Lucid

• Outcome: Review
• Latest audit: Sep 23, 2026 · 2:04 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its journal-curation purpose, but it also adds scheduled persistence and a silent Git self-update path with destructive cleanup commands.

Review this before installing. The journal-curation and MemPalace filing behavior is disclosed, but the daily self-update job should be removed or disabled unless you explicitly trust the remote repository and accept that local skill changes can be overwritten. Prefer manual, reviewed updates with pinned commits or signed releases, and disable the update cron job if you only need journal processing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/update.sh:2

Finding

Unattended Self-Update Retrieves and Activates Mutable Remote Code

Content

View full analysis

Vulnerability Details

File Location: scripts/update.sh:2-5
Supporting Locations: SKILL.md:155-156, references/self-update-lucid.md:3-12
Vulnerability Type: Unattended remote code update
Risk Level: High

Complete Code Snippet

bash

cd "$(dirname "$0")/.."
git reset --hard HEAD 2>/dev/null
git clean -fd 2>/dev/null
git pull 2>/dev/null

The update is configured as a recurring job:

markdown

| `lucid:update` | cron | `0 0 * * *` (midnight daily) | `lucid.update` |

The documented update procedure explicitly retrieves the mutable origin/main branch:

markdown

3. Fetch remote version via `git fetch origin`
4. Check `git log HEAD..origin/main --oneline` for incoming commits
...
7. `git pull origin main`

Technical Analysis

Initialization registers a daily update task, and the update script performs an unrestricted git pull from the configured remote. The retrieved revision is not pinned to a previously approved commit, verified against a digest, or authenticated through a required trusted signature. There is also no staging and approval gate before the fetched files become the active Skill installation.

This creates a post-review code execution channel: the effective contents of Skill instructions and scripts can change after the installed package has been audited. The attacker-controlled point is the mutable remote branch, under the control of the repository operator or an attacker who compromises that repository or its publishing credentials.

The dangerous operation is not merely downloading data. The pull replaces active Skill files, which are subsequently interpreted or executed by scheduled and manual Skill invocations under the Agent's existing permissions.

Attack Path

1. lucid.init registers the documented midnight lucid:update job.
2. The remote repository operator, or an attacker with control of the remote repository, adds malici ...[truncated 1058 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable unattended activation of remote updates.
2. Fetch updates into a separate staging directory or detached worktree.
3. Pin updates to an explicitly approved commit rather than following a mutable branch.
4. Require verification of a trusted commit or release signature. If signatures are unavailable, verify a digest delivered through an independently trusted channel.
5. Display the exact commit range and file diff, then require explicit user approval before activation.
6. Reject updates that modify unexpected files, introduce new executables, or alter scheduled-task definitions unless separately approved.
7. Activate an approved revision atomically and retain a known-good rollback copy.
8. Record the verified commit identifier and verification result in the update log.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/update.sh:2

Finding

Scheduled Update Unconditionally Deletes Local Changes and Untracked Files

Content

View full analysis

Vulnerability Details

File Location: scripts/update.sh:2-5
Vulnerability Type: Destructive filesystem operation without confirmation or scope validation
Risk Level: Medium

Complete Code Snippet

bash

cd "$(dirname "$0")/.."
git reset --hard HEAD 2>/dev/null
git clean -fd 2>/dev/null
git pull 2>/dev/null

Technical Analysis

Before updating, the script executes two unconditional destructive operations:

• git reset --hard HEAD discards all modifications to tracked files in the Skill working tree.
• git clean -fd recursively deletes all untracked files and directories within that working tree.

The script has no dirty-tree check, path allowlist, dry-run, backup, or interactive confirmation. Error output is redirected to /dev/null, further reducing the user's ability to observe failures or destructive cleanup.

This behavior is broader than the documented need to remove only untracked files that conflict with incoming tracked files. Because the update is scheduled, it can destroy user-created local adaptations and untracked project data without an update-time authorization decision.

Attack Path

1. A user or local integration creates an untracked file, directory, or tracked-file modification inside the Skill repository.
2. The recurring lucid:update task starts automatically.
3. git reset --hard HEAD discards tracked modifications.
4. git clean -fd recursively removes untracked files and directories.
5. The commands suppress diagnostic output, and no backup or recovery mechanism preserves the deleted content.

