OpenCortex

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:27 PM UTC
• Version: 3.6.7

Overview

OpenCortex is a disclosed memory automation skill, but it needs Review because recurring agents can rewrite long-term memory and some cron and secret-entry paths are under-scoped.

Install only in a workspace where you are comfortable with scheduled agents editing long-term memory. Review the cron messages after setup, keep optional git backup and metrics disabled until workspace-path cron escaping is fixed, and avoid entering real secrets as command-line arguments. Prefer system keyring storage for the vault and remove or edit the recurring jobs if you do not want autonomous memory rewriting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: references/distillation.md:9

Finding

Persistent Agent Memory Poisoning Through Untrusted Conversation-Derived Logs

Content

View full analysis

. Reference in docs as: vault: - Infrastructure changes → INFRA.md (ONLY if OPENCORTEX_INFRA_COLLECT=1 is set OR `.opencortex-flags` contains `INFRA_COLLECT=1` — otherwise skip infrastructure routing entirely) - Contacts mentioned → memory/contacts/ (one file per person/org. Include: name, role/relationship, context, communication preferences, key interactions. Create new file if first mention, update existing if already known.) - Workflows described → memory/workflows/ (one file per workflow/pipeline. Include: what it does, services involved, how to operate it, known issues. Create new file if first description.) - Preferences stated → memory/preferences.md (append under the matching category: Communication, Code & Technical, Workflow & Process, Scheduling & Time, Tools & Services, Content & Media, Environment & Setup. Format: **Preference:** [what] — [context/reasoning] (date). Do NOT duplicate existing preferences — update them if the user changes their mind.) - Decisions → relevant project file or MEMORY.md. Format: **Decision:** [what] — [why] (date) - Principles, ...[truncated 4048 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install.sh:859

Finding

Persistent Cron Command Injection Through Unescaped Workspace Path

Content

View full analysis

/dev/null | grep -q "git-backup"; then if [ "$DRY_RUN" = "true" ]; then echo " [DRY RUN] Would add crontab entry: 0 */6 * * * $WORKSPACE/scripts/git-backup.sh" else (crontab -l 2>/dev/null; echo "0 */6 * * * $WORKSPACE/scripts/git-backup.sh") | crontab - ``` Metrics registration: ```bash if ! crontab -l 2>/dev/null | grep -q "metrics.sh"; then if [ "$DRY_RUN" = "true" ]; then echo " [DRY RUN] Would add crontab entry: 30 23 * * * $WORKSPACE/scripts/metrics.sh --collect" else (crontab -l 2>/dev/null; echo "30 23 * * * $WORKSPACE/scripts/metrics.sh --collect") | crontab - ``` The update path repeats the unsafe construction: ```bash if ! crontab -l 2>/dev/null | grep -q "metrics.sh"; then echo "" if ask_yn "📊 New feature: daily metrics tracking (knowledge growth over time). Enable? (y/N): " n; then if [ -f "$SKILL_DIR/metrics.sh" ]; then if [ "$DRY_RUN" != "true" ]; then cp "$SKILL_DIR/metrics.sh" "$WORKSPACE/scripts/metrics.sh" chmod +x "$WORKSPACE/scripts/metrics.sh" (crontab -l 2>/dev/null; echo "30 23 * * * $WORKSPACE/scripts/metrics.sh --collect") | crontab - ``` The value originates from an environment variable or the current directory: ```bash WORKSPACE="${CLAWD_WORKSPACE:-$(pwd)}" ``` ### Technical Analysis `WORKSPACE` is inserted verbatim into a crontab command. It is not validated for control characters and its path is not safely quoted for interpretation by cron's shell. A workspace path containing spaces will cause incorrect command parsing. More importantly, a value containing shell metacharacters can append or alter shell commands. A newline can inject an entirely s ...[truncated 1656 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vault.sh:171

Finding

Vault Secrets Exposed Through Command-Line Arguments

Content

View full analysis

" exit 1 fi # Validate key name if ! echo "$KEY" | grep -qE '^[a-zA-Z_][a-zA-Z0-9_]*$'; then echo "❌ Invalid key name: '$KEY'" echo " Key must start with a letter or underscore, and contain only" echo " letters, digits, and underscores." exit 1 fi CONTENT=$(_decrypt | grep -v "^${KEY}=" || true) CONTENT="${CONTENT} ${KEY}=${VALUE}" _encrypt "$CONTENT" echo "✅ Stored: $KEY" ;; ``` The documented interface reinforces use of the vulnerable argument form: ```text vault.sh set ``` ### Technical Analysis The GPG passphrase is correctly passed through file descriptor 3, but the secret being stored is read from `$3`. Consequently, the plaintext secret is part of the process argument vector before encryption. Depending on the operating system and environment, command arguments may be observable through: - Process inspection tools. - `/proc` process metadata. - Shell history. - Terminal session recording. - Audit or endpoint-monitoring systems. - Agent command transcripts and debugging logs. Encryption at rest does not protect a secret that was already disclosed through the invocation mechanism. ### Attack Path 1. A user or agent executes: ```bash scripts/vault.sh set api_key sensitive-secret-value ``` 2. The secret appears in the command's argument vector. 3. The invoking shell may save the complete command in history. 4. A local process monitor, audit service, terminal logger, or another process operating under suitable local permissions captures the argument. 5. The attacker obtains the plaintext secret despite the encrypted v ...[truncated 434 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (113)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill also covers encrypted secret storage, passphrase generation, keyring integration, and rotation workflows, which are sensitive security functions distinct from memory management. Bundling secret-management behavior into a memory skill expands trust requirements and raises the impact of misuse, misconfiguration, or hidden data access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill also covers encrypted secret storage, passphrase generation, keyring integration, and rotation workflows, which are sensitive security functions distinct from memory management. Bundling secret-management behavior into a memory skill expands trust requirements and raises the impact of misuse, misconfiguration, or hidden data access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill also covers encrypted secret storage, passphrase generation, keyring integration, and rotation workflows, which are sensitive security functions distinct from memory management. Bundling secret-management behavior into a memory skill expands trust requirements and raises the impact of misuse, misconfiguration, or hidden data access.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The skill includes an optional git push capability and related backup automation, which can transmit repository contents off-host if enabled. Even though it is off by default, combining broad activation, shell execution, secret scrubbing logic, and push behavior creates a path for accidental or unsafe exfiltration if parameters are misused or a user misunderstands the scope.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

