Weave

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:46 AM UTC
• Version: 2.3.0

Overview

The skill’s social-graph functions are mostly coherent, but it automatically installs a silent daily self-updater that can replace the skill from GitHub, so it should be reviewed before installation.

Review this skill before installing. Its contact graph, local storage, and optional Google/Clay sync fit the stated purpose, but the daily automatic self-update should be removed or made explicit opt-in with signed, pinned releases and visible approval before replacing files. Keep writeback disabled unless you intentionally approve a specific sync, and remember that exports and connector staging files may contain sensitive personal data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:206

Finding

Automatic Daily Self-Update Establishes Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 206–221
Vulnerability Type: Persistent scheduled task installation
Risk Level: High

Vulnerable Code

markdown

## Initialization

On first invocation of any Weave command, `_open_db()` handles auto-initialization:

1. Create `~/openclaw/db/ocas-weave/` and subdirectories (`staging/`)
2. Write default `config.json` with ConfigBase fields if absent
3. Create `~/openclaw/journals/ocas-weave/`
4. Open database (auto-creates `weave.lbug` and runs DDL if tables absent)
5. Register cron job `weave:update` if not already present (check `openclaw cron list` first)
6. Log initialization as a DecisionRecord

## Background tasks

| Job name | Mechanism | Schedule | Command |
|---|---|---|---|
| `weave:update` | cron | `0 0 * * *` (midnight daily) | `weave.update` |

openclaw cron add --name weave:update --schedule "0 0 * * *" --command "weave.update" --sessionTarget isolated --lightContext true --timezone America/Los_Angeles

Technical Analysis

The Skill directs the Agent to install a daily cron job automatically during the first invocation of any command. This scheduled task survives the initiating run and repeatedly invokes the self-update feature without requiring approval for each execution.

Scheduled execution is not required for the Skill's core social-graph operations. Coupled with the mutable remote update mechanism, the cron job creates a persistent delivery channel through which later upstream changes can alter installed Skill instructions after the initially reviewed version has been approved.

Attack Path

1. A user invokes any Weave command.
2. The initialization procedure checks the cron configuration.
3. The Agent registers weave:update as a daily task.
4. The scheduled task survives the original session and runs in an isolated future session.
5. Each execution contacts the configured GitHub source and may instal ...[truncated 991 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic cron registration from first-use initialization.
• Require an explicit, informed user action before enabling scheduled updates.
• Keep updates manual by default and require confirmation for every installation.
• Clearly display the update source, target version, changed files, and integrity information before approval.
• If scheduling is retained, provide an obvious disable command and register no task unless the user affirmatively opts in.
• Combine these controls with immutable, cryptographically verified releases as described in the remote-update finding.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:225

Finding

Unverified Mutable GitHub Payload Is Downloaded and Installed Silently

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 225–242
Vulnerability Type: Unverified remote payload retrieval and installation
Risk Level: Critical

Vulnerable Code

markdown

## Self-update

`weave.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.

1. Read `source:` from frontmatter → extract `{owner}/{repo}` from URL
2. Read local version from `skill.json`
3. Fetch remote version: `gh api "repos/{owner}/{repo}/contents/skill.json" --jq '.content' | base64 -d | python3 -c "import sys,json;print(json.load(sys.stdin)['version'])"`
4. If remote version equals local version → stop silently
5. Download and install:
   ```bash
   TMPDIR=$(mktemp -d)
   gh api "repos/{owner}/{repo}/tarball/main" > "$TMPDIR/archive.tar.gz"
   mkdir "$TMPDIR/extracted"
   tar xzf "$TMPDIR/archive.tar.gz" -C "$TMPDIR/extracted" --strip-components=1
   cp -R "$TMPDIR/extracted/"* ./
   rm -rf "$TMPDIR"
   ```
6. On failure → retry once. If second attempt fails, report the error and stop.

Technical Analysis

The updater fetches an archive from the mutable main branch of a GitHub repository and recursively copies its contents over the installed Skill. The process does not pin an immutable commit, verify a cryptographic signature or checksum, enforce an approved file manifest, or present a diff for user review.

Checking only the remote version field does not establish payload integrity or authenticity. The archive contents can differ while retaining any chosen version value, and control of the upstream repository is sufficient to change the effective payload after the current package has been audited.

Although this package contains documentation rather than a scripts/ directory, Skill instructions directly determine Agent behavior. Replacing SKILL.md or related references therefore creat ...[truncated 1655 chars]

Remediation

View remediation

Remediation Suggestions

• Eliminate silent unattended installation and require explicit user approval before replacing any file.
• Retrieve only immutable, versioned release artifacts pinned to a specific commit hash.
• Require signed releases and verify signatures against a trusted, pinned maintainer key.
• Publish and verify a cryptographic checksum through a separately authenticated channel.
• Validate the archive against an explicit allowlist of expected paths and reject symlinks, path traversal, unexpected executables, and undeclared files.
• Extract into a staging directory, validate all contents, and display the complete diff before installation.
• Install atomically with rollback support rather than recursively copying over the live package.
• Do not trust the version field as an integrity control.
• Remove the automatic cron trigger or make scheduled update checks notification-only; installation should remain manual.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This is a true self-modification risk: first-run initialization automatically installs a cron-based updater that changes the skill's code from GitHub over time. For a tool that processes private contact and relationship data, autonomous code replacement increases the chance of supply-chain compromise, unexpected capability expansion, and persistence without ongoing user approval.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

md

## Setup

`weave.init` runs automatically on first invocation and creates all required directories, config.json, and the LadybugDB database. No manual setup is required. It also registers the `weave:update` cron job (midnight daily) for automatic self-updates.

