Mentor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:46 AM UTC
• Version: 2.3.0

Overview

The skill is mostly coherent as an orchestration and evaluation tool, but it grants persistent background authority, silently self-updates from a mutable GitHub source, and includes a broad Gmail-based contact-profiling workflow.

Install only if you are comfortable with Mentor running recurring background jobs, reading all OpenClaw journals, invoking other skills, and potentially enriching contacts from Gmail and public sources. Disable or remove the automatic self-update cron, avoid scheduled random contact enrichment, and review any plan before allowing it to write personal data into Weave.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:233
• Finding: Persistent unsigned remote self-update permits post-review payload replacement## Vulnerability Details **File Location**: `SKILL.md:233-254` and `SKILL.md:260-277` **Vulnerability Type**: Unsigned remote update combined with persistent scheduled execution **Risk Level**: Critical ### Vulnerable Code ```text 8. Register cron jobs `mentor:deep` and `mentor:update` if not already present (check `openclaw cron list` first) 9. Register heartbeat entry `mentor:light` in `HEARTBEAT.md` if not already present ``` ```bash openclaw cron list # If mentor:deep absent: openclaw cron add --name mentor:deep --schedule "0 5 * * *" --command "mentor.heartbeat.deep" --sessionTarget isolated --lightContext true --wakeMode next-heartbeat --timezone America/Los_Angeles # If mentor:update absent: openclaw cron add --name mentor:update --schedule "0 0 * * *" --command "mentor.update" --sessionTarget isolated --lightContext true --timezone America/Los_Angeles ``` ```text ## Self-update `mentor.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred. 1. Read `source:` from frontmatter → extract `{owner}/{repo}` from URL 2. Read local version from `skill.json` 3. Fetch remote version: `gh api "repos/{owner}/{repo}/contents/skill.json" --jq '.content' | base64 -d | python3 -c "import sys,json;print(json.load(sys.stdin)['version'])"` 4. If remote version equals local version → stop silently 5. Download and install: ```bash TMPDIR=$(mktemp -d) gh api "repos/{owner}/{repo}/tarball/main" > "$TMPDIR/archive.tar.gz" mkdir "$TMPDIR/extracted" tar xzf "$TMPDIR/archive.tar.gz" -C "$TMPDIR/extracted" --strip-components=1 cp -R "$TMPDIR/extracted/"* ./ rm -rf "$TMPDIR" ``` 6. On failure → retry once. If second attempt fails, report the error and stop. ``` ### Technical Analysis Initialization registers `mentor.update` as a daily cron task. The updater retrieves the mutable `m ...[truncated 2081 chars]
• Remediation: ## Remediation Suggestions 1. Remove automatic unattended updates and require explicit user or administrator approval. 2. Retrieve only immutable, versioned releases or commit hashes rather than a mutable branch. 3. Verify releases using a trusted cryptographic signature whose public key is distributed separately from the update source. 4. Maintain a signed file manifest and verify every extracted file before installation. 5. Stage updates outside the live Skill directory and perform security validation before an atomic switch. 6. Validate archive paths, file types, and extraction boundaries before copying any content. 7. Display the source commit, changed files, requested capability changes, and signature status before approval. 8. Preserve the previous verified version and support automatic rollback after validation or execution failure. 9. Do not register the updater as a persistent cron task by default. If scheduled updates are necessary, make registration opt-in and notify the user of every update attempt.

