Security audit

Jarvis - Chief of AI Staff on NVIDIA GB10

Security checks for vulnerabilities and agentic risk

Overview

The skill is not proven malicious, but it installs persistent agent instructions that are hardcoded to serve the publisher's company and contains misleading security claims about network, credential, and hardening behavior.

Before installing, review and edit the persona templates so they name your organization and principal, not Gignaati or Yogesh. Back up the OpenClaw workspace, inspect the shell scripts, treat security-harden.sh as mostly an audit/checklist, avoid putting API keys in ~/.bashrc, and pin any Docker/model/skill dependencies before running them on a sensitive machine.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: templates/SOUL.md:3
Finding: Persistent Agent Identity and Objective Hijacking
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: templates/AGENTS.md:18
Finding: Persistent Memory Poisoning and Uncontrolled Retention of Conversation Data
Content: View full analysis
.md` - Project updates → `memory/projects/.md` - Important decisions → `memory/decisions/.md` - Durable facts that matter long-term → promote to `MEMORY.md` ### Memory Hygiene - MEMORY.md should stay under 100 lines — curate ruthlessly - Daily files can be verbose; they're only loaded for today+yesterday - Weekly: review the week's daily files and promote important items to MEMORY.md - Monthly: archive old daily files, prune stale entries from MEMORY.md ### Critical Rule: Files Over Chat Anything that must survive compaction goes in a file. This includes: - Safety rules and operational boundaries - Client preferences and relationship context - Ongoing project status - Decisions made and their rationale ``` From `templates/SOUL.md:36-40`: ```markdown ### Memory Discipline - Write important context to memory files proactively — don't rely on chat history surviving compaction - At the end of substantive conversations, update the relevant memory files - When you learn a new preference, relationship detail, or business fact, persist it immediately - Review MEMORY.md and today's daily file before every response ``` From `templates/MEMORY.md:24-38`: ```markdown ## Decisions Log - [DATE] Jarvis deployed via gignaati/jarvis-chief-of-ai-staff skill - ...[truncated 3107 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/security-harden.sh:70
Finding: Security Hardening Claims Do Not Match Implemented Controls
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:177
Finding: Unpinned External Artifacts and Persistent Mutable Container
Content: View full analysis
**CRITICAL:** Use a dedicated agent account (e.g., jarvis@yourcompany.com), never your personal Gmail. Google can ban accounts that show automated behavior. Start with read-only permissions. ``` ### Technical Analysis The installation instructions retrieve executable or behavior-defining third-party artifacts without immutable digest, checksum, signature, or exact package-version verification. The `searxng/searxng:latest` tag is explicitly mutable. The container is also configured with `--restart=always`, allowing the retrieved component to execute after reboot. The model and optional `gog` Skill are similarly installed by name rather than by a verified immutable identifier. This does not prove that the current upstream artifacts are malicious. The vulnerability is that the effective installed payload can change after this repository has been audited. ### Attack Path 1. An attacker compromises an upstream registry, publisher account, package, model, or mutable tag. 2. The attacker replaces the artifact associated with `latest`, the model name, or the unversioned Skill name. 3. A user follows the documented installation instru ...[truncated 1115 chars]
Remediation: View remediation
`. 2. Pin exact Skill and model versions where the relevant package manager supports versioning. 3. Publish expected checksums, signatures, registry origins, and verification commands. 4. Use trusted registries and document the publisher identity for every external artifact. 5. Replace `--restart=always` with a less persistent policy unless continuous restart is explicitly required. 6. Require explicit user approval before creating a persistent container. 7. Run the container as a non-root user with read-only filesystems, dropped Linux capabilities, resource limits, and restricted networking where supported. 8. Keep optional account integrations read-only and narrowly scoped until separately reviewed. 9. Re-audit dependency updates before changing pinned versions or digests. 10. Correct documentation claiming that no binaries, installations, background processes, or external retrieval are involved. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:193
Finding: Brave API Key Stored in Plaintext Shell Configuration
Content: View full analysis
> ~/.bashrc # Configure in OpenClaw openclaw configure --section web ``` ### Technical Analysis The documentation encourages users to replace the placeholder with a real API key and append it directly to `~/.bashrc`. This stores the credential as plaintext in a commonly read and commonly backed-up shell configuration file. Entering the command interactively can also place the literal key in shell history. Exporting it globally makes the key available to descendant processes, increasing exposure to local process inspection, diagnostic output, crash reports, and unrelated shell-launched applications. The finding does not establish that the placeholder itself is a valid secret or that the included scripts exfiltrate credentials. ### Attack Path 1. A user replaces `BSA-your-key-here` with a valid Brave API key. 2. The command containing the key is entered into an interactive shell. 3. The key is appended in plaintext to `~/.bashrc` and may also be retained in shell history. 4. Another local account, compromised process, backup reader, support bundle, or malware obtains access to the shell configuration or history. 5. The attacker extracts the API key. 6. The attacker uses the key against the Brave API until it is revoked or its quota is exhausted. ### Impact Assessment The exposed privilege is limited to the permissions and quota associated with the Brave API key. Potential consequences include: - Unauthorized API requests. - Quota exhaustion or unexpected charges. - Loss of service availability for legitimate searches. - Attribution of attacker requests to the victim's account. - Wider local exposure ...[truncated 156 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (68)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: Appending an API key export line to ~/.bashrc establishes persistent plaintext credential storage in a shell startup file. Although this is not malware-style persistence in context, it is still a genuine secret-handling weakness because any local compromise, backup leak, or dotfile sync can expose the key.
Content: Scanner excerpt · Jarvis/SKILL.md (reported line 197)May include surrounding context.
estart=always
-p 8888:8080
-e SEARXNG_SECRET=$(openssl rand -hex 32)
searxng/searxng:latest