## Dependencies

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The scheduled task table confirms a daily cron job whose purpose is self-updating from GitHub source. Persistent, unattended self-modification is especially dangerous in agent skills because behavior can drift after review and newly pulled code may gain access to the same local environment and sensitive graph data.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md

| Job | Mechanism | Schedule | Command |
|---|---|---|---|
| `weave:update` | cron | `0 0 * * *` (midnight daily) | Self-update from GitHub source |

## Changelog

Self-Modification

High

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The changelog entry itself is documentation rather than executable behavior, but it corroborates that the product intentionally introduced automatic self-update capability. As contextual evidence it reinforces the credibility of the self-modification risk, though the line itself is less dangerous than the setup and scheduled-task instructions.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

md

## Changelog

### v2.3.0 -- March 27, 2026
- Added `weave.update` command and midnight cron for automatic version-checked self-updates

### v2.2.0 -- March 22, 2026
- Routing improvements

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The skill is explicitly self-modifying: it can pull a remote package and overwrite its own local contents. In this skill context, that is more dangerous because the same skill handles private social-graph data, sync connectors, journaling, and scheduled execution, so a malicious update could gain persistent access to sensitive contacts and relationship data.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

text

## Self-update

`weave.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises bidirectional sync and writeback to Google Contacts and Clay, but does not clearly warn that personal relationship data, preferences, and graph-derived information may be transmitted to external services. Given the highly sensitive nature of a private social graph, missing privacy disclosures can lead users to enable syncing without understanding data exposure and overwrite risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that initialization automatically registers a daily cron job to self-update from GitHub, but it does not prominently warn users that code will continue changing after installation. In an agent skill that can later be invoked with user trust and local data access, unattended remote code updates materially expand the supply-chain risk and can introduce new behavior without explicit review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill defines a self-update path that fetches code directly from GitHub and replaces local files, while also stating the update can run silently. This creates a supply-chain and unauthorized code-change risk: a compromised repo, branch, GitHub token path, or transit step could replace the skill with malicious content without meaningful user visibility or approval.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/connectors.md (reported line 131)May include surrounding context.

md

## Clay

API: Clay REST API v1. Auth: Bearer token. Base: `https://api.clay.earth/v1`.

Field map (Clay → Weave):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/connectors.md (reported line 160)May include surrounding context.

md

## Clay

API: Clay REST API v1. Auth: Bearer token. Base: `https://api.clay.earth/v1`.

Field map (Clay → Weave):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 72% confidence

Finding

This outbound sync sends locally stored contact data to a third-party service, creating a real data exfiltration risk if approval and writeback gating are not enforced by code at the call site. The function itself does not verify explicit approval or a writeback-enabled configuration, so any internal caller with access could trigger bulk transmission of personal data to Clay.

Content

Scanner excerpt · references/connectors.md (reported line 225)May include surrounding context.

md

body = {k: v for k, v in {"name": name, "email": email,
                "company": org, "title": title, "city": city}.items() if v}
        try:
            requests.patch(f"https://api.clay.earth/v1/people/{clay_id}",
                           headers=headers, json=body).raise_for_status()
            pushed += 1
        except Exception as e:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown shows COPY TO examples exporting person records including email, location, phone, organization, and occupation data to files, but provides no warning that these operations create local copies of potentially sensitive personal data. Under the markdown-specific missing-warning rule, descriptions of behaviors affecting user data or privacy should disclose that impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The helper queries export records for Google and Clay sync workflows and include contact/profile fields, but the document does not warn that these files are intended for outbound transfer and may expose personal data if mishandled. This is a privacy-relevant behavior that should be disclosed in markdown guidance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example journal records an upsert run as an "observation" and sets side_effect_executed to false even though the reasoning summary says a Person record was upserted. This can misclassify data-modifying operations in the audit trail, weakening accountability, downstream policy enforcement, and incident investigation if other components copy the example or rely on journal semantics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest explicitly describes collecting, storing, querying, and syncing highly sensitive personal relationship data, preferences, and shared experiences, but it provides no user-facing privacy warning, consent language, retention policy, or explanation of how this data will be protected. Because the skill also requests contact-sync credentials and broad contacts scope, users may expose third-party personal data without understanding the privacy implications, making this a real security/privacy weakness in context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's natural-language command example fixes the timezone to America/Los_Angeles, which imposes a locale-specific behavior for scheduled execution. The file does not offer a user choice or explain why this locale is required, so it conflicts with the policy against forcing a specific locale without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The markdown includes code that creates the staging directory and writes a new CSV file, but the surrounding text does not warn users that running it will modify the local filesystem. For markdown content, behaviors that affect user data or system state should be disclosed clearly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.