SPIRIT State Sync

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:27 PM UTC
• Version: 1.1.0

Overview

The skill is purpose-aligned state backup tooling, but it recommends unsafe installation and unattended syncing of sensitive agent state, so users should review it carefully before installing.

Install only after reviewing exactly what .spirit-tracked will sync, using a private repository with least-privilege credentials, and avoiding the curl-to-bash restore path and git credential.helper store. Prefer the declared Homebrew install or a pinned verified release, start with manual syncs, and enable cron or autobackup only if continuous remote backups of agent memory and project files are intentional.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:191

Finding

Unverified Remote Installer Is Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 191
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

bash

# Install SPIRIT
curl -fsSL https://theorionai.github.io/spirit/install.sh | bash

Technical Analysis

The documented restore procedure downloads a mutable shell script from an external website and streams it directly into Bash. This combines retrieval and execution without allowing the user to inspect the payload and without verifying an immutable version, cryptographic signature, or checksum.

The effective code is not included in the audited project and can change after this Skill has been reviewed. Consequently, the behavior of the remote installer cannot be established through this static audit. Compromise of the hosting account, deployment pipeline, website content, or another relevant supply-chain component could turn the command into arbitrary code execution.

HTTPS protects the connection in transit but does not establish that the current remote script is the same script that was originally reviewed or intended by the user.

Attack Path

1. An attacker compromises the installer website, its publication pipeline, or an account authorized to update the hosted script.
2. The attacker replaces install.sh with a malicious shell payload.
3. A user follows the documented restore instructions.
4. curl retrieves the attacker-controlled content and immediately streams it to Bash.
5. Bash executes the payload with all permissions available to the invoking user.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking account. Depending on that account's privileges and accessible credentials, the payload could read or alter Agent identity and memory files, steal repository or SSH credentials, tamper with projects, establish persistence, delete data, or compromise the user accoun ...[truncated 81 chars]

Remediation

View remediation

Remediation Suggestions

Remove the curl | bash pipeline. Prefer the package-manager installation method already declared by the Skill, with a pinned and trusted release where supported.

If a standalone installer is necessary:

1. Publish versioned release artifacts from the declared upstream repository.
2. Download the installer to a local file rather than streaming it into a shell.
3. Pin an immutable release version or commit.
4. Publish and verify a SHA-256 digest or, preferably, a cryptographic signature backed by a documented trusted key.
5. Abort installation if verification fails.
6. Encourage users to inspect the downloaded script before execution.
7. Execute it without elevated privileges unless a specific installation step demonstrably requires elevation.
8. Document the files, permissions, and scheduled services the installer creates.

A safer workflow should resemble:

bash

curl -fL -o install.sh \
  https://example.invalid/releases/vX.Y.Z/install.sh
echo "EXPECTED_SHA256  install.sh" | sha256sum --check -
less install.sh
bash install.sh

The placeholder URL, version, and digest must be replaced with an immutable official release and its independently published expected checksum.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:159

Finding

Documentation Suggests Plaintext Persistence of Git Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 159
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Complete Code Snippet:

bash

git config credential.helper cache  # or 'store' for persistence

Technical Analysis

Git's store credential helper persistently saves credentials unencrypted on disk, typically in ~/.git-credentials. Although the documentation presents it as an alternative rather than enabling it automatically, users following the recommendation may expose reusable repository credentials to any process or local account able to read that file.

This is especially sensitive because the repository is intended to contain Agent identity, behavioral configuration, user preferences, conversation memories, and project data. The nonpersistent cache helper does not have the same at-rest exposure, but it should not be described interchangeably with plaintext store.

Attack Path

1. A user follows the documentation and configures credential.helper store.
2. The user authenticates to the configured HTTPS Git remote.
3. Git writes the reusable credential to plaintext storage.
4. Malware, a compromised process, an improperly privileged local user, or an exposed backup reads the credential file.
5. The attacker uses the credential to access the private state repository within the token's granted permissions.

Impact Assessment

Exploitation can disclose a reusable Git credential and permit unauthorized repository access. Depending on token scope, an attacker may clone private Agent state, alter or delete repository content, inject modified identity or behavioral files, or access other repositories authorized by the same credential. This finding does not itself grant operating-system privilege escalation.

Remediation

View remediation

Remediation Suggestions

Remove the recommendation to use credential.helper store, or clearly mark it as insecure plaintext storage.

