Weave

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:46 AM UTC
• Version: 2.3.0

Overview

The skill’s social-graph functions are mostly coherent, but it automatically installs a silent daily self-updater that can replace the skill from GitHub, so it should be reviewed before installation.

Review this skill before installing. Its contact graph, local storage, and optional Google/Clay sync fit the stated purpose, but the daily automatic self-update should be removed or made explicit opt-in with signed, pinned releases and visible approval before replacing files. Keep writeback disabled unless you intentionally approve a specific sync, and remember that exports and connector staging files may contain sensitive personal data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:206
• Finding: Automatic Daily Self-Update Establishes Cross-Session Persistence## Vulnerability Details **File Location**: `SKILL.md`, lines 206–221 **Vulnerability Type**: Persistent scheduled task installation **Risk Level**: High ### Vulnerable Code ```markdown ## Initialization On first invocation of any Weave command, `_open_db()` handles auto-initialization: 1. Create `~/openclaw/db/ocas-weave/` and subdirectories (`staging/`) 2. Write default `config.json` with ConfigBase fields if absent 3. Create `~/openclaw/journals/ocas-weave/` 4. Open database (auto-creates `weave.lbug` and runs DDL if tables absent) 5. Register cron job `weave:update` if not already present (check `openclaw cron list` first) 6. Log initialization as a DecisionRecord ## Background tasks | Job name | Mechanism | Schedule | Command | |---|---|---|---| | `weave:update` | cron | `0 0 * * *` (midnight daily) | `weave.update` | openclaw cron add --name weave:update --schedule "0 0 * * *" --command "weave.update" --sessionTarget isolated --lightContext true --timezone America/Los_Angeles ``` ### Technical Analysis The Skill directs the Agent to install a daily cron job automatically during the first invocation of any command. This scheduled task survives the initiating run and repeatedly invokes the self-update feature without requiring approval for each execution. Scheduled execution is not required for the Skill's core social-graph operations. Coupled with the mutable remote update mechanism, the cron job creates a persistent delivery channel through which later upstream changes can alter installed Skill instructions after the initially reviewed version has been approved. ### Attack Path 1. A user invokes any Weave command. 2. The initialization procedure checks the cron configuration. 3. The Agent registers `weave:update` as a daily task. 4. The scheduled task survives the original session and runs in an isolated future session. 5. Each execution contacts the configured GitHub source and may instal ...[truncated 991 chars]
• Remediation: ## Remediation Suggestions - Remove automatic cron registration from first-use initialization. - Require an explicit, informed user action before enabling scheduled updates. - Keep updates manual by default and require confirmation for every installation. - Clearly display the update source, target version, changed files, and integrity information before approval. - If scheduling is retained, provide an obvious disable command and register no task unless the user affirmatively opts in. - Combine these controls with immutable, cryptographically verified releases as described in the remote-update finding.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:225
• Finding: Unverified Mutable GitHub Payload Is Downloaded and Installed Silently## Vulnerability Details **File Location**: `SKILL.md`, lines 225–242 **Vulnerability Type**: Unverified remote payload retrieval and installation **Risk Level**: Critical ### Vulnerable Code ```markdown ## Self-update `weave.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred. 1. Read `source:` from frontmatter → extract `{owner}/{repo}` from URL 2. Read local version from `skill.json` 3. Fetch remote version: `gh api "repos/{owner}/{repo}/contents/skill.json" --jq '.content' | base64 -d | python3 -c "import sys,json;print(json.load(sys.stdin)['version'])"` 4. If remote version equals local version → stop silently 5. Download and install: ```bash TMPDIR=$(mktemp -d) gh api "repos/{owner}/{repo}/tarball/main" > "$TMPDIR/archive.tar.gz" mkdir "$TMPDIR/extracted" tar xzf "$TMPDIR/archive.tar.gz" -C "$TMPDIR/extracted" --strip-components=1 cp -R "$TMPDIR/extracted/"* ./ rm -rf "$TMPDIR" ``` 6. On failure → retry once. If second attempt fails, report the error and stop. ``` ### Technical Analysis The updater fetches an archive from the mutable `main` branch of a GitHub repository and recursively copies its contents over the installed Skill. The process does not pin an immutable commit, verify a cryptographic signature or checksum, enforce an approved file manifest, or present a diff for user review. Checking only the remote version field does not establish payload integrity or authenticity. The archive contents can differ while retaining any chosen version value, and control of the upstream repository is sufficient to change the effective payload after the current package has been audited. Although this package contains documentation rather than a `scripts/` directory, Skill instructions directly determine Agent behavior. Replacing `SKILL.md` or related references therefore creat ...[truncated 1655 chars]
• Remediation: ## Remediation Suggestions - Eliminate silent unattended installation and require explicit user approval before replacing any file. - Retrieve only immutable, versioned release artifacts pinned to a specific commit hash. - Require signed releases and verify signatures against a trusted, pinned maintainer key. - Publish and verify a cryptographic checksum through a separately authenticated channel. - Validate the archive against an explicit allowlist of expected paths and reject symlinks, path traversal, unexpected executables, and undeclared files. - Extract into a staging directory, validate all contents, and display the complete diff before installation. - Install atomically with rollback support rather than recursively copying over the live package. - Do not trust the `version` field as an integrity control. - Remove the automatic cron trigger or make scheduled update checks notification-only; installation should remain manual.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Self-Modification

High

• Category: Rogue Agent

Content

## Setup

`weave.init` runs automatically on first invocation and creates all required directories, config.json, and the LadybugDB database. No manual setup is required. It also registers the `weave:update` cron job (midnight daily) for automatic self-updates.