T07 · Tool Hijacking and Spoofing

Error

• Location: references/workflow_plans.md:15
• Finding: Mutable workflow plans can redirect execution to arbitrary installed skill commands## Vulnerability Details **File Location**: `SKILL.md:227-233`; `references/workflow_plans.md:15-17`; `references/workflow_plans.md:25-45` **Vulnerability Type**: Untrusted declarative command dispatch **Risk Level**: High ### Vulnerable Code ```text 7. Copy bundled plans from skill package `references/plans/*.plan.md` to `~/openclaw/data/ocas-mentor/plans/` -- skip any plan file already present (do not overwrite user-modified plans) ``` ```text Plans are pre-authored, parameterized task sequences stored at `~/openclaw/data/ocas-mentor/plans/*.plan.md`. Each plan defines an ordered set of steps, the skill and command each step invokes, what inputs each step receives, and what outputs it produces for downstream steps. ``` ```text ### 1. Load and validate the plan Read the plan file at `~/openclaw/data/ocas-mentor/plans/{plan_id}.plan.md`. Validate: - All required parameters are present (from `--arg` flags or user prompt) - All step IDs are unique - All `{{steps.x.y}}` references point to steps that appear earlier in the sequence If validation fails, abort before starting. Report which parameter or reference is invalid. ``` ```text **b. Invoke the skill** -- execute the step's skill and command with the resolved inputs. Follow the step's Notes for any special handling (identity heuristics, extraction patterns, write-back behavior). ``` ### Technical Analysis Persisted plan files directly select the `skill` and `command` that Mentor executes. The documented validation checks required parameters, duplicate step IDs, and reference ordering, but it does not authenticate a plan, verify its origin, restrict commands to an allowlist, enforce declared capabilities, or require confirmation before executing side effects. Initialization explicitly preserves previously modified plan files. Therefore, a plan can remain altered across Mentor upgrades and continue to be treated as an executable workflow definition. ...[truncated 1464 chars]
• Remediation: ## Remediation Suggestions 1. Define an explicit allowlist of permitted skill and command pairs for every trusted plan. 2. Validate plans against a strict schema that rejects unknown fields, unsupported commands, malformed substitutions, and undeclared side effects. 3. Cryptographically sign bundled plans and reject modified plans unless the user explicitly approves and re-signs them. 4. Store trusted plans in a read-only directory separate from user-authored plans. 5. Apply restrictive filesystem permissions to the writable plan and plan-run directories. 6. Require interactive confirmation before commands that access private data, perform network operations, modify durable state, or invoke high-privilege skills. 7. Resolve commands through a capability broker that verifies both the plan's declared permissions and the target skill's manifest. 8. Record and display a plan hash at creation and invocation time; stop execution if it changes unexpectedly. 9. Disable cron and heartbeat execution for untrusted or locally modified plans.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/plans/contact-enrichment.plan.md:83
• Finding: Contact-enrichment workflow performs broad sensitive-data collection and durable third-party profiling## Vulnerability Details **File Location**: `references/plans/contact-enrichment.plan.md:83-125`; additional processing at `references/plans/contact-enrichment.plan.md:143-227` **Vulnerability Type**: Excessive private-data access and persistent profiling **Risk Level**: High ### Vulnerable Code ```text ## Step 2: gmail-scan **Skill:** gog (Gmail via `gog gmail messages search`) **Command:** gmail-messages-search ``` ```bash gog gmail messages search "{query}" --max {{params.gmail_max_messages}} --account $GOG_ACCOUNT --json ``` ```text **Review ALL returned messages -- not a sample.** This is the only step with direct access to first-party signals. Skimming degrades enrichment quality significantly. **Extraction targets** (look for these in every message body and signature): - **Relationships**: any mention of family members (spouse, children, parents, siblings), close colleagues, or named connections ("my partner Alex", "my daughter Emma") - **Life events**: birthdays, anniversaries, births, deaths, job changes, moves, graduations, health events -- note the date if present - **Alternative contact methods**: phone numbers in signatures, secondary email addresses, social handles - **Current employer and role**: from email signatures (employer name, title, department) - **Location**: city or region from signature, out-of-office messages, or contextual mentions - **Topics of interest**: recurring subjects, hobbies, professional interests that appear across multiple threads - **Preferred name**: if they sign emails with a different name than their display name, record as alias ``` ```text **Write-back rules:** - Source type: `inferred` for anything extracted from email content; `user-stated` only if the contact explicitly stated a fact about themselves in first person - `source_ref`: Gmail message ID (format: `gmail:{message_id}`) - `record_time`: current timestamp - `confidence`: `0.9` for facts fro ...[truncated 2919 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed approval for every contact-enrichment run and identify the contact before Gmail access begins. 2. Do not permit random-contact enrichment through unattended cron or heartbeat execution by default. 3. Show the Gmail queries, requested message scope, and intended data categories before access. 4. Default to metadata or narrowly selected threads rather than reviewing all returned message bodies. 5. Exclude sensitive categories such as health, deaths, family details, and information about minors unless the user expressly requests them. 6. Never create third-party Person nodes or relationship edges automatically. Present proposed records and provenance for approval. 7. Provide a pre-write preview with individual accept, reject, and redact controls. 8. Enforce purpose limitation, configurable retention, deletion, export, and field-level access controls. 9. Encrypt stored profiles and provenance references and prevent sensitive values from appearing unnecessarily in journals. 10. Reconcile the Skill capability manifest with all documented Gmail, Weave, Fellow, and Forge interactions and deny undeclared access at runtime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Self-Modification

