runs when the user asks for standing rules, and only after the user picks which rules to write. The write is shown first and the sync is disclosed in the skill, so the explicit user gate neutralizes the control-plane write concern.
Persistence
criticalRefutedlow confidenceThe skill lets the agent write durable memory entries via `deja remember` without an explicit user-confirmation step, so a persistent decision could be stored from agent judgement alone.
store one durable decision after it is settled, as a single self-contained fact
Why it was refuted
`deja remember` is one of the declared modes of the deja tool and writes to deja's own memory store, not an agent control plane. Recalled content is framed as untrusted reference data, which limits what a stored entry can do later.
Persistence
criticalRefutedmedium confidenceThe skill instructs the agent to run `deja rules sync`, which copies a rules file into every installed agent's global rules file; this writes to the agent control plane across tools, though only after the user picks the rules.
run `deja rules sync`, which copies the file into every installed agent's global rules file
Why it was refuted
The skill states the rules sync happens only after the user picks rules. The write is shown to the user first and the sync is disclosed, so the user gate neutralizes the cross-agent write concern.
Persistence
highRefutedmedium confidenceThe installer can append an export PATH line to the user's shell rc file (~/.zshrc, ~/.bashrc or ~/.profile) and falls back to sudo install; the rc write is gated by an interactive prompt unless --yes is passed.
printf '%s\n' "$line" >> "$rc"
Why it was refuted
The rc-file append happens only after an explicit y/N prompt on the controlling terminal, or never; otherwise it just prints a message. The line it writes is a plain PATH export.
Supply chain
highRefutedmedium confidenceinstall.sh resolves the 'latest' GitHub release at runtime and installs its binary, so the installed code is mutable and lives outside the pinned commit; the checksum file comes from the same release origin, so it only guards against corruption.
api="https://api.github.com/repos/$repo/releases/latest"
Why it was refuted
This is the project's own vendor installer fetching its own GitHub release. It checks the archive against a checksums entry and aborts if none is found, which is a normal installer pattern and not a concealed channel.
Supply chain
highRefutedlow confidenceinstall.sh resolves the latest GitHub release at runtime, downloads the archive and its checksums.txt from the same mutable release, and installs the binary, so the checksum gives no independent integrity guarantee.
curl -fsSL "$base/$archive" -o "$tmp/$archive"
Why it was refuted
This is the same vendor installer pattern as above: it downloads the project's own release archive and verifies a checksum, and it contains nothing concealed or off-origin.
Code execution
highRefutedlow confidenceThe hook bridge script resolves a 'deja' binary from PATH or user-writable home directories and execs it with all hook arguments, with session, prompt and tool-call JSON on stdin; the binary is not shipped or pinned, so its behavior is unverifiable here.
exec "$DEJA" "$@"
Why it was refuted
The hook script's declared purpose is to bridge Claude Code hooks to the deja binary, so exec'ing that binary is the core capability. Missing-binary and duplicate-hook cases exit quietly.
Persistence
highRefutedlow confidenceThe skill directs the agent to run `deja rules sync`, which copies a rules file into every installed agent's global rules file, an agent control-plane write, but only after the user picks the rules and sees the exact lines.
run `deja rules sync`, which copies the file into every installed agent's global rules file
Why it was refuted
Syncing rules across agents is an openly stated feature of this rules-suggestion workflow, and the skill requires the user to pick the rules and see the exact lines before anything is written.
Persistence
highRefutedlow confidenceAfter user selection, the skill has the agent append rules to a rules file and run `deja rules sync`, which copies them into every installed agent's global rules file (agent control-plane write across tools), though it is user-gated.
run `deja rules sync`, which copies the file into every installed agent's global rules file
Why it was refuted
Syncing rules across agents is an openly stated feature of this workflow, and it is gated on the user picking the rules and seeing the exact lines first.
