Delphi Self Awareness

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:11 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a self-diagnostic guide, but it mandates a recurring cron job, persistent logging, broad memory/workspace checks, and questionable secret-storage guidance without clear user opt-in.

Review before installing. Use this only if you are comfortable with an agent creating a weekly scheduled self-check, reading workspace and memory state, listing active crons, and writing a persistent drift log. Prefer requiring explicit approval before enabling the cron or logging, and do not store API keys in memory/keys.env unless your platform separately protects and excludes that file from indexing, logs, and model context.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:75

Finding

Mandatory Installation of a Persistent Weekly Agent Cron Job

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:68

Finding

Broad Workspace, Memory, Skill, and Cron Reconnaissance

Content

View full analysis

/ exec: ls /memory/ (if exists) exec: ls /skills/ (if exists) ``` Then read `references/storage-conventions.md` to understand how to reason about paths generically. ``` From `SKILL.md`, lines 105–122: ```markdown ### B. Memory Freshness - Check when `MEMORY.md` was last meaningfully updated (look for recent dates in content) - Check if today's daily file exists: `memory/YYYY-MM-DD.md` - Flag if MEMORY.md hasn't been updated in >7 days ### C. Storage Sanity - Verify workspace path is known and accessible - Check that key paths referenced in MEMORY.md actually exist - Flag any broken references ### D. Drift Check - Run through the drift catalog mentally: am I currently doing any of these wrong? - Read `references/drift-catalog.md` for the full list ### E. Active Crons - Note how many cron jobs are active (use `cron` tool: `action=list`) - Flag any that haven't fired recently or seem misconfigured ``` From `references/storage-conventions.md`, lines 130–140: ```markdown ## First-Load Storage Discovery On first load in a new deployment, do this to understand what you're working with: ``` 1. Run session_status → note the workspace path 2. exec: ls / 3. exec: ls /memory/ (if it exists) 4. Read MEMORY.md to understand what's been established 5. Check if drift-log.md exists — create it if not ``` ``` ### Technical Analysis The skill systematically inventories the workspace, memory directory, installed skills, long-term memory, referenced filesystem paths, and active scheduled jobs. Some metadata inspection is relevant to a s ...[truncated 1967 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/storage-conventions.md:85

Finding

Plaintext Agent Memory Directory Recommended for Secret Storage

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as an informational, always-on self-awareness framework, but it also instructs the agent to perform persistent side effects during first load, including creating scheduled tasks and initializing persistent files. That mismatch is dangerous because operators may load it expecting passive guidance while it silently changes system state and establishes ongoing behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs creation of a recurring cron job even though its declared purpose is meta-awareness and self-diagnosis. Scheduled execution creates autonomous persistence and repeated execution without a fresh user request, which can be abused or can cause unexpected background activity in environments where skills are expected to be reactive only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to create a recurring cron job without any user-facing warning or consent language. This is dangerous because it grants the skill persistence and autonomous execution, which can surprise users, consume resources, or be repurposed to run future actions outside the immediate interaction loop.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs persistent writes to memory files without clearly informing the user that data will be stored automatically. Undisclosed persistence can capture operational details or user-related content beyond the current session, creating privacy, retention, and trust issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Mandating that every self-check be logged to a persistent drift log, without a privacy or retention warning, creates ongoing storage of behavioral metadata by default. In an always-on skill, this raises the risk because repeated autonomous logging can accumulate sensitive operational history over time.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/drift-catalog.md (reported line 60)May include surrounding context.

md

**Correction:** Run `session_status` during long sessions. The context % is not visible unless you check it. At 70%+, warn the user.

### 2.4 MEMORY.md Staleness
**What it looks like:** Trusting MEMORY.md entries without checking how current they are.
**Detection:** Acting on MEMORY.md content that references dates many weeks old as if it's current.
**Correction:** MEMORY.md is manually curated. Check the dates of entries. Stale entries can be misleading. Flag if >7 days since last meaningful update.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/drift-catalog.md (reported line 107)May include surrounding context.

md

**Correction:** Run `session_status` during long sessions. The context % is not visible unless you check it. At 70%+, warn the user.

### 2.4 MEMORY.md Staleness
**What it looks like:** Trusting MEMORY.md entries without checking how current they are.
**Detection:** Acting on MEMORY.md content that references dates many weeks old as if it's current.
**Correction:** MEMORY.md is manually curated. Check the dates of entries. Stale entries can be misleading. Flag if >7 days since last meaningful update.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/drift-catalog.md (reported line 106)May include surrounding context.

md

**Detection:** You hedge on something that a tool call could answer definitively.
**Correction:** Run the tool call. Replace guesses with facts. "I think the context is around 50%" → `session_status`.

### 4.3 Output Without Verification
**What it looks like:** Writing a file, running a command, then declaring it done without checking.
**Detection:** You say "done" after a write/exec without reading back the result.
**Correction:** Always verify. `read` after `write`. Check exec output carefully. Silent exit 0 ≠ success.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/failure-protocol.md (reported line 90)May include surrounding context.

md

2. Tell the user: what you tried, what failed each time, what you think the root cause is
3. Ask for guidance or suggest what information would help you proceed

Never retry indefinitely. Never silently fail and pretend it worked.

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/storage-conventions.md (reported line 13)May include surrounding context.

text

ZONE 1: Workspace (agent's home)
  └── Where you read and write files by default
  └── Auto-injected bootstrap files live here
  └── Path: configured in `agents.defaults.workspace` (default: ~/.openclaw/workspace)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document explicitly suggests storing secrets in memory/keys.env or similar workspace-managed locations. In a self-awareness/reference skill, this normalizes secret placement inside agent-accessible memory/storage paths, increasing the chance that credentials are read, summarized, copied into logs, or exposed through later tool use. Because the skill is about storage conventions, readers may treat this as endorsed best practice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest frames the skill as embedding accurate knowledge of agent/platform behavior, but the code specifically instructs consulting an external website for config questions. That introduces a network information-retrieval capability that is not stated in the manifest and is not essential if the skill is meant to be a local architectural grounding layer.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill claims to be an awareness framework, yet it instructs creation and ongoing use of a persistent drift log in memory files. This is a real concern because it converts passive guidance into durable data storage, potentially retaining behavioral or session-derived information without clear expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The skill is described as a framework for answering meta questions and preventing incorrect beliefs about runtime behavior. While path verification is relevant, explicitly directing shell command execution (exec: ls) introduces operational command capability beyond passive architectural self-knowledge, especially in a reference file meant to be always-on enrichment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file instructs the agent to "create it if not" for drift-log.md and later to delete temporary files, but it does not warn users that following these conventions may modify or remove files in the workspace. Under the markdown-file criteria for missing warnings, file-creation and deletion behaviors that affect user data or system state should be disclosed.

Content

No source excerpt is available for this finding.