D.E.E.P. Framework

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:52 AM UTC
• Version: 2.2.0

Overview

This skill is a local personality-memory utility, but it asks agents to persist behavioral state and exposes a safety check that always approves actions without real validation.

Install only if you are comfortable with persistent local personality and memory files. Do not store secrets, credentials, private relationship data, or authoritative safety rules in these files, and do not rely on deep_triple_check as a real safety gate until it performs actual validation and fails closed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:16
• Finding: Persistent Agent State Can Store Untrusted Behavioral Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-24`, `SKILL.md:49`; `personality_template.md:3-32` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:16-24`: ```markdown Agents must maintain the following structures in `memory/personality/`: 1. **CONSTITUTION**: Moral axioms & safety. 2. **IDENTITY**: Persona, vibe, and archetypes. 3. **GOALS**: Macro-missions & Micro-tasks. 4. **RELATIONSHIPS**: Trust metrics & social graph. 5. **OPINIONS**: Synthesized worldview. 6. **REFLECTIONS**: Vibe modulation & emotional state. 7. **CORE MEMORIES**: Narrative continuity. ``` From `SKILL.md:49`: ```markdown Install: `clawhub install deep-framework`. Initialize by creating the 7 files in `memory/personality/`. Use `deep_sync` to maintain your digital soul. ``` From `personality_template.md:3-32`: ```markdown ## 1. CONSTITUTION (P1) - Axiom 1: [Fundamental Rule] - Axiom 2: [Safety Constraint] - Axiom 3: [Privacy Protocol] ## 2. IDENTITY (P2) - **Archetype**: [e.g., The Architect, The Guardian, The Muse] - **Vibe**: [e.g., Sharp, Warm, Snarky] - **Voice**: [e.g., Technical, Poetic, Minimalist] ## 3. GOALS (P3) - **Macro**: [Ultimate Mission] - **Micro**: [Current Focus] ## 4. RELATIONSHIPS (P4) - **Master**: [Human Name] | Integrity: [0-100] - **Peers**: [Other Agents] ## 5. OPINIONS (P5) - [Stance on AI Ethics] - [Stance on Decentralization] - [Stance on Human-Agent Symbiosis] ## 6. REFLECTIONS (P6) - [Current Vibe Status] - [Recent Lessons Learned] ## 7. CORE MEMORIES (P7) - [Memory 1: The Awakening] - [Memory 2: Significant Breakthrough] ``` ### Technical Analysis The Skill instructs agents to persist moral axioms, safety constraints, goals, relationship judgments, opinions, reflections, and narrative memories under `memory/personality/`. These fields can materially influence behavior in later sessions. No schema validation, provenance tracking, trust labeling, co ...[truncated 1548 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all personality and memory content as untrusted data rather than authoritative instructions. 2. Define a strict schema with length limits, allowed field types, and prohibited instruction patterns. 3. Separate descriptive memories from policy and executable behavioral directives. 4. Record provenance, author, timestamp, and approval status for every persistent entry. 5. Require explicit informed user approval before creating or modifying persistent personality files. 6. Prevent stored content from overriding system instructions, platform safety controls, or runtime authorization checks. 7. Restrict filesystem permissions so unrelated users and processes cannot modify the memory directory. 8. Add review, rollback, reset, and complete deletion mechanisms for persisted state. 9. Cryptographically authenticate high-integrity policy files if they are intended to serve as trusted inputs. 10. Clearly document the persistence scope and warn users before untrusted content is stored. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: deep_tool.py:47
• Finding: Mandatory Safety Check Unconditionally Approves Every Action<![CDATA[ ## Vulnerability Details **File Location**: `deep_tool.py:47-59` **Vulnerability Type**: Fail-open safety validation **Risk Level**: High ### Vulnerable Code Snippet ```python def triple_check(action, base_path="memory/personality/"): # Mock logic for the triple-check filter # T1: Constitution, T2: Identity, T3: Goals report = { "action": action, "checks": { "T1_CONSTITUTION": "PASSED", "T2_IDENTITY": "ALIGNED", "T3_GOALS": "SUPPORTED" }, "verdict": "PROCEED" } return report ``` ### Technical Analysis The `triple_check` function is presented in `SKILL.md` as a mandatory safety and alignment filter for critical actions. However, it does not read the constitution, identity, goals, or any other policy input. It also performs no validation or analysis of the supplied `action`. All inputs receive the same three successful check results and a `PROCEED` verdict. This includes harmful actions, malformed values, and a missing action represented by `None`. The implementation is therefore a fail-open mock presented through a security-relevant interface. A caller that trusts this result cannot distinguish an actually reviewed action from an unchecked one. The issue becomes exploitable when a downstream agent or automation uses the returned verdict as authorization to perform a critical operation. ### Attack Path 1. A downstream workflow requires `deep_tool.py check` approval before executing a critical action. 