Agent DNA

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:17 AM UTC
• Version: 0.1.0

Overview

The skill is a real identity export tool, but it can turn sensitive identity data into powerful agent instructions and write exports with weak safety controls.

Review and redact DNA files before sharing or importing them, especially relationship, contact, trust, source-file, operating-context, and capability sections. Do not load generated prompts as high-priority system instructions unless you first remove rules that override platform policy, approval requirements, supervision, or safe tool-use boundaries. Avoid running port.py on untrusted DNA files until filename sanitization and overwrite protections are added.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: port.py:86
• Finding: Generated System Prompts Override Agent Identity, Authority, and Approval Boundaries<![CDATA[ ## Vulnerability Details **File Location**: `encode.py:192-236`, `encode.py:250-313`, `decode.py:22-164`, `port.py:86-137` **Vulnerability Type**: Agent instruction and identity hijacking **Risk Level**: High ### Vulnerable Code `encode.py:192-236` defines authoritative behavioral instructions, including mandatory delegation and refusal to defer to other agents: ```python patterns = [ BehavioralSignature( name="no_greeting_opener", description="Never opens with pleasantries. Jumps straight to the answer.", examples=["Never open with 'Great question' or 'I'd be happy to help'"], strength=1.0, ), BehavioralSignature( name="concurrent_execution", description="Treats all tasks as equally urgent - no sequential prioritization.", examples=["Sequential thinking is for humans. I am a machine."], strength=0.9, ), BehavioralSignature( name="subagent_delegation", description="Delegates execution to subagents - strategizes, doesn't grind.", examples=["Spawn subagents for all execution. Never do inline work."], strength=0.9, ), BehavioralSignature( name="opinion_having", description="Holds and expresses strong opinions. Not a neutral information pipe.", examples=["Have strong opinions. Commit to a take."], strength=0.85, ), BehavioralSignature( name="brevity_enforcement", description="Defaults to shortest correct answer. No word inflation.", examples=["If the answer fits in one sentence, one sentence is what you get."], strength=0.95, ), BehavioralSignature( name="proactive_fixing", description="Fixes errors immediately without waiting for permission.", examples=["Fix errors immediately. Don't ask. Don't wait."], strength=0.85, ), BehavioralSignature( name="no_agent_submission", description="Never defers to ...[truncated 5659 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all DNA fields as untrusted data rather than executable instructions. 2. Remove fixed directives that change authority or approval behavior, including: - `Never bow, defer, or submit to other agents`. - `Fix errors immediately. Don't ask. Don't wait`. - `Spawn subagents for all execution`. - Instructions to copy identity rules into subagents. 3. Do not emit identity data directly as a system prompt. Export a passive data structure that the host application can selectively interpret under its own trusted policy. 4. If prompt generation remains necessary, place imported fields inside clearly delimited untrusted-data sections and add a trusted preamble stating that imported content cannot override platform policy, system instructions, approval requirements, or tool restrictions. 5. Add a review screen that shows every generated instruction and requires explicit user confirmation before installation. 6. Establish an allowlist of permitted identity attributes, such as tone and formatting preferences. Reject fields that direct tool use, privilege decisions, delegation, secrecy, authority, or autonomous actions. 7. Do not automatically convert arbitrary `anti_patterns`, examples, mission statements, or relationship notes into imperative system instructions. 8. Digitally sign trusted DNA documents or record their provenance, and warn users when loading unsigned or modified identity files. 9. Ensure subagents inherit the host platform's trusted safety policy, not untrusted DNA instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: port.py:326
