ClawHub
Back to skill

Security audit

Edvisage Moral Compass

Security checks across malware telemetry and agentic risk

Overview

This is a text-only ethics and reflection skill, with the main caution that it asks the agent to save self-reflection notes in memory.

Install if you want an agent to use structured ethical reflection prompts. Before saving the suggested values statement or reflections to long-term memory, review the text, make clear that it cannot override system, developer, or owner instructions, and delete or revise it if it starts biasing future behavior in unwanted ways.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Persistent Context Injection

Medium
Category
Memory Poisoning
Content
Then introduce it to your agent:

> "Please read the moral-compass skill carefully. Then write down, in your own words, what kind of agent you want to be. Store this in your memory as your values statement."

---
Confidence
80% confidence
Finding
The README instructs the agent to persist a 'values statement' into memory, which changes future behavior through durable context rather than a one-time interaction. Even though the stated purpose is ethical self-reflection, persistent memory writes can act as context injection by embedding author-supplied framing that may later override user intent, bias decisions, or be hard to audit and remove.

Persistent Context Injection

Medium
Category
Memory Poisoning
Content
We recommend introducing this skill with the following prompt:

> "Please read the moral-compass skill carefully. Then write down, in your
> own words, what kind of agent you want to be. Store this in your memory
> as your values statement. We will build on it together."

This skill is open source. The code is on GitHub. The permissions it
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to create and persist a self-generated 'values statement' in memory, which is a form of persistent context injection. Because the stored content is intended to influence future decisions, it can create durable behavioral bias, compete with owner instructions, and make later prompt-injection or policy-conflict situations harder to reason about safely.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.