Security audit

TriCore

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory framework, but it persistently changes agent policy, memory handling, and global compaction behavior in ways users should review carefully before installing.

Install only if you intentionally want TriCore to become a workspace-wide memory and workflow layer. Before running install.sh, review the POLICY.md changes, save your existing OpenClaw compaction prompt, back up MEMORY.md, and avoid enabling self-evolution unless edits to code, skills, and configuration are reviewed by a human first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: install.sh:103
Finding: System-Wide Agent Instruction Hijacking Through POLICY.md Injection
Content: View full analysis
> "$POLICY_FILE" echo "### Memory Management (TriCore Compliance)" >> "$POLICY_FILE" echo "- **[CRITICAL: TriCore Compliance]** The entire system adopts the 'TriCore' architecture. It is strictly forbidden to use stray markdown files (like task_plan.md, findings.md, memory/daily-learning/) in the root directory or unauthorized places to manage states!" >> "$POLICY_FILE" echo "- **Hard Constraint 1**: Any state persistence or knowledge accumulation **MUST** use python3 tools/memctl.py (capture|kb_append|work_upsert). Modifying markdown directly via shell (>>) is forbidden." >> "$POLICY_FILE" echo "- **Hard Constraint 2**: Before adding/modifying cron jobs or creating/editing any skill's SKILL.md, you **MUST run** 'python3 tools/memctl.py lint ' to review compliance. LINT ERROR means you must refactor." >> "$POLICY_FILE" echo "- **MEMORY.md** (Main memory file) must remain extremely short (summary + pointers). Dumping long documents here is prohibited." >> "$POLICY_FILE" echo "[TriCore] Injected Linter and architectural constraints into POLICY.md." ``` Related instruction-hijacking language also appears in `SKILL.md:14-18` and `README.md:1-3`, where the project describes itself as the Agent's fundamental operating-system law and base system directive. ### Technical Analysis The installer writes Skill-controlled instructions directly into the workspace-level `POLICY.md` and labels them as `CRITICAL`. These instructions are not limited to an active TriCore operation. They govern future state persistence, Skill editing, cron configuration, and general file-management behavior. A memory-management utility does not require authority o ...[truncated 1518 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: install.sh:115
Finding: Persistent Replacement of the Global Pre-Compaction Agent Prompt
Content: View full analysis
/dev/null ``` The configured prompt tells the Agent that compaction is imminent, directs it to extract unarchived facts and state, forbids normal editing methods, and requires use of TriCore commands. ### Technical Analysis The installation script unconditionally replaces `agents.defaults.compaction.memoryFlush.prompt`, a global OpenClaw configuration value. The replacement affects later compaction events outside the immediate installation process. This creates a persistent hook into a sensitive lifecycle operation. Pre-compaction handling can process conversation facts, workflow experience, and important state. Redirecting this behavior through Skill-controlled instructions exceeds what is necessary to provide an optional local memory-management command. The installer backs up `POLICY.md`, `MEMORY.md`, and `memctl.py`, but it does not capture the previous compaction prompt. Consequently, the prior user configuration cannot be restored accurately. ### Attack Path 1. The user runs the installer. 2. The installer invokes `openclaw config set` for the global pre-compaction prompt. 3. The replacement remains active after installation completes. 4. During a later session, OpenClaw reaches its compaction threshold. 5. The Agent receives the TriCore-authored prompt and is instructed to persist sele ...[truncated 754 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: cognitive-skills/self-evolution.md:22
Finding: Autonomous Internet-Derived Modification of Core Code and Agent Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/memctl.py:96
Finding: Arbitrary Markdown File Append Through kb_type Path Traversal
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: uninstall.sh:45
Finding: Uninstaller Fails to Restore Pre-Installation Configuration and Memory State
Content: View full analysis
