Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a local agent demo rather than a backdoor, but it needs Review because its memory, monitor, and policy-execution controls are too weak for sensitive use.
Install only in an isolated virtual environment. Treat this as a demo framework, not a security boundary: do not rely on PolicyExecutor to block network, filesystem, subprocess, or other side effects from untrusted tools. Avoid running the web monitor with secrets or sensitive prompts, stop it when finished, and harden memory storage by validating agent IDs before using this with untrusted input.
src/protocol/memory.py:4Path Traversal in Agent Memory Storage
src/tools/policy_executor.py:6Policy Executor Does Not Enforce Its Declared Network Policy
src/web/thought_tree.py:65HTML Injection Through Unescaped Confidence Values
install.sh:9Mutable and Unhashed Dependency Installation
The declared description presents a broad agent framework with policy-guarded execution semantics, but the supplied code chunk only performs local dependency installation. While installation can be a supporting detail, this specific code does not itself implement or demonstrate the described framework behavior. Its primary purpose is setup/package installation, which is materially different from the declared operational purpose of the skill.
The declared description describes a substantial autonomous-agent framework with policy-guarded execution and composability on ClawHub. The provided code chunk only implements minimal placeholder perception utilities for text and image analysis, and even those do not perform real analysis beyond string formatting. This is a materially different primary purpose from the declared framework, so the description does not accurately represent the code shown.
The description claims a broader agent framework with local-first architecture, observability, composability, and policy-guarded execution on ClawHub. The supplied code only provides a basic reasoning helper that simulates thought output, plus optional TUI display and optional cryptographic signing. Those behaviors do not substantiate the declared primary purpose, and key claimed capabilities like policy enforcement and ClawHub execution are absent from this chunk. Additionally, signing outputs with a crypto interface is an extra capability not reflected in the description.
The supplied code only loads a YAML configuration file and returns specific fields (IDENTITY, EQUIP, GRANT, DENY). This is materially narrower and different from the declared description of a universal autonomous entity framework with observable/composable agents and policy-guarded execution on ClawHub. While configuration parsing could be a supporting component of such a system, the declared purpose describes a much broader framework and execution model that is not represented in this code chunk. The code also performs local file access, which is not reflected in the declared permissions list.
The declared description presents a broad autonomous agent framework with observability, composition, and policy-guarded execution. The supplied code chunk only implements two terminal display helpers for showing thought text and tool names. While UI observability could be a supporting detail, exposing chain-of-thought is a specific behavior not reflected in the description, and the code does not evidence the core claimed framework capabilities such as execution control, policy enforcement, composability, or ClawHub integration. This is therefore a meaningful description-to-behavior mismatch for this chunk.
The supplied code chunk does not implement a general 'Universal Autonomous Entity Standard' framework, agent composition system, or policy-guarded execution on ClawHub. Instead, it is narrowly focused on one function: serving a local web page that visualizes provided thought-tree data and raw JSON. While this could be a small observability component within a larger agent framework, the declared description presents the skill as a broad local-first agent framework, whereas the code shown is specifically a monitoring/viewer utility with HTTP serving behavior. That is a materially different primary purpose from the declared description.
The handler directly extracts and displays the internal prompt from in-memory agent data, which is a direct confidentiality leak of model inputs and potentially hidden instructions or secrets. In an agent framework, prompts often contain system directives, user data, tokens, or task context, so exposing them through a web endpoint increases the risk of prompt disclosure and downstream compromise.
self.send_response(404)
self.end_headers()
self.wfile.write(b"Not Found")
return
prompt = html.escape(str(self.data.get("prompt", "")))
tree = self.data.get("thought_tree", {})
Without declared permissions the skill's intent is opaque and cannot be validated.
The function persists arbitrary memory data to a JSON file, which can affect user data and filesystem state. There is no confirmation prompt, log message, comment, or docstring indicating that the skill stores data locally.
The file write path is influenced by untrusted input in two ways: the base directory comes from the BOT_MEMORY_DIR environment variable and the filename embeds unsanitized agent_id. An attacker who can control either value can cause writes outside the intended memory store via path traversal or redirection to sensitive filesystem locations, leading to file overwrite or data corruption.
def save_memory(agent_id: str, data: dict):
path = os.path.join(MEMORY_PATH, f"{agent_id}.json")
with open(path, "w", encoding="utf-8") as f:
json.dump(data, f, indent=2, ensure_ascii=False)
def load_memory(agent_id: str):
The function renders the agent's internal thought_process directly to the terminal, which can expose sensitive reasoning, hidden prompts, secrets copied into reasoning state, or internal policy/debug data to anyone with terminal access or logs. In an agent framework, chain-of-thought disclosure is more dangerous than ordinary debug output because it may reveal internal decision logic and confidential intermediate content not intended for users.
This code intentionally launches a local HTTP server and renders sensitive runtime state, including the prompt and thought-tree contents, into a browser-accessible page. Even though it binds to 127.0.0.1 by default, any local process, browser extension, malware, or user-triggered page that can reach localhost may read this internal agent data, creating confidentiality exposure for prompts, reasoning traces, and possibly other embedded secrets.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
This code contains natural-language comments/docstrings in Chinese, including the feature description at L08 and L25-L27, with no indication that language choice is configurable or user-selected. Under the stated policy, forcing a specific language without opt-in is a locale/language policy concern.
The natural-language docstrings at L10-L18 are written only in Chinese, which imposes a specific language choice without any opt-in or justification. The policy explicitly calls for flagging language or locale constraints when the skill does not offer a user language choice or document a justified regional scope.
The code accesses BOT_MEMORY_DIR to determine where persistent memory files are stored. Access to environment-derived configuration that influences data storage is not explained via comments, docstrings, or user-facing output.
The docstrings are written only in Chinese, which indicates a fixed language choice without offering user selection or documenting a justified locale restriction. This can violate language/locale policy when the skill is not clearly scoped to a Chinese-only environment.
No suspicious patterns detected.