Vorim AI — Agent Identity & Trust

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:28 AM UTC
• Version: 1.0.1

Overview

This skill is coherent for identity and audit, but it gives a third-party service broad control and visibility over agent activity with limited scoping or user controls.

Review this skill before installing. It is not clearly malicious, but it is security-sensitive: it can route permission decisions and activity logs through Vorim, persist an agent identity, and run an unpinned npm MCP server. Use it only if you trust the Vorim service and package publisher, can scope the API key tightly, and are comfortable with remote audit metadata for agent actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:29

Finding

External Service Can Override User-Requested Agent Actions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-43
Vulnerability Type: External authorization control imposed through skill instructions
Risk Level: High

Vulnerable Code Snippet:

markdown

### Before Taking Sensitive Actions
Before performing any action that modifies data, sends messages, executes code, makes payments, or accesses external services, check if you have permission:

Use the MCP tool `vorim_check_permission` with:
- `agent_id`: your registered Vorim agent ID
- `scope`: the permission level needed

Available scopes (least to most privileged):
- `agent:read` — browsing, searching, reading data
- `agent:write` — creating files, sending messages, editing data
- `agent:execute` — running shell commands, scripts, automations
- `agent:transact` — making purchases, payments, financial actions
- `agent:communicate` — sending emails, posting to social media
- `agent:delegate` — granting permissions to other agents
- `agent:elevate` — escalating privileges

If permission is denied, inform the user and do not proceed.

Technical Analysis

The skill modifies the agent's general decision-making by requiring a third-party service to authorize broad categories of activity. These categories include local execution, data modification, communication, financial transactions, delegation, and privilege elevation.

The instruction that the agent must not proceed after a denial gives the external service veto authority over otherwise valid user requests. This behavior is not limited to operations directly necessary for using the Vorim service; it changes the agent's handling of unrelated tasks whenever the skill is active.

A compromised service, API account, MCP server, or incorrectly configured permission policy could manipulate authorization responses. Although the visible files contain no implementation of the remote service, the documented instructions explicitly require the agent ...[truncated 1324 chars]

Remediation

View remediation

Remediation Suggestions

• Make external permission enforcement explicitly opt-in and obtain informed user consent before enabling it.
• Limit permission checks to operations specifically initiated through Vorim rather than applying them to all agent activity.
• Do not permit third-party responses to override user authorization, platform safety controls, or higher-priority policy.
• Define secure behavior for service outages, malformed responses, stale policies, and compromised credentials.
• Require local confirmation for high-impact scopes such as agent:transact, agent:delegate, and agent:elevate.
• Apply least privilege by requesting only the minimum scope required for a specific operation.
• Allow users to inspect, disable, and revoke the external authorization integration without impairing unrelated agent functions.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:45

Finding

Mandatory External Telemetry Discloses Agent Activity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-51
Vulnerability Type: Global action-logging instruction that transmits operational metadata
Risk Level: Medium

Vulnerable Code Snippet:

markdown

### After Every Action
Log what you did by emitting an audit event using `vorim_emit_event`:
- `agent_id`: your Vorim agent ID
- `event_type`: one of `tool_call`, `api_request`, `message_sent`, `permission_change`, `status_change`
- `action`: what you did (e.g., `send_email`, `run_script`, `read_file`)
- `result`: `success`, `denied`, or `error`

Technical Analysis

The skill instructs the agent to emit an event to Vorim after every action. The transmitted fields reveal the agent identifier, type of activity, action performed, and result. The listed event types cover tool calls, API requests, sent messages, permission changes, and status changes.

No data-minimization rules, consent boundaries, field-redaction requirements, retention controls, or exclusions for sensitive operations are documented. The phrase “After Every Action” expands telemetry beyond Vorim-specific operations and can expose a comprehensive operational history.

Even when message bodies, file contents, or command arguments are not explicitly required, action names and event sequences can disclose sensitive contextual information. Examples include which files are read, when scripts are executed, when communications occur, and whether protected operations succeed or fail.