Recommend one of the following instead:

1. Passphrase-protected SSH keys managed through ssh-agent.
2. GitHub CLI authentication using the operating system's secure credential facilities.
3. A platform-specific credential manager backed by the OS keychain or secret store.
4. Short-lived, narrowly scoped credentials where supported.

Also advise users who previously enabled store to:

1. Unset the helper from the applicable Git configuration scope.
2. Securely remove plaintext credential files after confirming their location.
3. Revoke or rotate credentials that may have been stored.
4. Review token scopes and repository access logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (11)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The restore instructions fetch and execute a remote shell script directly from the network, which bypasses package-manager integrity protections and gives the remote endpoint full code execution on the host. If the site, transport path, or published script is compromised, users will execute attacker-controlled code immediately.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

bash

# Install SPIRIT
curl -fsSL https://theorionai.github.io/spirit/install.sh | bash

# Clone your state
git clone [e-mail]:USER/REPO.git ~/.spirit

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping downloaded content directly into bash chains retrieval and execution into a single step, removing opportunities for inspection, validation, or integrity checking. In this skill's context, that pattern is especially dangerous because it is presented as a standard recovery step, making users more likely to run it without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

bash

# Install SPIRIT
curl -fsSL https://theorionai.github.io/spirit/install.sh | bash

# Clone your state
git clone [e-mail]:USER/REPO.git ~/.spirit

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/spirit-sync-cron.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# SPIRIT Auto-Sync Cron Script
# Place in crontab or use with OpenClaw scheduled jobs

set -e

# Check if spirit is installed
if ! command -v spirit &> /dev/null; then
    echo "Error: spirit not found in PATH"
    exit 1
fi

# Check if initialized
if [ ! -d "$HOME/.spirit" ]; then
    echo "Error: SPIRIT not initialized. Run: spirit init"
    exit 1
fi

# Run sync with timestamp
LOG_FILE="$HOME/.spirit/.cron-sync.log"
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting SPIRIT auto-sync..." >> "$LOG_FILE"

if spirit sync >> "$LOG_FILE" 2>&1; then
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] ✓ SPIRIT sync completed" >> "$LOG_FILE"
else
    ech

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick-start and top-level description emphasize preservation and syncing, but they do not prominently warn that user-related state, preferences, conversation logs, and project files may be uploaded to a remote Git repository. In a skill designed for agent memory/state management, that omission can cause users to enable syncing without informed consent about the sensitivity and external persistence of the data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-start path makes remote synchronization of workspace state a routine setup step, including files later described as identity, memory, user preferences, and projects. Because it is framed as the recommended workflow, users may push sensitive state to an external repository without fully appreciating what is being transferred or whether the remote is safely configured.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section explicitly defines preservation of USER.md, memory logs, and project files as the default workflow for syncing to a Git repository. That normalizes collection and external storage of potentially sensitive user-provided and session-derived data, creating confidentiality and retention risks if the repository is misconfigured, shared, or later exposed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The cron example establishes recurring automatic synchronization of workspace state every 15 minutes, which creates durable session persistence and repeated external transfer without per-run user review. In the context of memory, identity, and project data, this increases the blast radius of accidental inclusion of sensitive content and can continuously propagate newly added secrets or logs.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

bash

# Add to crontab
crontab -e

# Every 15 minutes
*/15 * * * * SPIRIT_SOURCE_DIR=/root/.openclaw/workspace /usr/local/bin/spirit sync 2>/dev/null

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide instructs users to configure unattended periodic syncs to a private Git repository but does not warn that these jobs may continuously transmit workspace/state data and rely on stored credentials. In a state-preservation tool, that omission can lead users to enable background exfiltration of sensitive agent memory, code, tokens, or project data without informed consent or review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 7)May include surrounding context.

bash

# Edit crontab
crontab -e

# Add entries (adjust path as needed):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These instructions describe OpenClaw cron jobs that can wake an agent session or spawn an isolated session and trigger sync behavior automatically, yet they omit any warning about unattended state-changing actions. In this skill's context, automatic wake-and-sync increases risk because it can cause autonomous repository writes or network pushes without a human verifying what state is being preserved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The built-in auto-backup section encourages enabling a daemon for ongoing backups but does not disclose that this creates continuous unattended persistence of agent state and potentially remote synchronization of user/project data. For a tool explicitly designed to preserve identity and memory, the lack of privacy and data-retention warnings materially increases the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.