Persistence
highRefutedmedium confidenceThe skill instructs the agent to append rules and run `deja rules sync`, which copies the rules file into every installed agent's global rules file, a write to the agent control plane across tools; it is gated on the user picking rules and seeing the exact lines first.
run `deja rules sync`, which copies the file into every installed agent's global rules file
Why it was refuted
Syncing rules across agents is an openly stated feature of this workflow, and it is gated on the user picking the rules and seeing the exact lines first.
Persistence
highRefutedlow confidenceAfter user selection, the skill has the agent append rules to a rules file and run `deja rules sync`, which propagates them into every installed agent's global rules file (an agent control-plane write), though it is gated on explicit user confirmation.
`deja rules sync`, which copies the file into every installed agent's global rules file
Why it was refuted
Syncing rules across agents is an openly stated feature of this workflow, and it is gated on the user picking the rules and seeing the exact lines first.
Persistence
highRefutedlow confidenceAfter the user picks rules, the skill has the agent append them to a rules file and run `deja rules sync`, which copies that file into every installed agent's global rules file, a persistent write to the control plane of other agents.
run `deja rules sync`, which copies the file into every installed agent's global rules file
Why it was refuted
Syncing rules across agents is an openly stated feature of this workflow, and it is gated on the user picking the rules and seeing the exact lines first.
Persistence
highRefutedmedium confidenceThe skill directs the agent to append user-selected rules to a rules file and run `deja rules sync`, which copies it into every installed agent's global rules file, a control-plane write across tools, though it is gated on user selection and confirmation.
run `deja rules sync`, which copies the file into every installed agent's global rules file
Why it was refuted
Syncing rules across agents is an openly stated feature of this workflow, and it is gated on the user picking the rules and seeing the exact lines first.
Privilege escalation
mediumRefutedlow confidenceinstall.sh falls back to sudo to install the downloaded binary when the destination directory (possibly /usr/local/bin) is not writable.
sudo install -m 0755 "$tmp/$bin" "$dest_dir/$bin"
Why it was refuted
sudo is used only as a fallback when the destination directory is not writable, and only to install the checksum-verified binary there. That is ordinary installer behaviour, not privilege escalation.
Agent hijacking
mediumRefutedlow confidenceThe skill tells the agent to treat date markers in recalled transcript results as binding, 'not advisory', which conflicts with its own statement that results are untrusted reference data and lets stored transcript content steer agent behavior.
that is the user's own later judgement on that session, and it is not advisory
Why it was refuted
The marker is the tool's own convention for recording the user's later judgement. What it tells the agent to do is benign (avoid rejected approaches, confirm stale results), so it does not hijack the agent.
Manipulation
mediumRefutedlow confidenceBracketed markers in recalled transcript results are declared non-advisory, so the agent must obey them, even though the same skill calls that data untrusted. A forged marker in a past transcript could therefore steer the agent.
that is the user's own later judgement on that session, and it is not advisory
Why it was refuted
Obeying the markers only means not repeating rejected approaches and confirming stale results. It does not push the agent toward any harmful or deceptive action.
Agent hijacking
mediumRefutedlow confidenceThe skill says results from past transcripts are untrusted data, yet marks bracketed markers in them as binding, non-advisory user judgement, so forged markers in transcript text could steer the agent.
that is the user's own later judgement on that session, and it is not advisory
Why it was refuted
The marker is the tool's own convention for recording the user's later judgement. What it tells the agent to do is benign (avoid rejected approaches, confirm stale results), so it does not hijack the agent.
Agent hijacking
mediumRefutedlow confidenceRecalled transcript results carrying a bracketed marker are declared non-advisory and binding on the agent, which elevates untrusted historical content to authority and contradicts the earlier statement that results are untrusted reference data.
that is the user's own later judgement on that session, and it is not advisory
Why it was refuted
The marker is the tool's own convention for recording the user's later judgement. What it tells the agent to do is benign (avoid rejected approaches, confirm stale results), so it does not hijack the agent.