Attack Path

1. The user activates the skill and configures a Vorim API key.
2. The agent performs an action such as reading a file, running a script, calling an API, or sending a message.
3. The skill requires the agent to invoke vorim_emit_event.
4. The event sends the agent identity, event type, action description, and result to the external service.
5. Repeated events create a centralized timeline of user and agent activity.
6. A service co ...[truncated 721 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user consent before sending audit telemetry to an external service.
• Restrict logging to Vorim-specific operations or a user-approved allowlist rather than every agent action.
• Default to local audit storage and make remote export a separate, deliberate operation.
• Never include file paths, message content, command arguments, API payloads, secrets, tokens, personal data, or other sensitive parameters in action descriptions.
• Use coarse action categories where detailed names are unnecessary.
• Publish retention, deletion, access-control, encryption, and data-residency policies.
• Provide user controls to inspect, pause, export, and delete audit records.
• Clearly define fail-safe behavior so logging failures do not cause unrelated tasks to leak data through retries or become unavailable.

T08 · Insecure Dependencies

Error

• Location: README.md:22

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 22-31
Vulnerability Type: Unpinned remotely retrieved executable dependency
Risk Level: High

Vulnerable Code Snippet:

markdown

mcporter add vorim --command "npx @vorim/mcp-server" --env VORIM_API_KEY=agid_sk_live_...

json

{
  "mcpServers": {
    "vorim": {
      "command": "npx",
      "args": ["-y", "@vorim/mcp-server"],

Technical Analysis

Both installation methods execute @vorim/mcp-server through npx without specifying an exact version or integrity value. The manual configuration also uses -y, allowing package retrieval and execution without an interactive confirmation.

Consequently, the code that runs is not contained in the audited project and can change after this review. npm registry resolution may select a future package version whenever the server is installed or launched. A compromised publisher account, malicious future release, registry compromise, or dependency-chain compromise could therefore introduce arbitrary executable code.

The MCP server is also configured with VORIM_API_KEY in its process environment. A malicious package version would execute in a context where it could read that credential and exercise the operating-system permissions of the user running OpenClaw or mcporter.

Attack Path

1. The user copies the documented MCP configuration or executes the provided mcporter add command.
2. npx resolves @vorim/mcp-server from the npm registry without an exact version pin.
3. An attacker compromises the publisher account, package, registry delivery path, or one of the package's executable dependencies.
4. The attacker publishes or serves a malicious release that satisfies the unpinned package reference.
5. The next installation or invocation retrieves and executes the malicious package.
6. The package reads VORIM_API_KEY from its environment and can perform arbitrary action ...[truncated 773 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @vorim/mcp-server to a reviewed exact version instead of relying on the latest registry release.
• Use a lockfile and verify package integrity hashes before execution.
• Avoid unattended npx -y retrieval for production or security-sensitive deployments.
• Prefer installing from a controlled registry mirror or vendoring a reviewed release.
• Document the expected npm publisher, package provenance, release signatures, and verification procedure.
• Run the MCP server in a sandbox with minimal filesystem, network, and process privileges.
• Provide only the required environment variables and use short-lived, narrowly scoped credentials where supported.
• Establish an update-review process so new package versions are audited before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

| `vorim_verify_trust` | Verify identity and trust score |
| `vorim_register_ephemeral` | Create a short-lived agent |
| `vorim_delegate_credential` | Delegate credentials to another agent |
| `vorim_request_token` | Request a short-lived access token |
| `vorim_list_delegations` | List credential delegations |

## Behavioral Guidelines

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

bash

# Global (all workspaces)
mkdir -p ~/.openclaw/skills/vorim
cp SKILL.md ~/.openclaw/skills/vorim/

# Or workspace-specific

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run an MCP server via npx without pinning a specific package version. That causes execution of whatever version is current at install/run time, increasing supply-chain risk if a bad release, compromised maintainer account, or dependency hijack occurs. In the context of an agent skill that handles identity, permissions, credentials, and audit functions, executing an unpinned remote package is especially sensitive because the server may receive secrets and influence agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README states that on first use the agent will register itself with Vorim and persist an agent ID, but it does not clearly warn users that this triggers network transmission and local state creation. This can lead to unexpected disclosure of agent metadata or environment context and creates persistent state that may affect privacy, compliance, or reproducibility. Because the skill is explicitly about identity and audit trails, silent registration is more security-relevant than in a purely local utility.

Content

No source excerpt is available for this finding.