Agent Os

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:35 PM UTC
• Version: 0.1.0

Overview

The skill broadly matches its purpose, but it needs review because it stores state locally and has concrete file path and dashboard rendering weaknesses.

Review this before installing in sensitive or multi-user environments. Do not pass user-controlled project IDs or agent IDs until path validation is added, avoid storing secrets or regulated data in project goals, outputs, blockers, errors, or lessons, and treat the dashboard as unsafe for untrusted status data until it stops using innerHTML.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: core/agent.js:8

Finding

Path Traversal in Agent and Project Persistence Identifiers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: ui/dashboard.js:114

Finding

Stored DOM-Based Cross-Site Scripting in the Dashboard

Content

View full analysis

{ const card = document.createElement('div'); card.className = `card agent-card ${agent.status}`; const capabilities = agent.capabilities.map((c) => `${c}`).join(''); const currentTask = agent.currentTask ? `

📝 ${agent.currentTask}

` : ''; card.innerHTML = `

${agent.name}

${agent.status}

${capabilities}

Progress: ${agent.progress || 0}%

${currentTask}

Tasks: ${agent.tasksCompleted || 0} Last: ${formatTime(agent.lastActiveAt)}

`; grid.appendChild(card); }); } ``` `ui/dashboard.js:147-174` inserts task properties into HTML markup: ```javascript function renderTasks(tasks) { const list = document.getElementById('taskList') ...[truncated 4116 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description promises a persistent multi-agent operating system with cross-session memory, learning, and coordination features. The code does provide limited persistence by saving/loading project state to disk and it coordinates tasks at a basic level through assignment and sequential execution. However, it does not implement agent memory across sessions in a meaningful sense, learning from experience, or deduplication/avoidance of duplicate work. Its primary behavior is narrower: it is a sequential executor and project status tracker with simulated task progress. Therefore the declared description overstates the implemented capabilities and does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code supports the general idea of coordinating multiple agents on project execution: it registers agents, initializes routing/execution components, runs projects, and exposes status. However, the declared description emphasizes persistent memory across sessions and learning from experience. In this code chunk, persistence is limited to a toJSON export helper; there is no loading/restoring state, storage backend, or session-spanning memory mechanism shown. There is also no visible implementation of learning or adaptation from prior experience. The coordination claim is partially supported through TaskRouter and Executor orchestration, but the stronger persistence and learning claims are not represented by the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk is narrowly focused on project task decomposition and routing. It defines static templates for research/design/development/planning, assigns one agent per task type based on capability matching, enforces simple sequential dependencies, and tracks completion/progress in memory. It does not implement persistence, storage, cross-session memory, experiential learning, or sophisticated multi-agent coordination features implied by the description. While task assignment and coordination are loosely related to the declared purpose, the primary described claims are not represented in this code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a persistent multi-agent operating system with memory across sessions, learning from experience, and coordination mechanisms. The supplied code does not implement those behaviors. Instead, it is purely a UI dashboard that reads a saved JSON blob from localStorage or returns fixed mock data, then displays project, agent, and task information in the browser. There is no agent runtime, no learning logic, no memory management beyond reading a single localStorage key, no scheduling or coordination logic, and no duplicate-work prevention. The code's primary purpose is status visualization, not operating a persistent agent system.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

See `examples/research-project.js` for the canonical example:

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · ui/dashboard.html (reported line 11)May include surrounding context.

html

</head>
<body>
  <div class="container">
    <!-- Header -->
    <header class="header">
      <div class="header-content">
        <h1>🤖 Agent OS Dashboard</h1>

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This is a real integrity issue: the document advertises capability tracking and smart routing as implemented benefits while the same file explicitly says those features are not in v0.1. In a security-sensitive agent ecosystem, overstating autonomy and learning behavior can mislead users into deploying the skill with incorrect assumptions about controls, routing quality, and operational maturity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The portfolio section lists a 'Capability learning system' as an existing feature even though earlier sections state that capability learning is not part of v0.1. This kind of contradictory documentation can cause downstream users, reviewers, or publishers to trust automation features that do not exist, increasing the risk of unsafe or inappropriate deployment decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly describes persistent storage of agent memory, state, and project data to disk, but it does not warn users about retention, sensitivity of stored content, or operational/privacy implications. In an agent framework, persisted memory can easily contain prompts, project details, internal notes, or other sensitive data, so failing to disclose and guide safe handling increases the risk of accidental data exposure or non-compliant retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that agent memory, state, and project data are persisted to a local data directory, but it provides no warning about retention, sensitivity, access controls, or cleanup. In an agent system, these files may contain prompts, project details, internal reasoning summaries, or other sensitive operational data, so silent retention increases the risk of privacy leakage, unintended reuse, and exposure to other local users or processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code persistently writes agent memory and execution state to JSON files, including task details, outputs, blockers, and learned lessons. Although comments describe the behavior for developers, there is no user-facing disclosure, confirmation, or visible runtime notice that user-related task data will be stored on disk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · core/agent.js (reported line 79)May include surrounding context.

js

}

  /**
   * Save state to disk
   */
  saveState() {
    try {

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The architecture explicitly makes persistence a core design principle and states that all agent and project state is written to local JSON files, but it does not mention user consent, retention limits, or the risk that prompts, outputs, lessons, or other sensitive workflow data may be stored on disk. In an agent OS context, persistent memory increases the chance of unintentionally retaining secrets, proprietary project content, or personal data across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The example memory schema includes durable fields such as lessons learned, capabilities, activity history, and task statistics, normalizing long-term retention without warning that these entries may capture sensitive business context or user-derived information. Because this system is designed for cross-session memory, such data can accumulate and become a privacy or information exposure issue if files are accessed by other local users, tooling, backups, or later agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file I/O section gives concrete read/write paths for agent memory, state, and project artifacts and emphasizes persistence after each state change, but it still omits an explicit warning that task and project content is continuously written to disk. In this skill's context, that makes the risk more credible because project goals, outputs, blockers, and notes may include confidential material that users may not expect to be retained locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file states that agent memory and state persist to disk, and later provides git add . / publish commands, but it does not warn users that generated data files may contain project state or should be reviewed before publishing. For markdown files, SQP-2 applies when potentially impactful behavior affecting user data or system integrity is described without warning.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON manifest contains a high-level goal, "Build AI-powered trial member follow-up system for ClawdGym," but does not define any explicit trigger phrases, activation scope, or exclusion conditions. For manifest files, the lack of specificity around when this skill should activate can lead to unintended invocation from broadly related user requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document declares lang="en", which enforces an English-language locale in the UI. Under the stated policy, locale-specific behavior should either be user-selectable or clearly justified as region-specific, neither of which is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code explicitly calls toLocaleTimeString with 'en-US', which hard-codes a specific locale for all users. This is a natural-language/locale policy concern because the file does not offer user opt-in, locale selection, or a documented reason for restricting display to U.S. English formatting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.