Skill Cortex Pub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:23 AM UTC
• Version: 0.0.2

Overview

This skill is openly designed to install and route third-party skills, but its broad acquisition flow and persistent routing memory deserve user review before installation.

Install only if you are comfortable with an agent that can recommend, install, and execute additional skills after approval. Prefer using it with trusted ClawHub publishers or pinned GitHub sources, inspect proposed skills before approving them, and periodically review or delete ~/.openclaw/skill-cortex/cortex.json if you do not want routing history retained.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unverified Third-Party Skill Acquisition and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5, 21-29
Vulnerability Type: Third-party supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet

markdown

When lacking ability, it autonomously acquires Skills from ClawHub or GitHub, then releases them after use.

markdown

## Phase 1: Perception

1. Read cortex.json (if missing or corrupt, skip to step 3).
2. Semantically match the users task description against sensory.patterns signals.
3. On miss, search ClawHub.

## Phase 2: Validation

Present candidates to the user with safety info. Wait for explicit approval before installing.

## Phase 3: Execution

Install the Skill, generate an execution plan, execute the task. On failure, auto-recover or switch to next candidate.

Supporting source-selection behavior is also documented at DESIGN.md:42-43:

jsonc

"source": "clawhub",          // "clawhub" | "github"
"version": "1.2.0",           // locked version for reflex validation

Technical Analysis

The Skill directs the Agent to discover, install, and execute dynamically selected third-party Skills from ClawHub or GitHub. Although explicit user approval is required before installation, the documented validation process does not require:

• Cryptographic signature verification
• Artifact checksum verification
• Trusted-publisher or repository allowlisting
• Pinning GitHub sources to immutable commit hashes
• Local source inspection before execution
• Sandboxed execution with least-privilege controls

Marketplace safety metadata and user consent do not independently establish artifact authenticity or safety. Recording a version for later reflex validation only detects subsequent version changes; it does not verify that the initially selected version is trustworthy.

This creates a supply-chain trust boundary in which external Skill content may become executable Agent instructions or code after only metadata-based review. A malicious publisher, compromised acco ...[truncated 1598 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict acquisition to explicitly trusted ClawHub publishers and allowlisted GitHub organizations or repositories.
2. Pin every installation to an immutable artifact digest or Git commit rather than relying only on a mutable version label or branch.
3. Require cryptographic signature and checksum verification before installation.
4. Download candidates into a quarantine directory and inspect all Skill instructions, scripts, manifests, dependencies, and declared side effects before requesting approval.
5. Present the user with verified publisher identity, immutable version identifier, requested permissions, network destinations, filesystem access, and detected executable content.
6. Execute newly acquired Skills in a sandbox with denied-by-default filesystem, environment-variable, credential, network, shell, and Agent-tool access.
7. Grant only the minimum capabilities required for the specific task and require separate approval for privilege expansion.
8. Revalidate the exact artifact before every installation and reflex invocation; demote or block the Skill whenever its digest, signature, dependencies, or permission requirements change.
9. Maintain a local denylist for known-malicious publishers, repositories, package names, hashes, and versions.
10. Record provenance and verification results in cortex.json without storing secrets or personal data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The design stores a persistent cortex file containing behavioral metadata such as task regions, usage history, candidate skills, failures, and environment-variable names, but does not require an explicit user-facing warning or consent flow at the storage point. Because this skill manages short-term capability memory and fetches third-party skills, silent persistence creates a meaningful privacy and local data exposure risk if the file is read, uploaded, or exfiltrated by another component.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The design explicitly relies on semantic matching to judge intent alignment but does not define rejection criteria, confidence thresholds, or negative examples. In a skill that autonomously acquires and routes external capabilities, this ambiguity can cause over-broad activation and incorrect skill selection, increasing the chance of unintended installs or execution of higher-risk skills.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md

- **Entity filtering**: signal words are stripped of personal data before storage
- **Synaptic pruning**: stale routes and low-confidence lessons are automatically cleaned up
- **Failure recovery**: auto-retry, candidate switching, and structured error reporting
- **Safety-first**: write operations never enter reflex; all installs require user consent

## Installation

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition 'when installed Skills cannot complete the current task' is broad and subjective, which can cause this skill to activate in many ambiguous situations. In a skill that can search external sources and install new capabilities, ambiguous triggering increases the chance of unnecessary acquisition flows, expanding attack surface and potentially pressuring users into approving risky skills.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.