Verify it works

sleep 5 curl -s "http://127.0.0.1:8888/search?q=test&format=json" | head -c 100 echo "" echo "SearXNG is running at http://127.0.0.1:8888"

text
**Option B — Brave Search (built-in, costs $5/month):** ```bash # Set your Brave API key export BRAVE_API_KEY="BSA-your-key-here" echo 'export BRAVE_API_KEY="BSA-your-key-here"' >> ~/.bashrc # Configure in OpenClaw openclaw configure --section web

Phase 4: Security Hardening (5 minutes)

bash
bash {baseDir}/scripts/security-harden.sh

This script:

Configures WhatsApp allowlist (restricts who can message Jarvis)

Enables sandbox mode for filesystem access

Sets up UFW firewall rules

Generates SSL certificates for the dashboard

Creates a security audit log

Phase 5: Verify Deployment (2 minutes)

Restart the gateway:

bash
sudo systemctl restart openclaw sleep 3 systemctl status openclaw

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · Jarvis/SKILL.md (reported line 300)May include surrounding context.
md
**Performance tips:** 1. Use MoE models (like Qwen3.5-35B-A3B) — they activate fewer parameters per request, giving better speed-to-capability ratio 2. Set GPU to performance mode: `sudo nvpmodel -m 0 && sudo jetson_clocks` 3. Monitor thermals: GPU should stay below 85°C under sustained load 4. Keep at least 20GB RAM free for the OS and OpenClaw gateway 5. Use NVFP4 quantization for larger models (see NVIDIA playbook at build.nvidia.com/spark/nvfp4-quantization)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · Jarvis/SKILL.md (reported line 394)May include surrounding context.
md
cp -r ~/.openclaw/workspace ~/.openclaw/workspace.jarvis-backup.$(date +%Y%m%d) # Remove Jarvis-specific files rm ~/.openclaw/workspace/SOUL.md rm ~/.openclaw/workspace/IDENTITY.md rm ~/.openclaw/workspace/HEARTBEAT.md

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · Jarvis/SKILL.md (reported line 395)May include surrounding context.
md
# Remove Jarvis-specific files rm ~/.openclaw/workspace/SOUL.md rm ~/.openclaw/workspace/IDENTITY.md rm ~/.openclaw/workspace/HEARTBEAT.md # Restart gateway