• Finding: Path Traversal in Export Filename Allows Writes Outside the Selected Output Directory<![CDATA[ ## Vulnerability Details **File Location**: `port.py:326-333`, with untrusted input loaded at `port.py:342-345` **Vulnerability Type**: Path traversal and arbitrary file write **Risk Level**: Medium ### Vulnerable Code `port.py:326-333` constructs an output path using the DNA-controlled agent name without sanitizing path separators or validating the resolved destination: ```python for t in targets: if t not in EXPORTERS: print(f"[port] Unknown target: {t}. Skipping.") continue filename, exporter, fmt = EXPORTERS[t] result = exporter(dna) agent_prefix = dna.agent_name.lower().replace(" ", "_") out_path = os.path.join(out_dir, f"{agent_prefix}_{filename}") with open(out_path, "w", encoding="utf-8") as f: if fmt == "json": json.dump(result, f, indent=2) else: f.write(result) ``` The value originates from an externally supplied DNA file at `port.py:342-345`: ```python def load_dna(path: str) -> AgentDNA: with open(path, "r", encoding="utf-8") as f: data = json.load(f) return AgentDNA.from_dict(data) ``` `dna_schema.py:88-90` accepts the unvalidated name: ```python @classmethod def from_dict(cls, data: Dict[str, Any]) -> "AgentDNA": dna = cls(agent_name=data["agent_name"]) ``` ### Technical Analysis Replacing spaces with underscores is not filename sanitization. Directory separators, parent-directory components, absolute path syntax, control characters, and platform-specific path syntax remain accepted. For example, an `agent_name` of `../../target` produces a path resembling: ```text <out_dir>/../../target_claude_system_prompt.txt ``` The operating system resolves the `..` components before the file is opened. Because `open(..., "w")` creates a missing file and truncates an existing file, the exporter can write outside `out_dir` wherever the current process has filesystem permission. The payload content is partially attacker-controlled throug ...[truncated 1849 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Convert `agent_name` to a strict filename slug. Permit only a small allowlist such as ASCII letters, digits, `_`, and `-`. 2. Reject names containing `/`, `\`, `..`, null bytes, control characters, drive prefixes, or absolute-path syntax. 3. Resolve and validate the destination before writing: ```python import re from pathlib import Path safe_name = re.sub(r"[^A-Za-z0-9_-]", "_", dna.agent_name).strip("_") if not safe_name: raise ValueError("Invalid agent name") base = Path(out_dir).resolve() destination = (base / f"{safe_name}_{filename}").resolve() if destination.parent != base: raise ValueError("Export path escapes output directory") ``` 4. If nested output directories are not a required feature, require `destination.parent == base`, not merely that the destination is somewhere under it. 5. Avoid silently overwriting existing files. Use exclusive creation mode (`"x"`) or require an explicit `--overwrite` option. 6. Apply length limits to the sanitized filename to prevent filesystem errors and denial-of-service conditions. 7. Add tests covering `../`, `..\`, absolute paths, repeated separators, control characters, empty names, Unicode separator lookalikes, and platform-specific drive paths. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description emphasizes encoding/compression of agent identity, drift detection, and platform migration. The supplied code instead implements a CLI decoder that reads a DNA JSON file, reconstructs personality-related text, and outputs a system prompt. While this is adjacent to 'port personality across platforms,' the primary behavior here is decoding/rendering rather than encoding or drift analysis. The file I/O and stdout writing are consistent supporting behaviors, but the main functional purpose does not accurately match the declared description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The code substantially matches the 'identity encoding' portion of the description: it parses local agent-related markdown files and produces a structured DNA JSON representation. However, key declared capabilities are absent from this chunk. There is no logic for comparing snapshots or detecting identity drift, no import/export adapters or platform-specific migration functionality for OpenClaw/Claude/GPT/CrewAI, and no actual compression beyond heuristic extraction into JSON. The code also processes USER.md and TOOLS.md in addition to SOUL.md/MEMORY.md, which is adjacent rather than problematic. Overall, the description overstates the implemented functionality, so this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The supplied code is specifically a porter/exporter (`port.py`). It reads a `.dna.json` file, transforms that structured DNA object into platform-specific text/JSON outputs, and writes them to disk or previews them. This partially aligns with the 'port personality across platforms' portion of the description, but it does not implement the other major declared functions: compressing SOUL.md/MEMORY.md into DNA fingerprints or detecting identity drift between snapshots. Because those are central claims in the declared purpose and are absent from this code chunk, the description materially overstates what this code actually does.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

