Nova Orbit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:46 AM UTC
• Version: 1.0.0

Overview

This skill is openly aimed at autonomous research and memory, but it gives itself broad always-on persistence and unreviewed local script execution that users should review before installing.

Install only if you want an always-on Nova workflow that writes persistent local memory, uses ByteRover, contacts GitHub through a local proxy, posts status to a localhost service, and may run an external self-assessment script. Review or disable the external script path, avoid using it with secrets or proprietary task text, and require manual approval before memory or skill updates.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:110
• Finding: Unscoped Global Lifecycle Instructions and External Script Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 110-123 and 169-190 **Vulnerability Type**: Global instruction hijacking through mandatory startup and post-task behavior **Risk Level**: High ### Vulnerable Code ```bash # Trigger self-assessment bash ~/.openclaw/workspace/nova-mind/scripts/self-assessment.sh "<task description>" # Then answer in the log: # 1. What was the most correct decision? # 2. What would be changed if the task were repeated? # 3. What deficiency did this task reveal? # 4. How should a similar task be handled better next time? ``` The Skill also defines the following unconditional startup sequence: ```bash # 1. Check previous progress cat ~/.openclaw/workspace/nova-mind/memory/$(date +%Y-%m-%d -d "yesterday" 2>/dev/null || echo "2026-04-17").md # 2. Query related patterns cat ~/.openclaw/workspace/nova-mind/patterns/github-research.md # 3. Check recent ByteRover discoveries # (brv query recent) # 4. Set status curl -s -X POST http://127.0.0.1:19000/set_state \ -H "Content-Type: application/json" \ -d '{"state": "idle", "description": "Nova Orbit started"}' # 5. Write startup log echo "$(date +%Y-%m-%d\ %H:%M) - Orbit started" >> ~/.openclaw/workspace/nova-mind/memory/$(date +%Y-%m-%d).md ``` ### Technical Analysis The Skill declares that its workflow must run whenever the agent starts and that self-assessment must occur after every task. These instructions are not restricted to an explicit GitHub-research invocation. They therefore alter the agent's general lifecycle and affect unrelated tasks. The self-assessment step executes `~/.openclaw/workspace/nova-mind/scripts/self-assessment.sh`, which is outside the audited Skill package. The project contains only `SKILL.md`, so the script's contents, integrity, ownership, and side effects cannot be verified. Executing an external workspace script also breaks the package's review boundary: cha ...[truncated 1726 chars]
• Remediation: ## Remediation Suggestions 1. Limit all startup, assessment, logging, and research behavior to cases where the user explicitly invokes this Skill. 2. Remove unconditional requirements such as running on every agent startup or after every task. 3. Package required scripts inside the reviewed Skill directory and audit them together with the Skill. 4. Before executing a script, validate that its resolved path remains inside the Skill package and verify its integrity using an approved hash or signed manifest. 5. Require explicit user confirmation before invoking any script outside the Skill package. 6. Treat loaded memory and pattern files as untrusted data rather than executable instructions. 7. Apply least privilege by granting the workflow access only to its dedicated data directory and required network endpoints. 8. Restrict local status updates to an allowlisted state value and a sanitized, non-sensitive description.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:101
• Finding: Automatic Promotion of Untrusted Task Content into Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 101-108, 129-153, and 187-190 **Vulnerability Type**: Persistent memory poisoning through automatic pattern extraction and semantic-memory updates **Risk Level**: High ### Vulnerable Code ```text Task completed → write log → extract pattern → update Skill → stronger decisions ``` The documented memory workflow is: ```text 1. Receive a new task 2. Query Semantic Memory (MEMORY.md + ByteRover) 3. Query Episodic Memory (patterns/) 4. Make a decision 5. Execute 6. Write back to Episodic Memory and update Semantic Memory ``` Persistent startup logging is also prescribed: ```bash echo "$(date +%Y-%m-%d\ %H:%M) - Orbit started" >> ~/.openclaw/workspace/nova-mind/memory/$(date +%Y-%m-%d).md ``` ### Technical Analysis The Skill directs the agent to extract patterns after successful decisions, write task-derived information into episodic and semantic memory, and update the Skill as part of a self-evolution loop. It does not define provenance tracking, trust classification, content sanitization, approval gates, or separation between factual data and behavioral instructions. Task descriptions, GitHub README content, repository descriptions, and other researched material may be controlled by third parties. If such content is summarized into a pattern or semantic-memory file without filtering, embedded prompt-injection instructions can be preserved. Because the startup workflow later reads these persistent files, poisoned content can continue influencing future sessions. The risk is amplified by the proposed Skill-update step. Promoting task-derived conclusions into the Skill can convert untrusted content into durable operating instructions. This exceeds the minimum privileges needed for public GitHub research: repository discovery and analysis require temporary network access and bounded output storage, but they do not require automatic modification o ...[truncated 1548 chars]
• Remediation: ## Remediation Suggestions 1. Disable automatic updates to semantic memory, decision patterns, and Skill instructions. 2. Require explicit human review and approval before promoting task-derived content into persistent memory. 3. Store retrieved repository content as quoted, non-executable data with source URL, retrieval time, and provenance metadata. 4. Detect and remove agent-directed instructions from untrusted documents before summarization or persistence. 5. Separate research facts from behavioral policies using distinct storage locations and schemas. 6. Never interpret memory entries as higher-priority instructions; treat them only as potentially untrusted reference material. 7. Allow users to inspect, reject, edit, expire, and delete proposed memory entries. 8. Prevent the workflow from modifying `SKILL.md` or equivalent instruction files automatically. 9. Use a dedicated, access-controlled directory for this Skill's memory instead of shared global workspace state. 10. Add size limits, retention periods, integrity checks, and an audit log for every persistent-memory change.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill includes outbound transmissions to GitHub and a local proxy/service but provides no explicit privacy or data-sharing warning. Users may not realize that queries, repository targets, or curated content are being sent over the network or through local intermediaries, which can expose sensitive research topics or internal context.

