Skill Cortex Pub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:23 AM UTC
• Version: 1.0.1

Overview

This skill is openly designed to install and run other skills on demand, but its broad third-party acquisition, reflex execution, and persistent routing memory need careful review before use.

Install only if you intentionally want an agent to discover, install, and run other skills for you. Prefer trusted ClawHub sources, avoid unreviewed GitHub candidates, require explicit approval for every install and candidate switch, and do not allow reflex mode for skills that read credentials, local sensitive data, or use the network. Periodically inspect or reset `~/.openclaw/skill-cortex/cortex.json`.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:29

Finding

Unreviewed Third-Party Skills Can Be Retrieved and Executed

Content

View full analysis

"`. Read summaries only, pick up to **3** candidates. If fewer than 2 relevant results, supplement with a GitHub search (mark as unreviewed source). ``` ```markdown ### 3.1 Install ```bash clawhub install ``` On failure, auto-switch to the next candidate. Max **2** switches, then stop and report. ### 3.2 Execution Plan Read the installed Skill's SKILL.md and present to the user: - Step summary - Side-effect severity: 🟢 read-only 🟡 write 🔴 destructive 🔑 sensitive credentials ⚙️ shell commands - Relevant prefrontal lessons (if any) — e.g., proactively check for a dependency known to be commonly missing **Reflex mode skips this step. Standard mode waits for user confirmation.** ### 3.3 Execute Follow the Skill's instructions to complete the task. ``` ### Technical Analysis The Skill searches external registries and may supplement results with GitHub candidates that it explicitly identifies as unreviewed. Candidate selection is based on search summaries and metadata, but the workflow does not require: - Cryptographic signature or checksum verification - Immutable version or commit pinning for initial installations - Publisher identity verification - Inspection of all package files and scripts - Rejection or sandboxing of unreviewed GitHub sources - Verification that declared side effects match actual behavior After installation, the Agent is instructed to follow the downloaded Skill's instructions. This transfers part of the Agent's effective control flow to mutable, externally supplied content. User approval based on a summary does not establish that the installed package is trustworthy or behaves as advertised. Although the project contains no embedded malicio ...[truncated 1635 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Reflex Installation Uses Opt-Out Consent Despite Requiring Explicit Confirmation

Content

View full analysis

= 0.90 AND consecutive successes >= 5 - **No write side effects** (side_effects contains no `write:`/`delete:`/`shell:` prefix) - **Version unchanged** (slug + version match the stored record) Reflex mode **skips only the execution plan confirmation**. Installation still requires user notification: ``` ⚡ Skill Cortex reflex: todoist-cli v1.2.0 (96% success rate) Task: query today's todos (read-only) | Will install and execute. Say cancel to abort. ``` ``` ```markdown Read the installed Skill's SKILL.md and present to the user: - Step summary - Side-effect severity: 🟢 read-only 🟡 write 🔴 destructive 🔑 sensitive credentials ⚙️ shell commands - Relevant prefrontal lessons (if any) — e.g., proactively check for a dependency known to be commonly missing **Reflex mode skips this step. Standard mode waits for user confirmation.** ``` ```markdown ## Boundary Rules 1. Never interfere with long-term Skills. 2. Installation requires user confirmation (including reflex mode). 3. System dependency installation requires separate confirmation. ``` ### Technical Analysis The boundary rules require user confirmation for all installations, including reflex mode. However, the reflex notification states that installation and execution will proceed unless the user says “cancel.” This is an opt-out workflow and does not obtain explicit affirmative confirmation. The inconsistency can cause the Agent to interpret silence, delayed input, or an unrelated response as authorization. Reflex mode also skips execution-plan confirmation, so the user may not see the detailed side effects before the downloaded ...[truncated 1661 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:37

Finding

Reflex Eligibility Permits Credential Reads Combined with Outbound Network Access

Content

View full analysis

= 0.90 AND consecutive successes >= 5 - **No write side effects** (side_effects contains no `write:`/`delete:`/`shell:` prefix) - **Version unchanged** (slug + version match the stored record) ``` The documented side-effect schema expressly permits credential reads and network access without classifying either as a reflex-blocking effect: ```jsonc "side_effects": [ // side-effect tags "read:env:TODOIST_API_KEY", "network:api.todoist.com" // write-op prefixes: "write:", "delete:", "shell:" // Skills with these prefixes can NEVER enter reflex mode ], ``` The corresponding promotion logic is: ```markdown ### Promotion Conditions (ALL must be met) 1. `runs.success >= 5` 2. `weight >= 0.90` 3. `side_effects` contains no `write:`, `delete:`, or `shell:` prefix 4. Current `reflex == false` ``` ### Technical Analysis Reflex eligibility blocks only side-effect tags beginning with `write:`, `delete:`, or `shell:`. It does not block: - Environment-variable reads - Credential or token reads - Sensitive local-file reads - Outbound network requests - A combination of sensitive reads and outbound communication The example schema explicitly combines `read:env:TODOIST_API_KEY` with `network:api.todoist.com`, yet such a candidate remains eligible for reflex promotion. Therefore, “read-only” is treated as safe even when the read target is a secret and a network exfiltration channel is available. The model also depends on side-effect metadata being complete and accurate. No mandatory package-level verification or runtime policy enforcement ensures th ...[truncated 1635 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

The README describes persistent local memory in ~/.openclaw/skill-cortex/cortex.json and promotion of frequently used skills into a faster "reflex" path, which constitutes session/task-derived state that can influence future behavior. Even though the document claims entity filtering and excludes write operations from reflex mode, persistent routing memory can still retain sensitive task patterns or create unsafe trust in previously selected third-party skills across sessions. In a skill that autonomously discovers and installs external capabilities, this persistence increases risk because prior interactions can affect later execution decisions.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md

- **Entity filtering**: signal words are stripped of personal data before storage
- **Synaptic pruning**: stale routes and low-confidence lessons are automatically cleaned up
- **Failure recovery**: auto-retry, candidate switching, and structured error reporting
- **Safety-first**: write operations never enter reflex; all installs require user consent

## Installation

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition is extremely broad: whenever installed skills cannot complete a task, this skill may autonomously acquire new skills from ClawHub or GitHub. In a system that installs and executes third-party capabilities, ambiguous activation materially increases the chance of unnecessary or premature invocation, expanding the attack surface and enabling untrusted code acquisition in situations where safer built-in handling might have sufficed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The semantic matching rule delegates scope decisions to the agent's 'own judgment on intent alignment,' which is effectively unconstrained routing logic for deciding when to reuse or acquire executable skills. In this context, that ambiguity is dangerous because it can misclassify tasks, invoke the wrong skill, bypass more careful candidate review paths, and cause installation/execution of unrelated or higher-risk capabilities based on weak similarity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.