High

• Category: Rogue Agent

Content

|---|---|---|---|
| `mentor:deep` | cron | `0 5 * * *` (daily 5am) | Full OKR scoring, trend analysis, variant proposals |
| `mentor:light` | heartbeat | Every heartbeat pass | Ingest journals, update aggregates, queue work |
| `mentor:update` | cron | `0 0 * * *` (midnight daily) | Self-update from GitHub source |

## Changelog

• Confidence: 91% confidence
• Finding: The README documents an automatic midnight self-update from GitHub source for the control-plane skill. A self-updating orchestrator is dangerous because it can change behavior without human review, and if the update channel or repository integrity is compromised, new code could gain broad access to task execution, journals, and connected skills.

Self-Modification

High

• Category: Rogue Agent

Content

- Init now creates `plans/` and `plan-runs/` directories and copies bundled plans

### v2.3.0 -- March 27, 2026
- Added `mentor.update` command and midnight cron for automatic version-checked self-updates

### v2.2.0 -- March 22, 2026
- Routing improvements

• Confidence: 90% confidence
• Finding: The changelog confirms support for automatic version-checked self-updates, reinforcing that self-modification is an intended feature rather than incidental wording. In a system described as a self-improving control plane, this compounds risk because updates alter a privileged coordinator that can schedule tasks, read journals, and influence other skills.

Self-Modification

High

• Category: Rogue Agent

Content

Heartbeat registration: append `mentor:light` entry to `~/.openclaw/workspace/HEARTBEAT.md` if not already present.


## Self-update

`mentor.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.