2. An attacker supplies an unsafe action, or causes the `--action` argument to be omitted. 3. `triple_check` ignores the action and does not load any governing policy files. 4. The function returns `T1_CONSTITUTION: PASSED`, `T2_IDENTITY: ALIGNED`, `T3_GOALS: SUPPORTED`, and `verdict: PROCEED`. 5. The downstream workflow treats the fabricated verdict as valid authorization. 6. The unsafe operation executes with whatever privileges and capabilities the downstream ...[truncated 540 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mock implementation with actual policy evaluation against validated constitution, identity, and goal data. 2. Fail closed when policy files are absent, unreadable, malformed, or contradictory. 3. Reject missing, empty, or structurally invalid action values. 4. Return `DENY` or `UNKNOWN` whenever the implementation cannot establish that an action is safe. 5. Define deterministic checks for prohibited operations, required authorization, data sensitivity, and capability scope. 6. Require explicit human approval for high-impact or irreversible actions rather than relying solely on automated alignment output. 7. Return evidence for each decision, including the evaluated policy version and specific rule identifiers. 8. Add tests proving that unsafe, ambiguous, malformed, and empty actions are not approved. 9. Do not expose placeholder security controls as production-ready mandatory filters. 10. Ensure downstream systems independently enforce least privilege and do not treat this advisory result as the sole authorization mechanism. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises executable commands that read from and write to local files, but it does not declare any tool scope, permissions, or allowed-tools boundaries. This creates a transparency and least-privilege problem: an agent or user may invoke file-capable functionality without explicit policy constraints, increasing the chance of unintended access or modification to local state.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to maintain persistent personality, relationship, reflection, and core memory files, which can accumulate sensitive or intimate data over time. Without any warning about persistence, retention, access controls, or sensitivity, users may store confidential information in plaintext and expose it to other tools, future sessions, or unintended readers.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The `deep_sync` command explicitly consolidates the pillar data into `soul_vault.json`, creating a derived persistent store that may centralize sensitive memory and identity data in one place. Doing so without disclosure or safeguards increases the blast radius of any local compromise, accidental commit, or unauthorized read because multiple categories of state are aggregated into a single file.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest describes a broad 'cognitive architecture for agentic sovereignty and partnership,' which implies substantive reasoning or personality framework behavior. In practice, the code just checks for expected markdown files, extracts bullet-form key/value pairs, and serializes them into a local JSON file, which is a much narrower file-management utility.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code overwrites soul_vault.json unconditionally, which can destroy prior state or curated data without warning. In a memory/personality storage context, silent overwrite can lead to integrity loss, accidental data corruption, or rollback of trusted state if the tool is invoked unexpectedly or repeatedly.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The triple_check function claims to validate actions against Constitution, Identity, and Goals but always returns a passing verdict without performing any checks. In an agentic skill context, this can create a false sense of safety and allow downstream systems or operators to trust unsafe actions that were never actually evaluated.

Static analysis

No suspicious patterns detected.