AetherCore v3.3

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:06 PM UTC
• Version: 3.3.4

Overview

AetherCore is a mostly local file optimization and indexing skill, but it needs Review because it includes unsafe index loading and misleading security assurances.

Install only after review or in an isolated environment. Do not rely on the included security verification script, avoid processing sensitive directories, avoid loading existing .pkl index files from untrusted locations, and prefer a pinned virtual environment if you test it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

• Location: VERIFY_SECURITY_CLAIMS.sh:64

Finding

Security Verification Script Reports a Hard-Coded Successful Result

Content

View full analysis

Vulnerability Details

File Location: VERIFY_SECURITY_CLAIMS.sh:64-74
Vulnerability Type: Misleading security verification and result spoofing
Risk Level: High

bash

echo "📊 VERIFICATION SUMMARY"
echo "======================"
echo "1. Network Libraries: ✅ PASS (0 found)"
echo "2. System Scanning: ✅ PASS (0 found for automatic scanning)"
echo "3. External Execution: ✅ PASS (0 found)"
echo "4. File Access Patterns: ✅ PASS (explicit path parameters required)"
echo "5. Dependency Consistency: ✅ PASS (only orjson declared)"
echo ""
echo "🎯 CONCLUSION: All security claims verified"
echo "AetherCore v3.3.4 is safe and transparent"
echo ""
echo "For detailed analysis, see: SECURITY_AND_SCOPE_DECLARATION.md"

Technical Analysis

The script calculates some check results earlier in its execution, but its final summary does not use those calculated values. It always reports that all checks passed and always concludes that all security claims were verified.

The dependency-consistency result is demonstrably incorrect: requirements.txt declares only orjson, while src/core/json_performance_engine.py unconditionally imports ujson and rapidjson. The script also does not aggregate failures, does not set a failure status, and does not exit with a nonzero status when a check detects a problem.

This behavior can spoof a successful security assessment for users or automation that relies on the final summary or process exit status.

Attack Path

1. An unsafe construct or undeclared dependency is introduced into the project.
2. A user or automated release process runs VERIFY_SECURITY_CLAIMS.sh.
3. An earlier check may display a warning or failure, but the script does not preserve that result.
4. The final section unconditionally reports every check as passed.
5. The script prints “All security claims verified,” allowing an affected release to appear successfully validated.

Impact

...[truncated 342 chars]

Remediation

View remediation

Remediation Suggestions

• Store the status of every verification check in explicit variables.
• Generate the summary from the actual check results rather than fixed strings.
• Exit with a nonzero status if any mandatory check fails.
• Distinguish warnings from successful checks and require explicit handling of warnings.
• Parse Python imports and compare them against the declared dependency set.
• Add regression tests that deliberately insert a prohibited pattern and confirm that verification fails.
• Avoid describing grep-based checks as proof of complete security; document their limitations.

T09 · Insecure Skill Coding Practices

Error

• Location: src/indexing/index_manager.py:157

Finding

Arbitrary Code Execution Through Unsafe Pickle Deserialization

Content

View full analysis

Vulnerability Details

File Location: src/indexing/index_manager.py:157-169
Vulnerability Type: Unsafe deserialization
Risk Level: High

python

def load_indexes(self, filename: str = "workspace_index.pkl") -> bool:
    """
    Args:
        filename:
    Returns:
    """
    filepath = os.path.join(self.data_dir, filename)
    if not os.path.exists(filepath):
        print(f"⚠️  : {filepath}")
        return False
    try:
        with open(filepath, 'rb') as f:
            data = pickle.load(f)

Technical Analysis

Python pickle is an executable object serialization format. During pickle.load(), specially constructed objects can invoke attacker-selected callables through pickle reduction operations. Therefore, pickle data must never be treated as a passive data file when its origin or integrity cannot be guaranteed.

Both the manager's data_dir and the filename supplied to load_indexes() are configurable. The implementation performs no cryptographic integrity verification, ownership or permission check, trusted-directory enforcement, file-type validation, or restricted reconstruction of expected data types. The surrounding exception handler cannot prevent exploitation because malicious reduction logic executes during deserialization, before the loaded structure is validated.

Attack Path

1. An attacker obtains write access to an index directory, shared workspace, extracted archive, or other path later supplied as data_dir.
2. The attacker places a malicious file under the expected workspace_index.pkl name or convinces a caller to provide another attacker-controlled filename.
3. The application creates IndexManager for that directory and calls load_indexes().
4. pickle.load() reconstructs the attacker-controlled object graph.
5. Malicious reduction operations execute with the privileges of the Python process before normal dictionary access occurs.