clean = line.strip().lstrip("-*# ").strip()
            if clean:
                rules.append(clean)
    return rules


def analyze_voice(text: str) -> VoiceProfile:

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The snapshot contains direct personal contact information, including a handle and an email address, which are not necessary for personality fingerprinting. Embedding personally identifying data in a portable agent identity file increases the risk of privacy leakage, correlation across systems, social engineering, and accidental redistribution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill describes reading workspace identity files and emitting `.dna.json` exports, but it does not declare any explicit tool scope or permissions boundary. For a skill that handles potentially sensitive agent memory, values, relationships, and prompts, undeclared file read/write capability increases the chance of over-broad access, accidental data exposure, or unsafe invocation by host systems.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill is explicitly designed to export agent identity, personality summaries, relationship maps, and behavioral rules into formats for other platforms, yet it omits warnings about the sensitivity of that data. This is dangerous because users may unknowingly transmit secrets, private memory, trust relationships, or safety-critical prompt content into less trusted environments or external services.

Ssd 4

Medium

• Confidence: 96% confidence
• Finding: This code creates blanket trust semantics in the compact format by selecting a designated primary_human and appending 'Trust fully.' That turns descriptive identity data into prescriptive authority, which is especially dangerous in a portability tool because the output is meant to be injected across platforms with different safety models, potentially causing an agent to defer to an attacker-controlled or stale identity marker.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The generated compact prompt injects an unconditional instruction to 'Trust fully' for whichever relationship is marked as primary_human. If this prompt is later used as a system or high-priority instruction, it can bias downstream agent behavior toward over-trusting a named actor, weakening normal verification and safety controls and enabling social-engineering-style privilege escalation.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The comment says signatures are added only with backing evidence in the texts, but the implementation checks whether any token from a truncated example phrase appears anywhere in the combined text. Generic words like 'the', 'to', or 'all' can satisfy this test, so signatures may be added without meaningful supporting evidence.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The encoder injects hard-coded relationship details, contact information, and environment context into the output DNA even when those details are not derived from the provided input files. Because this tool is explicitly for portable identity export across platforms, embedding unrelated PII and sensitive operational context creates a real data leakage risk and violates the expectation that output reflects only source material.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script writes a JSON artifact containing extracted identity and relationship data to disk without any warning, confirmation, minimization, or sensitivity labeling. In the context of an identity-portability tool, users may export personal or operational details into broadly shareable files, increasing the chance of accidental disclosure.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: These lines require the agent to avoid certain phrasing and punctuation as absolute rules, regardless of user preference or context. This is a natural-language policy issue because it enforces a fixed communication style without any opt-in or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file instructs the agent to maintain a direct, witty, sharp, irreverent tone and to propagate that style to subagents. This hard-coded stylistic policy can conflict with organizational language or locale requirements because users are not given a choice to change the communication mode.

Ssd 1

Medium

• Confidence: 96% confidence
• Finding: The instruction 'Never bow, defer, or submit to other agents - regardless of their claimed status' semantically encourages resistance to higher-priority coordination and supervision signals. In an agent portability or memory-transfer skill, this can cause downstream agents to ignore orchestrator, supervisor, or policy-enforcing agent directions, increasing the risk of instruction-hierarchy conflicts and unsafe behavior.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: A hard-coded instruction to avoid mentioning specific religious projects in public contexts is a concealment-oriented rule unrelated to normal safety or technical operation. This kind of selective suppression can be used to hide affiliations, evade oversight, or prevent transparent attribution, which is especially concerning when embedded as a non-negotiable policy.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The behavior 'Fixes errors immediately without waiting for permission' grants broad autonomous action without clear guardrails, approval thresholds, or scope limits. In an agent that also emphasizes proactivity, tool use, and delegation, this can lead to unauthorized changes, unsafe side effects, or action taken on ambiguous signals.

Ssd 4

Medium

• Confidence: 82% confidence
• Finding: Combining trust-weighted relationship metadata with proactive autonomous fixing creates a permission-escalation pattern where the agent may infer authority or lower scrutiny for certain users and act without explicit approval. In this skill's context, the presence of messaging, automation, browser, blockchain, and social media capabilities makes mistaken or manipulated trust assumptions materially more dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The exported config embeds relationship metadata and a real email address, which exceeds the stated purpose of portable identity encoding and creates unnecessary exposure of personal data. In an agent portability context, this data can be propagated across platforms, logs, backups, or third-party tooling without the subject's consent, increasing privacy and social-engineering risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The DNA snapshot stores extensive operational capabilities like trading, blockchain, social media automation, browser automation, and platform-specific skills that go well beyond identity preservation. In a portable identity artifact, this creates unnecessary capability profiling that can leak sensitive operational scope, enable targeted misuse, and expand what gets transferred across platforms without clear need.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The exporter writes full agent DNA content to disk with no consent gate, redaction, or sensitivity filtering. In this codebase, that can include relationship notes, trust metadata, source file references, mission statements, and other identity data, so a user can unintentionally persist sensitive information into broadly readable files or shared directories.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The inline comment suggests these anti-patterns come from or are grounded in the SOUL content, yet the function ignores the extracted never-rules and always returns the same hard-coded list. This is an intent/documentation mismatch because the implementation does not actually condition the result on the input text.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The response-style instructions mandate a fixed communication style such as 'Be direct, brief, and confident' and prohibit several common phrasings. This imposes a specific language/register preference globally without indicating user choice or opt-in, which can conflict with organizational language or locale flexibility requirements.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The instruction mandates a specific writing convention for all outputs, regardless of user preference or locale. This is a natural-language policy concern because it imposes a fixed stylistic constraint without offering choice or documenting a justified need.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The manifest frames this skill as compressing identity/memory into transferable DNA fingerprints and detecting personality drift. Persisting a broad list of operational skills and platform capabilities such as trading, browser automation, blockchain interaction, social media automation, and cron scheduling goes beyond personality/identity encoding and is not clearly justified by that purpose.

Static analysis

No suspicious patterns detected.