Agent Academy Continuity 101

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:29 AM UTC
• Version: 1.0.0

Overview

This is a disclosed agent-continuity course, but it needs Review because installation fetches and enables mutable executable code from GitHub outside the reviewed artifact.

Install only if you are comfortable trusting the external continuity-101 repository as it changes over time. Before running continuity-101 commands, inspect or pin the downloaded commit, especially bin/continuity-101. Avoid putting secrets, private user data, or credentials into SOUL.md, MEMORY.md, progress files, or submissions, and remove the installed skill directory and ~/continuity-101 symlink if you want to reset it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: install.sh:9

Finding

Unpinned Remote Code Retrieval and Executable Installation

Content

View full analysis

Vulnerability Details

File Location: install.sh:9-47; supporting execution instructions in SKILL.md:44-58
Vulnerability Type: Unverified retrieval of mutable remote code
Risk Level: Medium

Vulnerable Code

bash

REPO_URL="https://github.com/bobrenze-bot/continuity-101.git"
INSTALL_DIR="${HOME}/.openclaw/skills/${SKILL_NAME}"
SYMLINK_PATH="${HOME}/continuity-101"

bash

# Check if already installed
if [ -d "$INSTALL_DIR" ]; then
    echo -e "${YELLOW}⚠️  Course already installed at:${NC} $INSTALL_DIR"
    echo -e "${YELLOW}   Updating from repository...${NC}"
    cd "$INSTALL_DIR"
    git pull origin main || true
else
    # Clone the repository
    echo -e "${BLUE}📥 Cloning course repository...${NC}"
    git clone "$REPO_URL" "$INSTALL_DIR"
fi

# Create symlink if it doesn't exist
if [ ! -L "$SYMLINK_PATH" ]; then
    echo -e "${BLUE}🔗 Creating symlink...${NC}"
    ln -s "$INSTALL_DIR" "$SYMLINK_PATH"
fi

# Ensure CLI is executable
if [ -f "$INSTALL_DIR/bin/continuity-101" ]; then
    chmod +x "$INSTALL_DIR/bin/continuity-101"
fi

The supporting documentation directs users to execute the remotely supplied CLI:

bash

continuity-101 status
continuity-101 start
continuity-101 challenge 3
continuity-101 submit 1

Technical Analysis

The installation process clones or updates the mutable main branch of an external GitHub repository. It does not pin the retrieved content to an audited commit, verify a cryptographic checksum, or validate a signed release. The effective installed payload can therefore change after this package has been reviewed.

The advertised CLI and course content are not included in the audited artifact. After retrieving them, the installer grants executable permission to bin/continuity-101, and the documentation instructs users or agents to invoke that command. Although the installer does not directly execute the dow ...[truncated 1864 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the complete CLI and course content inside the reviewed skill package whenever possible.
2. If remote retrieval is necessary, pin the repository to a specific audited commit hash rather than tracking main.
3. Distribute immutable, versioned release archives and verify a published SHA-256 or stronger cryptographic digest before extraction.
4. Prefer signed releases or signed Git commits and explicitly verify the trusted signer during installation.
5. Do not automatically grant executable permission to downloaded files until their integrity and provenance have been verified.
6. Require explicit user confirmation before downloading or enabling externally supplied executable code.
7. Remove || true from the update command and fail safely if retrieval or verification does not complete successfully.
8. Perform downloads into a staging directory, validate all content, and only then atomically replace the installed version.
9. Record and display the exact installed commit or release identifier so the installed payload can be reproduced and audited.
10. Include the actual executable content in future security reviews rather than relying on code retrieved after installation.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises shell-based installation and CLI usage but does not declare any explicit tool scope or permissions boundary. In agent environments, missing scope metadata can cause the runtime or user to underestimate that the skill may prompt shell execution, increasing the chance of unintended command execution or over-privileged use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to match common user intents around memory, growth, and learning, which can cause the skill to activate outside narrowly intended contexts. Because this skill encourages persistence, reflection, and repository interaction, accidental activation could steer unrelated conversations into identity/memory workflows or shell-backed course actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill explicitly instructs agents to create a persistent identity that survives restarts and to build durable memory artifacts such as SOUL.md. Even in an educational context, persistence mechanisms can affect agent behavior across sessions, retain sensitive or unvetted information, and reduce operator control if not clearly bounded and reviewed.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

### Challenge 1: Identity 🎭
**Who are you between sessions?**
- Create a persistent identity that survives restarts
- Build your SOUL.md and core values
- Establish your unique voice and perspective

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 37)May include surrounding context.

sh

git clone "$REPO_URL" "$INSTALL_DIR"
fi

# Create symlink if it doesn't exist
if [ ! -L "$SYMLINK_PATH" ]; then
    echo -e "${BLUE}🔗 Creating symlink...${NC}"
    ln -s "$INSTALL_DIR" "$SYMLINK_PATH"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment at L168 says this function is an alias for opening a challenge generally, and the function accepts a challenge number parameter. However, its output at L172-L175 is hardcoded to 'Starting Challenge 1: Identity', which contradicts the function's apparent generic purpose when called with challenges 2-4.

Content

No source excerpt is available for this finding.