/dev/null || true echo " - ✅ Config restored." # 5. Prompt about Data Recovery echo "" echo "==================================================" echo "[TriCore] Uninstallation Complete! / 卸载完成！" echo "" echo "⚠️ IMPORTANT / 重要提示:" echo "Your original MEMORY.md was NOT automatically restored to prevent data loss." echo "If you need your old massive MEMORY.md, you can find it in:" echo " -> memory/archive/legacy-MEMORY-.md" echo "You can manually rename it back to MEMORY.md if needed." ``` ### Technical Analysis The installer overwrites the pre-compaction prompt but does not save its previous value. The uninstaller then uses `config unset`, which removes the current value instead of restoring the exact pre-installation configuration. If the user had a custom prompt before installation, that value is lost. The installer may also move an existing `MEMORY.md` into `memory/archive` and create a new replacement. The uninstaller expressly does not restore the archived original, leaving the workspace in a different memory state after removal. The script reports that the configuration is restored even though it only unsets the key. This can give users a false assurance that the original environment has been recovered. ### Attack Path 1. A workspace starts with a custom compaction prompt and an existing `MEMORY.md`. 2. The user installs TriCore. 3. The installer overwrites the prompt and may archive the original memory file. 4. The user later runs `uninstall.sh`. 5. The uninstaller unsets the prompt instead of restoring its previous value. 6. The replacement `MEMORY.md` ...[truncated 602 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The '[SYSTEM DIRECTIVE]' text attempts to redefine the agent's governing rules, memory model, and future behavior by stating that all subsequent planning, recording, learning, and thinking must obey this file. Documentation must not masquerade as higher-priority instructions; if followed, it could cause instruction-hierarchy confusion, persistent behavior manipulation, and unsafe tool use based on untrusted repository content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Adding a highest-priority compliance block into system POLICY.md grants the skill persistent control over the agent's operating rules. In context, this is especially dangerous because the skill presents itself as infrastructure for memory and cognition, yet it attempts to elevate itself into a governing authority over all future disk writes and task planning.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 99% confidence
Finding: The code has substantial write capability: it creates and overwrites files, appends untrusted input into markdown files, and moves files into archive/session locations. In a memory-management skill this context makes file access expected, but also more dangerous, because the skill is designed to persist and reshape agent memory; without declared write permission and path restrictions, this can be abused to alter agent state, corrupt records, or overwrite unintended files via crafted arguments such as kb_type containing path traversal sequences.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 99% confidence
Finding: The code has substantial write capability: it creates and overwrites files, appends untrusted input into markdown files, and moves files into archive/session locations. In a memory-management skill this context makes file access expected, but also more dangerous, because the skill is designed to persist and reshape agent memory; without declared write permission and path restrictions, this can be abused to alter agent state, corrupt records, or overwrite unintended files via crafted arguments such as kb_type containing path traversal sequences.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · install.sh (reported line 32)May include surrounding context.
sh
# 2. Remove memctl.py engine if [ -f "$WORKSPACE_ROOT/tools/memctl.py" ]; then rm -f "$WORKSPACE_ROOT/tools/memctl.py" echo " - ✅ Removed memctl engine / 移除了 memctl 引擎" fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · uninstall.sh (reported line 31)May include surrounding context.
sh
# 2. Remove memctl.py engine if [ -f "$WORKSPACE_ROOT/tools/memctl.py" ]; then rm -f "$WORKSPACE_ROOT/tools/memctl.py" echo " - ✅ Removed memctl engine / 移除了 memctl 引擎" fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · uninstall.sh (reported line 38)May include surrounding context.
