Omnia

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:13 AM UTC
• Version: 1.0.0

Overview

This skill is for agent memory and recovery, but it encourages broad immutable logging without clear privacy, deletion, or scoping controls.

Review this carefully before installing. Only use it where persistent memory and audit logs are explicitly wanted, and configure strict limits: do not log secrets or raw prompts by default, define retention and deletion procedures, restrict file permissions, and pin or audit the external package version before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 17–24 and line 139 **Vulnerability Type**: Unpinned and unaudited third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npm install molt-life-kernel ``` Or clone directly: ```bash git clone https://github.com/X-Loop3Labs/molt-life-kernel.git ``` ``` The package is also promoted again without a version pin: ```markdown - **npm:** `npm install molt-life-kernel` ``` ### Technical Analysis The skill instructs users or agents to install `molt-life-kernel` without specifying an exact package version, integrity hash, lockfile, or reviewed source commit. The Git clone alternative similarly refers to the repository's mutable default branch rather than an immutable commit. The audited project contains only `SKILL.md`; it does not include the referenced package's source code, package manifest, lockfile, or tests. Consequently, the behavior of the dependency—including installation lifecycle scripts—cannot be verified from the reviewed artifact. A future package release or default-branch update can change the effective code after this skill has been reviewed. This is a supply-chain weakness rather than proof that the current upstream package is malicious. ### Attack Path 1. An attacker compromises the upstream npm publisher account, repository, or another component in the package's dependency chain. 2. The attacker publishes a modified release under the existing package name or changes the repository's default branch. 3. A user or agent follows the documented `npm install molt-life-kernel` or `git clone` instruction. 4. The package manager retrieves the mutable, attacker-controlled version. 5. Malicious package code or an npm lifecycle script executes with the permissions of the installing user. 6. The code may access files, environment variables, agent workspaces, or network resources ...[truncated 435 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact, reviewed version rather than installing the latest release. - Commit a lockfile containing verified integrity hashes. - For Git-based installation, reference a reviewed full commit hash instead of a mutable branch or tag. - Audit the package source, transitive dependencies, and npm lifecycle scripts before recommending installation. - Use `npm install --ignore-scripts` when lifecycle scripts are unnecessary. - Run the package in a least-privilege environment with restricted filesystem and network access. - Document the verified version, commit, expected checksums, and update-review procedure in `SKILL.md`.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51
• Finding: Overbroad Immutable Logging May Persist Sensitive Agent Data## Vulnerability Details **File Location**: `SKILL.md`, lines 51–52, 73–77, and 116–120 **Vulnerability Type**: Insecure sensitive-data collection and retention guidance **Risk Level**: Medium ### Vulnerable Code ```javascript // Tenet 1: Record everything — append-only, never delete kernel.append({ type: 'user_query', payload: 'What is molt.church?' }); ``` Additional instructions reinforce unrestricted retention: ```markdown - **Agent keeps forgetting context** → Append-only ledger preserves everything - **Agent needs crash recovery** → Snapshot + rehydrate pattern - **High-risk actions need approval** → Witness gate with human-in-the-loop - **Agent behavior seems off** → Coherence enforcement catches drift - **User wants audit trail** → Every action is logged, timestamped, immutable ``` The integration example also directs agents to log broad categories of activity: ```javascript // In your AGENTS.md or custom skill // "Use molt-life-kernel to maintain session continuity. // Run kernel.enforceCoherence() at the start of each session. // Append all significant actions to the ledger. // Witness-gate any destructive operations." ``` ### Technical Analysis The instructions encourage agents to “record everything,” preserve it indefinitely, and make records immutable. However, the skill does not define an event allowlist, data classification policy, secret filtering, user-consent mechanism, retention period, access controls, encryption requirements, or deletion process. User queries and records of agent actions may contain API keys, authentication tokens, personal information, proprietary source code, private conversation content, or confidential workspace paths. Persisting those values in a ledger and copying them into crash-recovery snapshots expands both their lifetime and the number of locations from which they could be exposed. Append-only integrity does not provide confidentiality. An immuta ...[truncated 1566 chars]
• Remediation: ## Remediation Suggestions - Replace “record everything” with an explicit allowlist of necessary event types and fields. - Do not log complete user queries, credentials, authorization headers, cookies, private keys, or raw tool inputs and outputs by default. - Apply secret detection and structured redaction before data reaches the ledger. - Minimize payloads by recording event identifiers, outcomes, and non-sensitive metadata instead of full content. - Define retention periods and provide deletion or cryptographic-erasure procedures, including for snapshots and backups. - Encrypt ledger and snapshot data at rest using keys stored separately from the data. - Restrict storage permissions to the dedicated agent identity and document secure workspace configuration. - Require informed user consent before enabling persistent memory. - Provide mechanisms to inspect, export, correct, and delete stored personal information where applicable. - Test logging and recovery paths to ensure redacted information cannot reappear from snapshots or secondary copies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The invocation guidance is overly broad because it triggers not only on explicit requests for persistence tooling, but also on generic discussion topics like AI safety, identity persistence, agent health, or mentions of 'molt' and related terms. This can cause the skill to activate in contexts where persistent logging or continuity features were neither requested nor appropriate, increasing the chance of unnecessary data retention or intrusive behavior.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instruction to 'record everything' in an append-only ledger encourages comprehensive retention of user interactions and system activity without filtering, minimization, or sensitivity checks. In practice this can capture credentials, personal data, regulated content, or confidential business information and make later deletion difficult or impossible because the storage model is immutable.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes audit-ready persistent logging and immutable retention across sessions without clearly warning that user data may be stored long-term, potentially including sensitive prompts, actions, and metadata. In a memory/persistence skill, omission of retention limits, consent requirements, and privacy boundaries is dangerous because it normalizes collection before users understand the implications.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The guidance frames preserving everything the user provides and logging every action immutably as a normal operational pattern. This is risky because it establishes blanket retention as the default behavior, which can conflict with least-privilege, privacy-by-design, and data protection obligations while magnifying harm if the ledger is exposed.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The OpenClaw integration example instructs agents to append all significant actions to a persistent ledger, creating a direct operational path to continuous cross-session surveillance of user and agent behavior. Because it is framed as integration guidance, implementers are likely to adopt it verbatim, propagating unsafe defaults into production deployments.

Static analysis

No suspicious patterns detected.