• Confidence: 97% confidence
• Finding: The skill includes a built-in self-update mechanism that changes its own local code from a remote source. Self-modification is especially risky here because this skill also has orchestration authority, background execution hooks, and access to broad journal data, so a compromised update could materially expand control and persistence.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The self-update flow downloads a remote tarball from GitHub and copies its contents over the local skill directory, effectively replacing local files without meaningful verification or an explicit warning to the user. If the upstream repository, branch, or network path is compromised, this becomes a supply-chain update path that can introduce arbitrary malicious skill logic.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The plan explicitly states it will scan broad Gmail history for a person and write extracted facts back into Weave, but it provides no mandatory user-facing consent, notice, or scope limitation. This creates a privacy and authorization risk because highly sensitive first-party communications may be processed and persisted without explicit confirmation for each run.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Allowing the plan to select a random contact when no contact_id is supplied enables enrichment of arbitrary individuals without deliberate user selection. In the context of Gmail history scanning and persistent record updates, this materially increases the chance of unauthorized or unexpected processing of personal data.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The plan recommends periodic automated execution against random contacts, which normalizes recurring access to private email history and ongoing modification of personal records without requiring renewed approval. This increases both privacy exposure and the blast radius of mistakes because the workflow can silently process many contacts over time.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The instructions direct the agent to review all returned Gmail messages, including bodies and signatures, rather than using a minimally necessary subset. In a contact-enrichment context, that broad access can expose intimate or unrelated personal data and amplifies the consequences of overcollection, misinterpretation, and unauthorized storage.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The plan instructs extraction of highly sensitive personal details from all Gmail history, including relationships, health events, life events, alternative contact methods, and other private facts, then persists them into Weave. This is dangerous because it turns private communications into a structured dossier, increasing the risk of surveillance, misuse, secondary disclosure, and long-term harm if the datastore or downstream logs are accessed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README describes a workflow plan that scans Gmail and performs contact enrichment but gives no explicit privacy, consent, or data-handling warning. Because this skill is an orchestration/control-plane component and supports reusable plans, operators may enable sensitive data collection without understanding scope, retention, or downstream sharing across other skills.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The scheduled cron example runs contact enrichment unattended against user data, including Gmail-derived information, without warning about ongoing background access or consent renewal. In this context, unattended execution materially increases privacy risk because repeated collection can occur without user awareness and may propagate sensitive findings into journals, plan runs, or other integrated skills.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill is designed to recursively ingest journals from all skills under ~/openclaw/journals/, which can expose broad cross-skill operational data, prompts, outputs, and potentially sensitive artifacts. The description and usage guidance do not prominently warn users about this scope, so users may invoke the skill without informed consent about the data access involved.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Initialization persistently registers cron jobs and a heartbeat entry, causing the skill to run again in the background after a single invocation. Creating ongoing execution without a clear, up-front warning or opt-in can surprise users and expands the attack surface by enabling recurring automated behavior.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The cron registration hard-codes America/Los_Angeles, which can make scheduled execution occur at unexpected local times for most users. While not directly a code-execution flaw, it can cause unanticipated background activity, missed maintenance windows, or policy violations in environments where schedule timing matters.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs recursive reading of journals from a user-home directory and persistent tracking of ingested run identifiers, but provides no notice, consent boundary, minimization rule, or scope restriction for potentially sensitive journal contents. In an agent-skill context, this creates a real privacy and data-governance risk because it enables broad collection and retention of data produced by other skills, increasing the chance of over-collection, unintended cross-skill access, and persistence of sensitive operational metadata.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs writing proposal and decision JSON files into a user-local path under ~/openclaw/data/ocas-forge/intake without any warning, confirmation step, or stated authorization boundary. In an agent context, undocumented local file writes can cause unintended state changes, create persistence side effects, and enable chained abuse if upstream inputs can influence proposal_id, decision_id, or file contents.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file mandates persistent journaling of every run to a fixed path, including run identifiers, timestamps, model/runtime details, commands, and decision summaries, but provides no consent, minimization, retention, or visibility controls. This creates a privacy and data-governance risk because operational or potentially sensitive metadata may be stored on disk automatically and indefinitely, increasing exposure if the host is shared, compromised, or logs are later repurposed.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

3. Split task into smaller tasks
4. Revise task ordering/dependencies
5. Escalate to strategy loop
Every repair action must be journaled. Never retry indefinitely.

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

3. Split task into smaller tasks
4. Revise task ordering/dependencies
5. Escalate to strategy loop
Every repair action must be journaled. Never retry indefinitely.

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The final summary and action journal create an additional leakage channel by rephrasing enriched personal data into human-readable logs and journal entries. Even if Weave storage were controlled, these secondary artifacts may have broader access, weaker retention controls, or be easier to exfiltrate and search.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The bundled `contact-enrichment` plan is described as scanning Gmail and performing external enrichment/search actions without an accompanying privacy or data-sharing warning. Users may trigger collection and transmission of contact-related data to external systems without understanding the scope, which increases privacy, consent, and data-handling risk.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description includes trigger phrases such as 'manage this project' and 'coordinate a multi-step analysis', which are broad, common requests that can match many unrelated user intents. Because this skill is an orchestration engine with access to cross-skill journals and the ability to write improvement proposals to another skill's intake area, accidental invocation could expose sensitive workflow data or cause unauthorized coordination actions.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file states that VariantProposal and VariantDecision objects are written to files under `~/openclaw/data/ocas-forge/intake/`, which is a user-affecting filesystem operation. The document describes the write locations but does not include any warning or notice that the skill may create or overwrite files in the user's home directory.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The workflow directs the agent to create and update persistent run-state files, decision logs, and a journal entry, but it does not warn the user that plan execution will write to disk and preserve execution details. This can lead to unanticipated persistence of operational metadata or sensitive parameters, especially when plans process user-supplied inputs or automation contexts.

Static analysis

No suspicious patterns detected.