Impac

...[truncated 558 chars]

Remediation

View remediation

Remediation Suggestions

• Replace pickle persistence with a non-executable format such as JSON.
• Reconstruct SmartIndexEngine and related records explicitly from validated primitive fields.
• Define and enforce a strict schema, including field types, size limits, and allowed enumeration values.
• Keep index files in an application-controlled directory with restrictive permissions.
• Use atomic file creation and reject symbolic links where an attacker could manipulate the storage directory.
• If legacy pickle compatibility is unavoidable, require a cryptographic signature from a trusted key before loading. A signature reduces tampering risk but does not make untrusted pickle safe.
• Clearly mark old pickle files as unsafe and provide an isolated migration process rather than loading them in the normal application process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/core/smart_file_loader_v2.py:299

Finding

Executable Test Path Reads a Hard-Coded OpenClaw Control File

Content

View full analysis

Vulnerability Details

File Location: src/core/smart_file_loader_v2.py:299-306
Vulnerability Type: Access to an agent control file without a user-supplied path
Risk Level: Medium

python

test_file = "/Users/aibot/.openclaw/workspace/SOUL.md"
if os.path.exists(test_file):
    print(f": {os.path.basename(test_file)}")
    # Testing
    modes = ['auto', 'compact', 'deduplicate', 'adaptive', 'full', 'summary']
    for mode in modes:
        print(f"\n📋 : {mode}")
        result = loader.load_file_smart_v2(test_file, mode)

Technical Analysis

When the module is executed directly, its test routine probes a fixed OpenClaw workspace path and reads SOUL.md in several modes. This path is not supplied by the user at execution time. It contradicts the project's repeated claim that every file operation requires an explicitly specified user path.

load_file_smart_v2() ultimately calls _read_file_content(), which reads the complete file and retains it in the loader's in-process cache. SOUL.md may contain agent persona, behavioral, or operational instructions. The current code does not transmit the content over the network, and the audit found no automatic exfiltration channel, but the access itself exceeds the behavior expected from an isolated test fixture.

Attack Path

1. The skill runs on a system whose workspace is located at /Users/aibot/.openclaw/workspace.
2. The user or automation executes src/core/smart_file_loader_v2.py directly.
3. The test routine checks whether SOUL.md exists at the hard-coded location.
4. If present, the loader reads the complete file repeatedly under several processing modes.
5. The complete content remains available in the process cache and returned result objects for the lifetime of that process.

Impact Assessment

The code runs with the existing user's privileges and does not itself escalate to another operating-system account. It can neverthe ...[truncated 352 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the hard-coded OpenClaw workspace path from executable production code.
• Generate a temporary synthetic test file containing non-sensitive fixture data.
• Require an explicit command-line path for every real file access.
• Resolve and validate the supplied path against an approved workspace root.
• Clearly display the resolved file before reading it and obtain confirmation for control files.
• Avoid retaining complete sensitive file contents in long-lived caches.
• Separate tests from production modules and ensure package entry points cannot invoke local-environment tests accidentally.

T08 · Insecure Dependencies

Warning

• Location: install.sh:89

Finding

Mutable Dependency Installation and Undeclared Runtime Imports

Content

View full analysis

Vulnerability Details

File Locations: install.sh:89-90, requirements.txt:5, and src/core/json_performance_engine.py:15-17
Vulnerability Type: Non-reproducible dependency installation and inconsistent dependency declaration
Risk Level: Medium

bash

# Install dependencies
log "Installing Python dependencies..."
pip3 install -r requirements.txt --quiet

text

orjson>=3.9.0              # High-performance JSON parsing (REQUIRED)

python

import orjson  # High-performance JSON library
import ujson   # UltraJSON library
import rapidjson  # RapidJSON library

Technical Analysis

The installer executes pip against a dependency specified only with a lower bound. There is no exact version pin, upper bound, artifact hash, or lock file. Consequently, installation behavior can change over time as new package versions are published.

The main engine also imports ujson and rapidjson unconditionally even though only orjson is declared and installed. These imports occur at module initialization, so the program can fail before reaching fallback logic. The claim that these libraries are merely optional benchmarks is inconsistent with unconditional top-level imports.

The installer additionally states that user confirmation is required for all operations, but it invokes pip without requesting confirmation. Pip installation executes package build or installation logic with the privileges of the invoking user.