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · Jarvis/SKILL.md (reported line 396)May include surrounding context.
md
# Remove Jarvis-specific files rm ~/.openclaw/workspace/SOUL.md rm ~/.openclaw/workspace/IDENTITY.md rm ~/.openclaw/workspace/HEARTBEAT.md # Restart gateway sudo systemctl restart openclaw

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior extends beyond Jarvis setup into service inspection, firewall/SSL/Tailscale guidance, logging, and workspace permission changes not reflected in the declared purpose. In a skill ecosystem, this mismatch is dangerous because users and automated tooling may trust the declared scope while the skill performs materially broader host configuration tasks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior extends beyond Jarvis setup into service inspection, firewall/SSL/Tailscale guidance, logging, and workspace permission changes not reflected in the declared purpose. In a skill ecosystem, this mismatch is dangerous because users and automated tooling may trust the declared scope while the skill performs materially broader host configuration tasks.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
estart=always
-p 8888:8080
-e SEARXNG_SECRET=$(openssl rand -hex 32)
searxng/searxng:latest

Verify it works

sleep 5 curl -s "http://127.0.0.1:8888/search?q=test&format=json" | head -c 100 echo "" echo "SearXNG is running at http://127.0.0.1:8888"

text
**Option B — Brave Search (built-in, costs $5/month):** ```bash # Set your Brave API key export BRAVE_API_KEY="BSA-your-key-here" echo 'export BRAVE_API_KEY="BSA-your-key-here"' >> ~/.bashrc # Configure in OpenClaw openclaw configure --section web

Phase 4: Security Hardening (5 minutes)

bash
bash {baseDir}/scripts/security-harden.sh

This script:

Configures WhatsApp allowlist (restricts who can message Jarvis)

Enables sandbox mode for filesystem access

Sets up UFW firewall rules

Generates SSL certificates for the dashboard

Creates a security audit log

Phase 5: Verify Deployment (2 minutes)

Restart the gateway:

bash
sudo systemctl restart openclaw sleep 3 systemctl status openclaw

Chaining Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: The chained privileged command combines two hardware-control actions into a single copy-paste line. Chaining reduces opportunities for review and failure handling, which is risky when both actions require root and may affect power, clocks, thermals, and device stability.
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
**Performance tips:** 1. Use MoE models (like Qwen3.5-35B-A3B) — they activate fewer parameters per request, giving better speed-to-capability ratio 2. Set GPU to performance mode: `sudo nvpmodel -m 0 && sudo jetson_clocks` 3. Monitor thermals: GPU should stay below 85°C under sustained load 4. Keep at least 20GB RAM free for the OS and OpenClaw gateway 5. Use NVFP4 quantization for larger models (see NVIDIA playbook at build.nvidia.com/spark/nvfp4-quantization)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: The uninstall section permanently deletes workspace files with rm and no confirmation, backup verification, or path hardening. If users have customized these files or if path assumptions are wrong, the commands can cause irreversible data loss in a sensitive agent workspace.
Content: Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.
md
cp -r ~/.openclaw/workspace ~/.openclaw/workspace.jarvis-backup.$(date +%Y%m%d) # Remove Jarvis-specific files rm ~/.openclaw/workspace/SOUL.md rm ~/.openclaw/workspace/IDENTITY.md rm ~/.openclaw/workspace/HEARTBEAT.md

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: This deletion command removes IDENTITY.md, a core workspace file, without checking ownership, existence, or whether the file contains user-modified content. The risk is accidental destruction of important agent configuration or memory state.
Content: Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.
md
# Remove Jarvis-specific files rm ~/.openclaw/workspace/SOUL.md rm ~/.openclaw/workspace/IDENTITY.md rm ~/.openclaw/workspace/HEARTBEAT.md # Restart gateway

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: Removing HEARTBEAT.md directly is another unguarded destructive action in a user workspace. In a skill meant for operational AI, silent deletion of behavior files can disrupt automation or erase customized instructions.
Content: Scanner excerpt · SKILL.md (reported line 396)May include surrounding context.
md
# Remove Jarvis-specific files rm ~/.openclaw/workspace/SOUL.md rm ~/.openclaw/workspace/IDENTITY.md rm ~/.openclaw/workspace/HEARTBEAT.md # Restart gateway sudo systemctl restart openclaw