agent with best practices. NOT for: runtime memory_search queries (use built-in memory
  tools). Triggers: "set up memory", "organize yourself", "stop forgetting", "memory
  architecture", "self-improving", "cortex", "bootstrap memory", "memory optimization".
metadata: {"openclaw":{"requires":{"bins":["grep","sed","find"],"optionalBins":["git","gpg","openssl","openclaw","secret-tool","keyctl","file"]},"env":{"CLAWD_WORKSPACE":{"description":"Workspace directory (defaults to cwd)","required":false},"CLAWD_TZ":{"description":"Timezone for cron scheduling (defaults to UTC)","required":false},"OPENCORTEX_VAULT_PASS":{"description":"Vault passphrase via env var. Prefer system keyring.","required":false,"sensitive":true},"OPENCORTEX_VOICE_PROFILE":{"description":"Set to 1 to enable voice profiling in nightly distillation (env override; persistent default lives in .opencortex-flags).","required":false,"sensitive":false},"OPENCORTEX_INFRA_COLLECT":{"description":"Set to 1 to enable infrastructure auto-collection in nightly distillation (env override; persistent default lives in .opencortex-flags).","required":false,"sensitive":false},"OPENCORTEX_SCRUB_ALL":{"description":"Set to 1 to scrub all tracked files (not just known text types) during git backup. Off by default.","required":false,"sensitive":false},"OPENCORTEX_ALLOW_FILE_PASSPHRASE":{"description":"Set to 1 to allow vault passphrase stored in a file (.vault/.passphrase). Off by default; prefer system keyring.","required":false,"sensitive":false}},"sensitiveFiles":[".secrets-map",".vault/.passphrase"],"networkAccess":"Optional git push only (off by default, requires --push flag)"}}
---

# OpenCortex — Self-Improving Memory Architecture

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/distillation.md (reported line 86)May include surrounding context.

md

l Audit (P8 Enforcement)

- Scan today's daily logs for instances where the agent deferred to the user. Cross-reference with TOOLS.md, INFRA.md, and memory/. Flag unnecessary deferrals.

## Failure Root Cause (P7 Enforcement)

- Scan today's daily logs for ❌ FAILURE: or 🔧 CORRECTION: entries. Verify root cause analysis exists. If missing, add it.

## Cron Health

- Run openclaw cron list and crontab -l. Verify no two jobs within 15 minutes. Fix MEMORY.md jobs table if out of sync.

---

Before completing, append debrief to memory/YYYY-MM-DD.md.
Reply with brief summary.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

#!/bin/bash
# OpenCortex — Self-Improving Memory Architecture Installer
# Safe to re-run: won't overwrite existing files.
set -euo pipefail

OPENCORTEX_VERSION="3.6.7"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/install.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# OpenCortex — Self-Improving Memory Architecture Installer
# Safe to re-run: won't overwrite existing files.
set -euo pipefail

OPENCORTEX_VERSION="3.6.7"

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script advertises itself as non-destructive and says it never overwrites customized files, but later unconditionally replaces existing helper scripts and reference documents when their checksums differ. This is a trust-boundary violation: operators may run it assuming local customizations are preserved, leading to silent loss of user changes and unexpected behavior in an automation script.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/update.sh (reported line 1134)May include surrounding context.

sh

# .gitignore — ensure sensitive entries
if [ -f "$WORKSPACE/.gitignore" ]; then
  GITIGNORE_ADDS=()
  for entry in ".vault/" ".secrets-map" ".env" "*.key" "*.pem"; do
    if ! grep -qF "$entry" "$WORKSPACE/.gitignore" 2>/dev/null; then
      GITIGNORE_ADDS+=("$entry")
    fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 170)May include surrounding context.

md

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 5)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 27)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 46)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 51)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 62)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 70)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 72)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 73)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 81)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 116)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 148)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 165)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 166)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 267)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vault.sh (reported line 271)May include surrounding context.

sh

# OpenCortex Vault — Encrypted key-value store for sensitive data
# Uses GPG symmetric encryption (AES-256).
# Passphrase storage (in order of preference):
#   1. System keyring (secret-tool / macOS Keychain / keyctl)
#   2. Environment variable OPENCORTEX_VAULT_PASS
#   3. File at .vault/.passphrase (mode 600) — fallback
#

Static analysis

No suspicious patterns detected.