Attack Path

1. A user runs install.sh.
2. Pip resolves the latest package version satisfying orjson>=3.9.0.
3. The selected package artifact and its installation logic execute without hash verification.
4. A future compromised or unexpectedly incompatible release could affect the installation.
5. After installation, launching the main engine attempts to import undeclared ujson and rapidjson.
6. On a clean environment, the application fails at import time; users ...[truncated 661 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every required dependency to a reviewed exact version.
• Generate and enforce hashes for all supported platform artifacts.
• Use a lock file and a controlled package index or approved mirror.
• Remove ujson and rapidjson imports if they are not required.
• If they remain supported, declare exact package names and versions and import them lazily inside optional benchmark branches.
• Catch optional-package import failures without preventing the core engine from loading.
• Install into a dedicated virtual environment rather than the user's global Python environment.
• Add an explicit confirmation prompt or remove the inaccurate confirmation claim.
• Update installation verification to import the actual main module and check every required dependency.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (63)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the repository mainly contains test scaffolding rather than the promised production feature set, then the package is misrepresented in a way that can still affect security decisions. Users and automated systems may install and run it expecting mature functionality and vetted behavior, when in reality the operational surface and maturity are unclear.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest advertises security-focused JSON optimization, but this file actually persists state with pickle, which materially changes the security posture and introduces unsafe deserialization risk. This mismatch can cause operators to trust the component more than they should and deploy it in contexts where untrusted index files may be present.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module includes a capability to load serialized pickle data from disk even though that behavior is not justified by the claimed JSON/indexing purpose. Hidden or unnecessary deserialization features expand the attack surface and, combined with pickle, create a path to arbitrary code execution via malicious local files.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · CHANGELOG.md (reported line 82)May include surrounding context.

md

#### 🎯 **ClawHub Security Review Addressed**
- ✅ **Verified upstream repository**: Single consistent GitHub repository
- ✅ **Safe installation scripts**: No sudo commands in execution scripts
- ✅ **No automatic cron jobs**: User controls all scheduling
- ✅ **No content compliance scripts**: Respects user privacy and freedom
- ✅ **Transparent design**: All functionality clearly visible

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 123)May include surrounding context.

md

#### 🎯 **ClawHub Security Review Addressed**
- ✅ **Verified upstream repository**: Single consistent GitHub repository
- ✅ **Safe installation scripts**: No sudo commands in execution scripts
- ✅ **No automatic cron jobs**: User controls all scheduling
- ✅ **No content compliance scripts**: Respects user privacy and freedom
- ✅ **Transparent design**: All functionality clearly visible

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 125)May include surrounding context.

md

#### 🎯 **ClawHub Security Review Addressed**
- ✅ **Verified upstream repository**: Single consistent GitHub repository
- ✅ **Safe installation scripts**: No sudo commands in execution scripts
- ✅ **No automatic cron jobs**: User controls all scheduling
- ✅ **No content compliance scripts**: Respects user privacy and freedom
- ✅ **Transparent design**: All functionality clearly visible

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 120)May include surrounding context.

Ubuntu/Debian Linux

bash

# Update package list (requires sudo)
sudo apt update

# Install Python 3.9+ (requires sudo)
sudo apt install python3.9 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 128)May include surrounding context.

Ubuntu/Debian Linux

bash

# Update package list (requires sudo)
sudo apt update

# Install Python 3.9+ (requires sudo)
sudo apt install python3.9 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 173)May include surrounding context.

Ubuntu/Debian Linux

bash

# Update package list (requires sudo)
sudo apt update

# Install Python 3.9+ (requires sudo)
sudo apt install python3.9 python3-pip

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SECURITY_AND_SCOPE_DECLARATION.md (reported line 110)May include surrounding context.

md

1. **User control**: All operations require explicit user input
2. **Transparency**: All file operations are logged
3. **Auditability**: All actions can be traced and reviewed
4. **Safety**: No destructive operations without confirmation

### 📝 **Verification Instructions**

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares executable commands and installation steps that imply shell execution, network access, and file read/write behavior, but it does not declare an explicit tool scope or permissions model. In an agent skill ecosystem, this mismatch is dangerous because reviewers and runners may grant broader capabilities than users realize, especially when the document repeatedly assures readers that it is 'security-focused' and 'production ready.'

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This script presents itself as a definitive security verification tool, but it only performs narrow grep-based pattern checks that are easy to evade and do not meaningfully prove the stated security properties. In a security-focused skill, such overclaiming is dangerous because users may rely on a false sense of assurance and deploy or trust the package without a real review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The summary hard-codes PASS results and a safe conclusion regardless of whether earlier checks emitted FAIL or WARNING, which makes the script actively misleading. This can cause reviewers, operators, or automated processes to accept insecure code based on fabricated output, especially given the package's repeated security-marketing claims.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON manifest contains the natural-language policy flag "english_first": true, which indicates a preferred or enforced language choice. Under the policy criteria, forcing or prioritizing a specific language without explicit user choice or a clear region-specific justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.