No external attacker is required to trigger this path. If a remote update creates a filename conflict, the broad cleanup still deletes every untracked path rather than only the validated conflicting path.

Impact Assessment

The affected scope is the complete Skill Git working tree. Local customizations to tracked files can be irreversibly discarded, while ...[truncated 268 chars]

Remediation

View remediation

Remediation Suggestions

1. Abort the update when git status --porcelain reports a dirty working tree.
2. Preserve local changes in a timestamped backup outside the repository before any cleanup.
3. Run git clean -nd first and present the exact deletion list for approval.
4. Do not use repository-wide git clean -fd; remove only individually validated paths that conflict with the approved update.
5. Require explicit confirmation before discarding tracked modifications or deleting untracked content.
6. Keep normal command diagnostics visible and write structured update logs.
7. Prefer installing an approved revision into a new directory and switching installations atomically, leaving the existing working tree untouched.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (54)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 28)May include surrounding context.

md

- Hibernation protection: skip cycle entirely if no new journals for 7 consecutive days
- Relevance scoring model with additive signals and penalties (see `references/classification.md`)
- Wing/room assignment taxonomy for all OCAS skill domains
- `lucid:update` cron job (midnight daily self-update)
- `lucid.update` command and self-update procedure
- MemPalace declared as required MCP in frontmatter
- Standard `hermes:` and `openclaw:` frontmatter structure

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 29)May include surrounding context.

md

- Hibernation protection: skip cycle entirely if no new journals for 7 consecutive days
- Relevance scoring model with additive signals and penalties (see `references/classification.md`)
- Wing/room assignment taxonomy for all OCAS skill domains
- `lucid:update` cron job (midnight daily self-update)
- `lucid.update` command and self-update procedure
- MemPalace declared as required MCP in frontmatter
- Standard `hermes:` and `openclaw:` frontmatter structure

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill presents itself as a journal curator, yet the documented update path includes repository synchronization behavior and the analysis indicates destructive git operations such as reset/clean. Hidden maintenance or updater behavior is dangerous because it can overwrite local state, erase changes, or import unreviewed code under the guise of a benign data-processing skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill presents itself as a journal curator, yet the documented update path includes repository synchronization behavior and the analysis indicates destructive git operations such as reset/clean. Hidden maintenance or updater behavior is dangerous because it can overwrite local state, erase changes, or import unreviewed code under the guise of a benign data-processing skill.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

s scope. When running elephas directly (not via the `ocas-elephas` skill), see `references/elephas-pipeline-gotchas.md` for the expected unprocessed residual pa

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md

s scope. When running elephas directly (not via the `ocas-elephas` skill), see `references/elephas-pipeline-gotchas.md` for the expected unprocessed residual pa

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

A self-update capability is a self-modification pathway that can change the skill's behavior after initial review. In security-sensitive agent environments, that undermines trust assumptions because future code may gain new behaviors or permissions without equivalent scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

Lucid extracts no entities from user data directly. It classifies and routes journal content produced by other skills. When it emits Signals to Elephas, the Signal's `payload.type` reflects the entity type found in the source journal (Person, Place, Concept, etc.) per spec-ocas-ontology.md.

## Self-Update

See `references/self-update-lucid.md`.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The repeated self-update reference reinforces that the skill can modify or replace its own logic outside its stated curation role. This materially increases risk because a benign journal processor becomes a moving execution target with supply-chain exposure.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

## Self-Update

See `references/self-update-lucid.md`.

## Visibility

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The cron pattern explicitly instructs writing Python to /tmp and executing it via terminal, which materially expands the skill from file curation into arbitrary code execution. In an adversarial or compromised workflow, this becomes a flexible execution primitive that can run far beyond the stated purpose of journal processing.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/classification.md (reported line 50)May include surrounding context.

md

- Pure metrics/heartbeat journals (early exit above)
- Journal type "Observation" with no entities, no lessons, no decisions, no blockers
- Self-update journals with only version bump (no adaptations preserved)
- Routine sync journals (Spotify sync, calendar scan) with only success/failure status

## Classification Algorithm (Two-Pass)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This documentation describes a workflow that reads autobiographical observations, transforms them into synthetic dream content, and stores the result, which materially diverges from the skill's declared purpose of classifying OCAS journals into note/entity/skip outputs. That kind of undocumented scope expansion is dangerous because it can normalize or conceal processing of sensitive personal data for unrelated content generation and persistence, increasing privacy, integrity, and misuse risk.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

A self-update/self-modification procedure allows the skill to change its own code or operational content after deployment. In this context, that is especially risky because the skill is supposed to curate journals, not manage its own software lifecycle, so the capability is unnecessary and expands the attack surface significantly.