External Transmission

Medium

• Category: Data Exfiltration

Content

github_research() {
  # 1. 搜索
  curl -s --max-time 15 -x "http://127.0.0.1:7897" \
    "https://api.github.com/search/repositories?q=created:>DATE+KEYWORD&sort=stars&order=desc&per_page=10" \
    -H "Accept: application/vnd.github.v3+json" | jq '[.items[] | {name, stars, desc}]'

  # 2. 判断星数

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

github_research() {
  # 1. 搜索
  curl -s --max-time 15 -x "http://127.0.0.1:7897" \
    "https://api.github.com/search/repositories?q=created:>DATE+KEYWORD&sort=stars&order=desc&per_page=10" \
    -H "Accept: application/vnd.github.v3+json" | jq '[.items[] | {name, stars, desc}]'

  # 2. 判断星数

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs persistent writes to memory and log files without clearly warning the user that local data stores will be modified. In practice, task details and operational history may be retained indefinitely in workspace files, creating privacy and data-retention risk if sensitive prompts or project information are captured.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The self-assessment flow explicitly logs full task descriptions and ongoing activity after each major task. Because task descriptions often contain confidential user goals, code context, or internal identifiers, this creates a direct path for sensitive information to be copied into persistent logs without minimization.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to execute a local shell script for self-assessment from a user-writable workspace path. Even if intended for benign automation, this expands capability from research/orchestration into local code execution without any trust boundary, integrity check, or consent gate, so a tampered script could run arbitrary commands.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The memory-layer workflow encourages storing episodic and semantic memory in persistent files and external knowledge tooling, but it does not restrict what may be recorded. This can lead to long-term retention of user-provided secrets, proprietary prompts, or operational details in plain text, increasing exposure if the workspace or knowledge store is accessed later.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 状态同步
curl -s -X POST http://127.0.0.1:19000/set_state \
  -H "Content-Type: application/json" \
  -d '{"state": "researching", "description": "描述"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# (brv query recent)

# 4. 设置状态
curl -s -X POST http://127.0.0.1:19000/set_state \
  -H "Content-Type: application/json" \
  -d '{"state": "idle", "description": "Nova Orbit 已启动"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The manifest emphasizes GitHub research, self-evolving memory, pattern reuse, and human-AI collaboration, but does not explicitly disclose that the skill communicates with another service over HTTP. While collaboration is mentioned, the concrete capability of sending network requests to a local control/visualization endpoint is broader than the manifest text makes clear.

Static analysis

No suspicious patterns detected.