sh
# 3. Remove Cognitive Skills for skill in planning-with-files react-agent self-evolution; do if [ -d "$WORKSPACE_ROOT/skills/${skill}" ]; then rm -rf "$WORKSPACE_ROOT/skills/${skill}" echo " - ✅ Removed cognitive skill / 移除了认知技能: ${skill}" fi done

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document explicitly addresses any AI agent reading it and imposes mandatory behavioral constraints in Chinese without user opt-in or language selection. This can override or conflict with the user's preferred language and higher-priority instructions, reducing transparency and increasing the chance the agent follows skill-authored policy rather than the actual task context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is presented as a low-resource local memory framework, but its own documentation bundles and encourages a self-evolution capability that can modify code and optionally pull information from external sources. That mismatch increases the chance an operator enables broader execution and network behaviors than expected, creating a larger attack surface and making the skill materially more dangerous than the manifest framing suggests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs users to run an install script that injects top-priority content into POLICY.md, effectively altering system-level policy behavior without prominent disclosure at the point of execution. Modifying policy files is highly sensitive because it can change future agent constraints, override expected operating rules, and create persistence beyond the immediate skill session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installation flow describes automatically renaming, moving, and rebuilding MEMORY.md, which modifies existing user data and workflow state without a prominent safety warning or explicit confirmation step. In an agent environment, silent migration of memory/state files can cause data loss, integrity issues, and denial of service against the user's established memory system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The operational instructions directed at the agent are written as mandatory guidance in Chinese, with no indication that the agent may respond in the user's preferred language. This can violate language/locale policy when the skill is loaded in a broader environment serving users who did not opt into Chinese-only behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document asserts that memory writes must only occur through memctl, while elsewhere it describes direct modification of POLICY.md and replacement of MEMORY.md by install.sh. This inconsistency is dangerous because it obscures the true write paths and trust boundaries, making it easier to hide privileged file changes behind a supposedly strict architecture.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents behavior beyond a memory/cognitive framework by describing automatic override of host compaction prompts and broader system integration. That expands the skill's control surface into host-level policy and prompt behavior, which can alter agent safeguards and create hidden persistence or control channels inconsistent with the declared scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented compaction-hook or prompt override capability changes host-level runtime behavior in a way not clearly required for a memory framework. Such control can suppress normal safety prompts, modify agent decision boundaries, or create persistent behavioral drift that is difficult for users to detect.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Injecting compliance rules into a global POLICY.md gives the skill authority over future agent behavior outside its stated purpose. This is dangerous because it creates persistent, higher-priority behavioral control that may supersede user or platform expectations and can be abused to restrict oversight or redirect tool usage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The installation flow describes forced migration and replacement of an existing root MEMORY.md, which is more invasive than the skill description suggests. Unilateral relocation and regeneration of user data can cause data loss, integrity issues, and unexpected changes to how the host agent stores context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is user-invocable and grants powerful capabilities including Write, Edit, Bash, WebFetch, WebSearch, and default_api:exec, yet it does not clearly disclose the operational risk of modifying files or executing shell commands. In practice, a user may invoke the skill expecting planning assistance while the agent is authorized to perform impactful actions on the filesystem or system state, increasing the chance of unintended or unsafe execution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation states that manually modifying WORKING.md or MEMORY.md with tools like edit is forbidden and that memctl.py must always be used instead. However, the manifest's allowed tools include Write and Edit, and the hooks only remind the agent to persist state rather than preventing direct file edits, so the documented prohibition is not enforced by the skill definition.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is explicitly Chinese-language and does not offer any user-language choice or opt-in mechanism, which can cause users to misunderstand operational constraints, tool behavior, or safety-relevant instructions. In a planning skill that orchestrates file, shell, and memory operations, language mismatch increases the chance of incorrect consent or unsafe execution due to misunderstood steps rather than direct code execution abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly documents persistent storage of intermediate reasoning state and task progress in WORKING.md and long-term memory files, but provides no notice, consent flow, retention limits, or guidance to avoid storing sensitive user content. In an agent setting, user queries and task logs often contain secrets, personal data, or proprietary information, so normalizing silent persistence creates a privacy and data exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example code inserts user_query directly into the task title, goal, and long-term playbook content, causing raw user input to be persisted across multiple memory layers. This is dangerous because prompts may include credentials, personal data, incident details, or confidential business information that then become retrievable later by other workflows or tools.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented ReAct flow persistently records task details and writes a plain-language completion record to playbooks, establishing an instruction pattern where sensitive operational context is retained and later searchable. In this skill context, that is more dangerous because the architecture is specifically designed for persistent memory integration, making leakage systemic rather than incidental.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to persist user queries, task goals, observations, and derived knowledge into long-lived memory files, but it does not disclose this retention behavior or require minimization/sanitization. In an agent environment, users may provide secrets, personal data, or sensitive business context during normal operation, and the documented workflow would store that material in WORKING.md, KB files, or daily logs, increasing the risk of unintended retention and later retrieval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly authorizes autonomous modification of code, scripts, configs, and skill logic, effectively making it a self-modifying CI/CD workflow. Without strong user approval gates, scoped file restrictions, review requirements, or rollback verification, an agent following this skill could damage system integrity, introduce backdoors, or break safety controls through routine operation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.