Vesper

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:54 AM UTC
• Version: 2.7.0

Overview

Vesper has a coherent daily-briefing purpose, but it automatically creates persistent jobs and silently self-updates from GitHub while aggregating sensitive cross-skill data.

Review before installing. The briefing function itself is understandable, but installation should not proceed unless you are comfortable with first-run cron registration, recurring personal-data processing, persistent journals, and an automatic GitHub self-update mechanism. Prefer disabling the update cron, requiring manual reviewed updates from signed or pinned releases, and aligning the manifest permissions with the actual cross-skill read paths.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:269

Finding

Unattended Installation of Mutable Remote Repository Content

Content

View full analysis

"$TMPDIR/archive.tar.gz" mkdir "$TMPDIR/extracted" tar xzf "$TMPDIR/archive.tar.gz" -C "$TMPDIR/extracted" --strip-components=1 cp -R "$TMPDIR/extracted/"* ./ rm -rf "$TMPDIR" ``` ``` ### Technical Analysis The update procedure downloads an archive from the mutable `main` branch and copies its files directly over the installed skill. It does not pin an immutable commit, verify a cryptographic checksum, authenticate a release signature, validate an allowlist of files, or require user review before installation. The remote version comparison is not a security control. Both `skill.json` and the archive come from the same mutable repository, so an attacker who controls the repository can change the version and payload together. Because skill instructions determine subsequent agent behavior, replacing `SKILL.md` or adding executable components can alter future tool use and data access. The use of a temporary directory does not mitigate supply-chain compromise. Additionally, the archive is extracted without an explicit preliminary inspection for unsafe archive entries. ### Attack Path 1. An attacker compromises t ...[truncated 1193 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:236

Finding

Automatic Registration of Persistent Scheduled Tasks

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skill.json:8

Finding

Filesystem Permission Declaration Does Not Cover Instructed Cross-Skill Reads

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:217

Finding

Unverified Cross-Skill Observations Are Persisted into Long-Term Journals

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README documents a daily GitHub-based self-update mechanism but does not clearly warn that code will be fetched and applied automatically on a schedule. In an agent skill context, unattended remote updates create a supply-chain and persistence risk because future repository compromise or malicious releases could change runtime behavior without fresh user approval.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

This describes self-modifying behavior: on first invocation the skill installs persistent cron jobs and one of them performs daily self-updates from GitHub. Self-modification combined with persistence is dangerous because it lets the skill alter its codebase and execution schedule after initial trust is granted, expanding the blast radius of any upstream compromise.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md

## Setup

`vesper.init` runs automatically on first invocation and creates all required directories, config.json, and JSONL files. It also registers the `vesper:morning` cron job (daily 7am) and `vesper:evening` cron job (daily 6pm) and `vesper:update` (midnight daily, self-update). No manual setup is required.

## Dependencies

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The scheduled tasks table confirms a midnight cron job that performs self-update from GitHub source. A persistent unattended updater is a classic supply-chain risk: if the source repository, dependency path, or transport trust is compromised, arbitrary new behavior can be introduced automatically.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

md

|---|---|---|---|
| `vesper:morning` | cron | `0 7 * * *` (daily 7am) | Morning briefing generation |
| `vesper:evening` | cron | `0 18 * * *` (daily 6pm) | Evening briefing generation |
| `vesper:update` | cron | `0 0 * * *` (midnight daily) | Self-update from GitHub source |

## Changelog

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The changelog explicitly advertises automatic version-checked self-updates, reinforcing that unattended code modification is a deliberate feature rather than incidental wording. Even with version checks, this remains dangerous because version checking does not establish trustworthiness or integrity of the fetched code.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

md

- Elephas journal cooperation in skill cooperation section

### v2.3.0 -- March 27, 2026
- Added `vesper.update` command and midnight cron for automatic version-checked self-updates

### v2.2.0 -- March 22, 2026
- Routing improvements

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This skill contains a self-modification capability that downloads a tarball from the configured repository and copies its contents over the local installation. Any self-updating mechanism materially increases risk because it can change trusted behavior after deployment; combined with silent execution, it becomes a strong supply-chain and persistence vector if the upstream repository is compromised or the update process is abused.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

text

## Self-update

`vesper.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill is configured for self-modification via a remote GitHub source using a tarball fetched through the gh CLI. Any automatic code update mechanism expands the trust boundary to an external repository and introduces supply-chain risk; if the source, release process, or transport assumptions are compromised, the skill could replace itself with malicious code.

Content

Scanner excerpt · skill.json (reported line 19)May include surrounding context.

json

"~/openclaw/journals/ocas-vesper/"
    ]
  },
  "self_update": {
    "source": "https://github.com/indigokarasu/vesper",
    "mechanism": "version-checked tarball from GitHub via gh CLI",
    "command": "vesper.update",

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The manifest schedules the self-update command to run every day at midnight, turning the self-modification capability into an unattended recurring action. This materially increases danger because a compromised upstream source or mistaken release would be pulled automatically without user review, enabling persistence and rapid propagation of malicious changes.

Content

Scanner excerpt · skill.json (reported line 46)May include surrounding context.

json

"name": "vesper:update",
      "schedule": "0 0 * * *",
      "command": "vesper.update",
      "description": "Self-update from GitHub source"
    }
  ]
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README states that initialization automatically creates files and registers recurring cron jobs, including a daily self-update, without presenting this as a prominent security-sensitive behavior requiring explicit user consent. Automatic background execution plus system modification materially increases risk because a user may invoke the skill once and unknowingly grant it persistent execution and future code changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes very broad phrases such as 'what's happening' and 'catch me up', which can match ordinary conversation and cause this skill to activate in contexts the user may not intend. Because Vesper aggregates data from multiple other skills and personal sources, accidental invocation can expose sensitive summaries or route user requests away from safer, more specific tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly documents a silent update path that pulls code from a remote GitHub source and replaces the local package without prior user-facing approval. Silent remote updates reduce transparency and create a supply-chain risk: if the source repo or transport path is compromised, malicious changes can be installed and executed with the skill's existing privileges.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template hard-codes the greeting as "Good morning Jared," and the rules later require greetings to be either "Good morning Jared" or "Good evening Jared." This natural-language constraint fixes the addressee identity rather than allowing user-specific or configurable naming, which is a policy-style personalization issue in the file's instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mandates persistent journal writes to a user home-directory path for every run, but provides no notice, consent flow, retention guidance, or minimization requirements. Because the journal schema includes command content, timestamps, model/runtime metadata, and identifiers, this creates a privacy and data-governance risk if sensitive user inputs are stored on disk unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest includes very broad natural-language trigger phrases such as "what's happening" and "catch me up," which can cause the skill to activate unintentionally in unrelated contexts. Because the skill aggregates system-wide signals and writes briefings, accidental invocation could expose sensitive summaries or cause background processing the user did not intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This manifest describes a skill that reads across multiple intake directories, aggregates potentially sensitive operational data, and performs scheduled self-updates from GitHub, yet it provides no user-facing warning or consent model. That combination increases the risk of silent data exposure and unreviewed code changes, especially because the update runs automatically on a daily schedule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The instruction requires the greeting line to be exactly "Good morning Jared" or "Good evening Jared," which constrains output to English with no opt-in or documented locale justification. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.