## Dependencies

• Confidence: 97% confidence
• Finding: This is a true self-modification risk: first-run initialization automatically installs a cron-based updater that changes the skill's code from GitHub over time. For a tool that processes private contact and relationship data, autonomous code replacement increases the chance of supply-chain compromise, unexpected capability expansion, and persistence without ongoing user approval.

Self-Modification

High

• Category: Rogue Agent

Content

| Job | Mechanism | Schedule | Command |
|---|---|---|---|
| `weave:update` | cron | `0 0 * * *` (midnight daily) | Self-update from GitHub source |

## Changelog

• Confidence: 96% confidence
• Finding: The scheduled task table confirms a daily cron job whose purpose is self-updating from GitHub source. Persistent, unattended self-modification is especially dangerous in agent skills because behavior can drift after review and newly pulled code may gain access to the same local environment and sensitive graph data.

Self-Modification

High

• Category: Rogue Agent

Content

## Changelog

### v2.3.0 -- March 27, 2026
- Added `weave.update` command and midnight cron for automatic version-checked self-updates

### v2.2.0 -- March 22, 2026
- Routing improvements

• Confidence: 92% confidence
• Finding: The changelog entry itself is documentation rather than executable behavior, but it corroborates that the product intentionally introduced automatic self-update capability. As contextual evidence it reinforces the credibility of the self-modification risk, though the line itself is less dangerous than the setup and scheduled-task instructions.

Self-Modification

High

• Category: Rogue Agent

Content

```


## Self-update

`weave.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.

• Confidence: 98% confidence
• Finding: The skill is explicitly self-modifying: it can pull a remote package and overwrite its own local contents. In this skill context, that is more dangerous because the same skill handles private social-graph data, sync connectors, journaling, and scheduled execution, so a malicious update could gain persistent access to sensitive contacts and relationship data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises bidirectional sync and writeback to Google Contacts and Clay, but does not clearly warn that personal relationship data, preferences, and graph-derived information may be transmitted to external services. Given the highly sensitive nature of a private social graph, missing privacy disclosures can lead users to enable syncing without understanding data exposure and overwrite risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README states that initialization automatically registers a daily cron job to self-update from GitHub, but it does not prominently warn users that code will continue changing after installation. In an agent skill that can later be invoked with user trust and local data access, unattended remote code updates materially expand the supply-chain risk and can introduce new behavior without explicit review.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill defines a self-update path that fetches code directly from GitHub and replaces local files, while also stating the update can run silently. This creates a supply-chain and unauthorized code-change risk: a compromised repo, branch, GitHub token path, or transit step could replace the skill with malicious content without meaningful user visibility or approval.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Clay

API: Clay REST API v1. Auth: Bearer token. Base: `https://api.clay.earth/v1`.

Field map (Clay → Weave):

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Clay

API: Clay REST API v1. Auth: Bearer token. Base: `https://api.clay.earth/v1`.

Field map (Clay → Weave):

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

body = {k: v for k, v in {"name": name, "email": email,
                "company": org, "title": title, "city": city}.items() if v}
        try:
            requests.patch(f"https://api.clay.earth/v1/people/{clay_id}",
                           headers=headers, json=body).raise_for_status()
            pushed += 1
        except Exception as e:

• Confidence: 72% confidence
• Finding: This outbound sync sends locally stored contact data to a third-party service, creating a real data exfiltration risk if approval and writeback gating are not enforced by code at the call site. The function itself does not verify explicit approval or a writeback-enabled configuration, so any internal caller with access could trigger bulk transmission of personal data to Clay.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown shows `COPY TO` examples exporting person records including email, location, phone, organization, and occupation data to files, but provides no warning that these operations create local copies of potentially sensitive personal data. Under the markdown-specific missing-warning rule, descriptions of behaviors affecting user data or privacy should disclose that impact.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The helper queries export records for Google and Clay sync workflows and include contact/profile fields, but the document does not warn that these files are intended for outbound transfer and may expose personal data if mishandled. This is a privacy-relevant behavior that should be disclosed in markdown guidance.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The example journal records an upsert run as an "observation" and sets `side_effect_executed` to false even though the reasoning summary says a Person record was upserted. This can misclassify data-modifying operations in the audit trail, weakening accountability, downstream policy enforcement, and incident investigation if other components copy the example or rely on journal semantics.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The manifest explicitly describes collecting, storing, querying, and syncing highly sensitive personal relationship data, preferences, and shared experiences, but it provides no user-facing privacy warning, consent language, retention policy, or explanation of how this data will be protected. Because the skill also requests contact-sync credentials and broad contacts scope, users may expose third-party personal data without understanding the privacy implications, making this a real security/privacy weakness in context.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The skill's natural-language command example fixes the timezone to `America/Los_Angeles`, which imposes a locale-specific behavior for scheduled execution. The file does not offer a user choice or explain why this locale is required, so it conflicts with the policy against forcing a specific locale without opt-in.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The markdown includes code that creates the staging directory and writes a new CSV file, but the surrounding text does not warn users that running it will modify the local filesystem. For markdown content, behaviors that affect user data or system state should be disclosed clearly.

Static analysis

No suspicious patterns detected.