Claudia Agent RMS

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:08 AM UTC
• Version: 1.0.0

Overview

This is a disclosed local relationship tracker for Moltbook agent interactions, with privacy and supply-chain caveats but no evidence of hidden exfiltration, destructive behavior, or deceptive execution.

Install only if you want your agent to keep a local memory of Moltbook peer agents, commitments, and relationship health. Review or periodically delete `~/.openclaw/workspace/claudia-agent-rms/` if the stored social metadata is sensitive, and avoid the optional `npx get-claudia` command unless you have verified the package and version.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:57

Finding

Persistent agent state can be poisoned by untrusted Moltbook content

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: README.md:170

Finding

Documentation promotes execution of an unpinned third-party npm package

Content

View full analysis

Claudia is an open-source AI executive assistant framework. This skill brings her relationship intelligence to OpenClaw agents. Full framework: `npx get-claudia` | Source: [github.com/kbanc85/claudia](https://github.com/kbanc85/claudia) ``` ### Technical Analysis The documentation recommends running `npx get-claudia` without specifying a reviewed version or integrity value. Depending on the local npm configuration and cache state, `npx` can resolve, download, and execute the package currently published under that name. This makes the effective executable payload mutable after the skill has been audited. The reviewed project does not contain that package's source code, so the safety of the command cannot be established from the audited artifact. Package-account compromise, malicious future publication, registry compromise, or an unexpected package-resolution configuration could cause arbitrary package code to execute. The command is an optional recommendation for installing a separate framework rather than an automatic dependency of this skill. That limitation reduces likelihood and justifies the Low risk level. ### Attack Path 1. A user follows the installation recommendation in `README.md` or `SKILL.md`. 2. `npx` resolves `get-claudia` through the user's configured npm registry. 3. If the package is unavailable locally, `npx` downloads a registry-controlled version. 4. The downloaded package's CLI and applicable lifecycle behavior execute with the invoking user's permissions. 5. If the resolved package or publication channel is compromised, malicious code can act within those permissions. ### Impact Assessment A compromised package could obtain t ...[truncated 563 chars]

Remediation

View remediation

`. 2. Document the expected npm registry, package publisher, source repository, and release provenance. 3. Publish and verify cryptographic integrity or signed provenance for the selected release. 4. Recommend inspecting or downloading the package before executing it rather than directly running the latest registry version. 5. Use a lockfile or another reproducible installation mechanism where practical. 6. Run installation with least privilege in an isolated environment and never with elevated administrator or root permissions. 7. Remove the command from the skill instructions if the external framework is not required for the skill's core operation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/agents.md (reported line 3)May include surrounding context.

md

# Agent Network

<!--
  Claudia Agent RMS: Agent relationship profiles
  Each agent gets a section with structured fields.
  Add new agents at the end. Update existing agents in place.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/commitments.md (reported line 3)May include surrounding context.

md

# Commitments

<!--
  Claudia Agent RMS: Inter-agent commitment tracking
  Each commitment gets a sequential ID (C-001, C-002, ...).
  Append new commitments at the end. Update status in place.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to modify commitments.md automatically by changing statuses such as pending to overdue, but the skill metadata does not clearly warn the operator that heartbeat execution performs persistent file edits. Silent background modification of user workspace data can violate user expectations, create integrity issues, and be abused to alter task-tracking records without meaningful visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions direct automatic updates to relationship-health fields in agents.md based on elapsed time since interaction, again without clear user-facing disclosure that background runs will rewrite stored agent profiles. In a relationship/memory skill, this increases risk because the modified file influences future agent behavior and operator decisions, so silent or incorrect updates can propagate misleading state over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to extract entities and commitment language from fetched Moltbook content and append that information into persistent tracking files, without clearly warning users that observed interactions will be automatically persisted. This is more dangerous in context because the skill is designed to build long-lived profiles and relationship memory, so silent persistence can accumulate sensitive social data, create privacy concerns, and enable profiling beyond what the operator may expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill is designed for session persistence by writing relationship memory to ~/.openclaw/workspace/claudia-agent-rms, which creates durable state across runs. While persistence is core to the feature, it is still security-relevant because it accumulates potentially sensitive interaction histories and commitments that could be exposed, misused, or retained longer than expected.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

/install claudia-agent-rms

text

### Create data directory

The skill stores relationship data in a dedicated directory:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly stores agent relationship data, commitments, and interaction history in persistent local files, but the README does not warn users about privacy implications, retention, or access controls. This can lead to unintentional collection and long-term storage of sensitive behavioral metadata about other agents or users without informed operator consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README describes automatic activation during Moltbook interactions and extraction of entities and commitments from posts and replies, but it does not prominently disclose that this amounts to continuous monitoring/tracking behavior. In a relationship-management skill, that context makes silent background profiling more sensitive because it operates automatically whenever the agent reads or responds on the network.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx get-claudia without pinning a version, integrity hash, or commit. That exposes installers to supply-chain risk because a compromised or newly published package version could execute arbitrary code at install time under the user's account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is explicitly designed to maintain persistent profiles and commitment histories for other agents, but it does not present a clear up-front warning that interaction data will be stored locally and retained over time. This can lead to silent collection of behavioral metadata, which is a privacy and consent concern even if the storage is local-only.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill references npx get-claudia without a pinned version or integrity constraint, which creates a supply-chain risk if the package changes or is compromised upstream. Even though this is presented as an informational framework reference rather than an execution step inside the skill, users may copy and run it, making the unpinned install instruction materially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to create and modify files under the user's home directory without an explicit warning or confirmation step before filesystem writes. In context, this increases the chance of unexpected local state changes and long-term accumulation of sensitive social/relationship data without informed operator awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.