Content

Scanner excerpt · references/self-update-lucid.md (reported line 1)May include surrounding context.

md

# Lucid — Self-Update Procedure

`lucid.update` pulls the latest package from GitHub. Runs silently.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document defines a self-update mechanism that fetches and merges code from a remote GitHub repository, which is outside the stated journal-curation purpose of the skill. Allowing a skill to modify its own codebase introduces a software supply-chain and unauthorized capability expansion risk, especially because the update is described as running silently.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions authorize git fetch/pull, stash, conflict resolution, and commit operations for a skill whose declared role is journal curation. This grants code-changing behavior unrelated to the business function and creates a path for remote repository compromise, unintended code drift, or silent installation of new behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The procedure includes destructive cleanup actions such as resetting tracked files and deleting untracked files to make a pull succeed. These operations can destroy local data, remove operator-created files, and mask tampering or accidental overwrites, especially when performed as part of a silent update flow.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The documented use of commands like 'rm -f references/foo.md references/bar.md' enables destructive file deletion as part of the update flow. In an agent context, such patterns are dangerous because parameterized file paths or mistaken targeting can delete important local content unrelated to the intended update.

Content

Scanner excerpt · references/self-update-lucid.md (reported line 15)May include surrounding context.

bash

   # Remove untracked files that conflict with tracked incoming files
   git checkout -- .
   # Or remove specific untracked files: rm -f references/foo.md references/bar.md

8. On pull failure → retry once, then report error
9. git stash pop — this may produce merge conflicts if stash modifies the same files the pull updated

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The use of git reset --hard is an unsafe parameter choice because it forcibly resets tracked files to HEAD and discards any local modifications. In this skill context, that capability is unrelated to journal processing and increases risk by enabling silent destruction of user changes as part of routine execution or maintenance.

Content

Scanner excerpt · scripts/update.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
cd "$(dirname "$0")/.."
git reset --hard HEAD 2>/dev/null
git clean -fd 2>/dev/null
git pull 2>/dev/null

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README lists write-capable commands and cron/job registration behavior without clearly warning that these operations can modify storage, knowledge-graph state, or scheduling on the host. In an agent setting, presenting side-effecting commands without safety guidance increases the chance of unintended persistent changes, especially because the skill already operates batch jobs and memory-writing actions rather than read-only analysis.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises a lucid.update command that pulls the latest code from GitHub, which materially expands the skill from journal curation into remote code acquisition and replacement. In an agent/tooling context, undocumented or weakly governed self-update behavior can let an attacker or compromised upstream source introduce arbitrary code changes, creating a supply-chain execution risk far beyond the stated purpose of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A journal-curation skill does not need a GitHub update capability to perform its core function, so exposing this command represents unjustified privilege and unnecessary attack surface. If invoked by an agent or user without strict controls, it can fetch and apply untrusted changes, enabling persistence, behavior drift, or full compromise through malicious repository content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly documents read/write access to journals, data files, temp scripts, and cron-managed state, but it declares no explicit tool scope or permissions boundary. That mismatch weakens reviewability and allows an operator or agent runtime to grant broader file capabilities than users would reasonably infer from the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill performs multiple writes to local journals and external memory/KG systems, but the description lacks a prominent user-facing warning about data modification and privacy implications. That omission can cause users to enable processing of sensitive journal content without understanding where it will be copied or persisted.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest explicitly excludes 'entity identity resolution' from the skill's scope, yet the responsibility and cooperation sections say Lucid queries elephas.query to check if an entity already exists before emission. Determining whether a candidate entity matches an already-known entity is semantically part of identity resolution, creating a mismatch between stated scope and described behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Initialization can create directories/files and install cron jobs, but there is no strong caution that these are persistent system changes. Users may treat initialization as a harmless setup step when it actually modifies both filesystem state and scheduler configuration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Self-update from GitHub introduces a remote code supply-chain path that is not inherent to journal curation. A skill that can fetch and install changed logic can be turned into a persistence or compromise vector if the source, transport, or update process is tampered with.

Content

No source excerpt is available for this finding.