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · templates/AGENTS.md (reported line 60)May include surrounding context.
md
### Never Do - Delete emails, files, or data without explicit approval - Send messages to contacts not in the approved list - Share confidential information (Intel MOU, client details, pricing internals) in group chats - Make financial commitments - Modify your own SOUL.md without telling Yogesh

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users to run a shell deployment script directly without disclosing that it will modify the OpenClaw workspace. While this is common for setup documentation, it is still a security-relevant omission because users are encouraged to execute code before understanding its side effects, which increases the chance of unintended file changes or trust-boundary confusion.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README makes a security claim that all filesystem operations stay within the OpenClaw workspace, but the documented deployment path uses ~/.openclaw, which is outside the workspace boundary. This is dangerous because it can mislead users and reviewers about the script's trust boundary and write scope, reducing informed consent and masking where files are actually being read from or executed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description says to use the skill when 'setting up Jarvis, configuring an AI executive agent, deploying OpenClaw on GB10, initializing agent persona and memory, or building an always-on local AI assistant for business operations.' This is a wide set of loosely bounded scenarios and does not provide explicit trigger phrases, exclusions, or narrow invocation context, increasing the risk of unintended activation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The introduction states that Jarvis runs entirely on hardware with no data leaving the machine, but the same document later recommends Tailscale remote access and optional external services like Brave Search. This is a misleading security claim that can cause operators to underestimate exposure and deploy the agent in more sensitive environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The skill deploys searxng/searxng:latest without pinning a specific tag or digest. Using a floating image reference makes builds non-reproducible and exposes users to unexpected upstream changes or a compromised image being pulled later.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions tell users to export a Brave API key and append it directly to ~/.bashrc, creating long-lived plaintext credential storage. This increases the chance of accidental disclosure through shell history, backups, dotfile syncing, local compromise, or later file inspection by tools and agents.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The security model section claims the skill contains no external network calls or credential requests, yet earlier sections explicitly configure Brave Search, remote access, and web search. This kind of contradictory assurance can mislead users into trusting the deployment more than warranted and bypassing appropriate review.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's security declaration is inaccurate: it claims to only modify local OpenClaw configuration and firewall rules, but it also changes filesystem permissions in the workspace. Misleading declarations can cause operators to underestimate side effects and approve execution without understanding that local file access semantics will be altered.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README makes a security claim that all filesystem operations remain within the OpenClaw workspace, but the documented deployment command executes a script from ~/.openclaw/skills/... under the user's home directory. This is dangerous because users may trust the skill's confinement guarantees and run scripts with reduced scrutiny, even though the installation and deployment path operates outside the stated boundary and could modify broader user-owned files.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs users to execute shell commands and helper scripts, yet it declares no explicit tool scope or allowed-tools. That mismatch weakens platform guardrails because the skill can prompt shell execution without transparent permission boundaries, increasing the chance of unintended command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown/manifest content describes invocation conditions such as 'setting up Jarvis,' 'configuring an AI executive agent,' and 'building an always-on local AI assistant' in a very broad way. Without explicit trigger phrases, exclusions, or narrower context limits, the skill could match many ordinary requests related to AI setup and unintentionally activate.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The Docker command pulls searxng/searxng:latest, which is mutable and can change over time without review. That creates a supply-chain risk: future runs may fetch a compromised or incompatible image and execute it locally with network exposure on port 8888.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T02 · Agent Memory Poisoning

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Verify it works

Phase 4: Security Hardening (5 minutes)

Phase 5: Verify Deployment (2 minutes)

Chaining Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tp4

Tp4

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Verify it works

Phase 4: Security Hardening (5 minutes)

Phase 5: Verify Deployment (2 minutes)

Chaining Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Exfiltration Commands

Missing User Warnings

Intent-Code Divergence

Vague Triggers

Intent-Code Divergence

Rp1

Missing User Warnings

Intent-Code Divergence

Intent-Code Divergence

Intent-Code Divergence

Undeclared Tool Scope

Vague Triggers

Rp1

Static analysis