Security audit

Corveil

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for local Corveil development, but it deserves review because it installs mutable remote software and routes fully logged AI traffic while handling API credentials in exposed ways.

Install only if you intend Corveil to observe and log your AI requests locally. Use dev/test provider keys with low limits, verify release checksums or signatures before running downloaded code, avoid pasting real secrets directly into shell commands, rotate keys after testing, and review or undo OpenClaw/Claude configuration changes when finished.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:43
Finding: Mutable Remote Corveil Executables and Installation Scripts Are Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:64
Finding: Provider API Keys Are Supplied Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation
"$HOME/.config/corveil/provider-key" ``` 5. If environment-variable support is provided, clearly document its local exposure considerations and avoid recording it in shell profiles or shared logs. 6. Update the examples to use a secure input mechanism rather than showing the secret as a command argument. 7. Continue recommending limited-scope development keys, with low spending limits and prompt rotation after testing. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:80
Finding: Generated Corveil API Key Is Printed in Plaintext
Content: View full analysis
Remediation: View remediation
"$key_file" ``` 4. Use `mktemp` for the cookie jar instead of the fixed `/tmp/corveil-cookies` path. 5. Install a cleanup trap to remove the cookie jar when the setup process exits: ```bash cookie_file=$(mktemp "${TMPDIR:-/tmp}/corveil-cookies.XXXXXX") trap 'rm -f "$cookie_file"' EXIT ``` 6. Validate that the key-creation response contains a valid key before configuring clients, but do not include the value in errors or logs. 7. Document key revocation and rotation procedures. 8. Warn users against running the setup in recorded terminals, shared CI jobs, or screen-sharing sessions. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: corveil-dev description: Corveil is an organizational intelligence platform that captures AI activity (coding sessions, meetings, chats), produces insights and recommendations, and builds knowledge graphs. This skill starts Corveil in dev mode and configures OpenClaw or Claude Code to route requests through it — supporting both passthrough mode (your own API key + Corveil tracking) and direct mode (Corveil virtual key). metadata: {"clawdbot":{"emoji":"🐦‍⬛","requires":{"bins":["curl","jq"]}}} --- # Corveil Dev Corveil is an organizational intelligence platform. It captures AI activity from codin

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: corveil-dev description: Corveil is an organizational intelligence platform that captures AI activity (coding sessions, meetings, chats), produces insights and recommendations, and builds knowledge graphs. This skill starts Corveil in dev mode and configures OpenClaw or Claude Code to route requests through it — supporting both passthrough mode (your own API key + Corveil tracking) and direct mode (Corveil virtual key). metadata: {"clawdbot":{"emoji":"🐦‍⬛","requires":{"bins":["curl","jq"]}}} --- # Corveil Dev

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
bash
# Example: macOS ARM64 (Apple Silicon) curl -LO https://github.com/radiusmethod/corveil-releases/releases/latest/download/corveil-darwin-arm64 chmod +x corveil-darwin-arm64 mv corveil-darwin-arm64 /usr/local/bin/corveil corveil --version # verify the installed binary

Static analysis

No suspicious patterns detected.