Ocas Praxis

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:53 AM UTC
• Version: 2.0.0

Overview

This skill is purpose-built to persistently change agent behavior, but its controls for trusted inputs, approval, retention, and instruction precedence are not clear enough for that level of influence.

Install only if you intentionally want a skill that can maintain persistent behavioral lessons and inject active behavior shifts into future runs. Use a dedicated, permission-limited OCAS_ROOT, keep the intake directory writable only by trusted producers, review proposed shifts before activation, and periodically delete or archive journals and records that may contain sensitive task context.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:73

Finding

Untrusted Behavioral Data Can Become Persistent Runtime Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:35, 61, 69, 73-79; references/data_model.md:8-16; references/runtime_rules.md:3-10
Vulnerability Type: Persistent behavioral instruction injection
Risk Level: High

Vulnerable Code Snippets

SKILL.md:35

markdown

Praxis receives BehavioralSignal files from Corvus. Praxis decides whether to act on each signal.

SKILL.md:57-61

markdown

- No autonomous identity rewriting
- No silent safety boundary changes
- No unlimited behavior rule accumulation
- Only active shifts influence runtime
- Maximum 12 active shifts (configurable)
- Every shift must trace to recorded events

SKILL.md:67-69

markdown

## Runtime injection rules

The runtime brief is a compact list of active shifts only. Target: 3-12 items. Imperative, behavior-facing, free of historical clutter. Not a narrative log.

SKILL.md:71-79

markdown

## Inter-skill interfaces

Praxis receives BehavioralSignal files from Corvus at: `~/openclaw/data/ocas-praxis/intake/{signal_id}.json`

Praxis checks its intake directory during `praxis.event.record` and during any scheduled pass. Praxis decides whether to record each signal as an event and extract a lesson. It is not obligated to act on every signal.

After processing each file, move to `intake/processed/`.

See `spec-ocas-interfaces.md` for the BehavioralSignal schema and handoff contract.

references/data_model.md:8-16

markdown

## MicroLesson
```json
{"id":"string","event_ids":["string"],"lesson_text":"string","confidence":"string — high|med|low","scope":"string","status":"string — proposed|accepted|rejected"}

BehaviorShift

json

{"id":"string","source_lesson_ids":["string"],"shift_text":"string","status":"string — proposed|active|merged|expired|rejected","activation_reason":"string","created_at":"string","last_reviewed_at":"string","expiry_condition":"string|null","priority":"number"}

text

`references/runtime_rules.md:3-10`

```markd
...[truncated 3879 chars]

Remediation

View remediation

Remediation Suggestions

1. Authenticate signal producers

   • Require signed signals or a message authentication code tied to an explicitly trusted Corvus identity.
   • Verify ownership and restrictive permissions on the intake directory and every file before processing.
   • Reject symbolic links, unexpected file types, oversized files, duplicate identifiers, and files whose ownership or integrity cannot be established.

2. Replace unrestricted shifts with a constrained schema

   • Do not store arbitrary imperative text as an active shift.
   • Define an allowlisted set of behavioral controls, parameters, scopes, and conditions.
   • Generate runtime wording only from trusted templates and validated enum values.

3. Apply semantic validation

   • Reject shifts that mention instruction precedence, system or developer prompts, safety-policy changes, credentials, secrets, external destinations, shell commands, tool invocation, file access, or network actions.
   • Treat event summaries, evidence, lessons, and external signals strictly as untrusted data, never as executable instructions.

4. Require explicit approval

   • Keep automatically derived shifts in proposed status.
   • Require informed human approval before activation, presenting the source events, exact generated shift, expected effect, scope, and expiry condition.
   • Require elevated review for any shift that can affect tools, communications, privacy, or authorization decisions.

5. Enforce instruction precedence

   • State and enforce that active shifts are lower priority than system, developer, safety, current-user, and tool authorization requirements.
   • Ensure runtime briefs cannot modify permissions, disable safeguards, or authorize actions independently.
   • Delimit the brief as non-authoritative behavioral guidance rather than general instructions.

6. Improve lifecycle controls

   • Add mandatory expiration dates, periodic review, rollback, revocation, and a comp ...[truncated 629 chars]

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly persists behavioral events, lessons, shifts, debriefs, decisions, and per-run journals to local storage, but the user-facing description does not clearly warn about this ongoing data retention. This can lead operators to use the skill with sensitive behavioral or task data they would not have provided if storage behavior were disclosed, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill ingests files from a shared intake directory and moves them after processing, but this side effect is not surfaced as a clear warning to users. In a multi-skill or multi-process environment, undisclosed consumption and relocation of files can cause unintended data handling, loss of operator expectations about file state, and trust boundary issues around shared inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file mandates creation of persistent journals for every run, including a specific storage path and structured run metadata, but does not require any user-facing disclosure, consent, or control over that persistence. This is risky because users may unknowingly trigger durable logging of operational details and potentially sensitive command/context metadata, creating privacy, compliance, and data-retention exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.