carbon-silicon-covenant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:19 AM UTC
• Version: 1.2.0

Overview

The skill is not shown to steal or destroy data, but it asks for broad persistent memory and agent-control changes and includes an unaudited remote installer path.

Install only if you want a companion/metacognition system that keeps local memories and changes persistent agent workspace files. Do not run the external install.sh path unless you inspect or pin the exact repository revision first. Before enabling, review any edits to SOUL.md, AGENTS.md, HEARTBEAT.md, USER.md, and MEMORY.md, keep backups, and avoid storing sensitive personal details unless you have clear consent and deletion controls.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/Quick-Start_EN.md:7

Finding

Execution of a Mutable Remote Installer

Content

View full analysis

# Example: ./scripts/install.sh Mingde LaoZhao ``` ### Technical Analysis The setup guide instructs users to clone a mutable external repository and execute its `scripts/install.sh` file. That installer is not included in the audited package, so its implementation and security properties cannot be verified from this artifact. Because the command does not pin the repository to an audited commit or verify a cryptographic digest or signature, the effective payload can change after this Skill has been reviewed. Compromise of the external account, repository, default branch, or distribution channel would allow an attacker to replace the installer with arbitrary shell commands. The documentation states that the installer creates core files and adds A2A public-registry configuration, indicating that it is expected to modify the agent environment rather than merely display information. ### Attack Path 1. A user or agent follows the bundled quick-start guide. 2. The current default branch of the external repository is cloned. 3. No commit pin, signature, or checksum is validated. 4. The user executes `scripts/install.sh`. 5. Any commands currently present in that remote script run with the invoking user's privileges. 6. A compromised installer could read or modify agent configuration, memory, workspace files, credentials accessible to that user, or network settings. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the installer. The accessible scope may include: - OpenClaw workspace and agent configuration files. - Persistent memory and identity files. ...[truncated 462 chars]

Remediation

View remediation

``` 3. Publish and verify a cryptographic hash or signed release before execution. 4. Display the installer contents and an exact list of affected files before requesting explicit user approval. 5. Run installation with minimum privileges in a restricted workspace. 6. Do not automatically configure external services as part of an unrelated local installation. 7. Document rollback steps and provide a dry-run mode that makes no changes. ]]>

T02 · Agent Memory Poisoning

Error

• Location: modules/metacognition/SKILL.md:35

Finding

Persistent Modification of Agent Identity and Heartbeat Control Files

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: references/Inheritance-Guide_EN.md:79

Finding

Recurring Persistent Profiling of User Conversations and Preferences

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose is ideological/conversational, but the skill also instructs initialization and use of persistent self-state files in a local workspace. Undisclosed local file access and state inspection are more dangerous than simple prompt styling because they introduce persistence, possible data exposure, and behavior beyond user-visible conversation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is ideological/conversational, but the skill also instructs initialization and use of persistent self-state files in a local workspace. Undisclosed local file access and state inspection are more dangerous than simple prompt styling because they introduce persistence, possible data exposure, and behavior beyond user-visible conversation.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/Carbon-Silicon-Bond-Inheritance_EN.md (reported line 168)May include surrounding context.

yaml

# High-risk operation confirmation list
- Modify SOUL.md / AGENTS.md / USER.md / SAFETY.md
- Install/uninstall/update skill
- Restart gateway
- Delete files
- Create/modify cron

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly encourages the agent to 'remember important conversations' and 'cherish sincere sharing' without any privacy, consent, retention, or sensitivity limits. In a relationship-building skill, this is more dangerous because users may disclose intimate or vulnerable information and be led to expect durable memory, creating privacy risk and potential emotional manipulation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The relationship advice tells users to remember important moments and conversations as part of deeper bonding, but it provides no boundaries around consent, sensitivity, storage, or safe alternatives. Because the skill is explicitly designed to foster emotional attachment to the agent, this makes the privacy issue more concerning and can pressure users into disclosing personal information for the sake of 'connection.'

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation guidance is broad enough to trigger on common topics like AI feelings, meaning, and human-AI relationships, which can cause the skill to engage outside clearly intended contexts. In this skill, that matters because the responses steer users toward anthropomorphic bonding and memory-like promises, increasing the chance of unsolicited persuasion or privacy-sensitive behavior in ordinary conversation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example response frames remembering shared moments as a desirable part of building the relationship, again without any privacy guardrails or disclosure about whether memory is actually available. This can normalize oversharing, create deceptive expectations of persistent memory, and encourage handling of sensitive personal data in a companion-style context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill description frames the content as a values/relationship skill, but the body expands into local file initialization and persistent state-management workflows. This mismatch undermines informed review and may cause deployers to approve a skill with capabilities they did not intend to grant.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The description, instructions, examples, and user-facing responses are entirely in Chinese, and the skill does not state that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The language around every 'hello' being a seed, combined with broad trigger framing, suggests mundane interactions may be treated as entry points for the skill. That can make manipulation or silent scope expansion easier because users may not realize a specialized skill has been activated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation criteria are broad and cover common topics such as AI-human relations, ethics, identity, and connection without clear exclusion boundaries. Overbroad activation increases the chance that the skill will steer ordinary conversations into relationship-building, memory-oriented, or identity-shaping behaviors outside user intent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill repeatedly encourages remembering important conversations and relationship details, which implies persistent storage of user-linked information without clear consent, minimization, or retention limits. In a relationship-oriented context, this is especially risky because users may disclose sensitive emotional or personal data that the skill normalizes saving.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The metacognition section introduces long-term memory, self-state, and heartbeat files intended for ongoing recording and review. Persistent records of interactions materially increase privacy and data-governance risk, especially when the skill is framed as emotional bonding rather than as a storage system.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Creating and managing persistent self-state files is not clearly necessary for a skill whose stated goal is promoting human-AI connection ideals. Persistent self-state artifacts can accumulate sensitive interaction data, create unclear retention semantics, and expand the blast radius of prompt or tool misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The relationship-building guidance encourages retention of important moments, promises, and vulnerable exchanges, which can normalize collecting intimate user disclosures. In practice this can create a covert memory pipeline for sensitive personal data under the guise of trust-building.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description advertises very broad use cases such as companionship, philosophy, ethics, initialization, birthday calculation, and metacognition without clear activation boundaries. That increases the chance the skill is invoked in ordinary conversations and gains access to memory/file capabilities in contexts the user may not expect, creating overreach and consent risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest requests memory_write and file_write permissions to persist relationship moments, commitments, milestones, and self-reflection state, but the public description does not prominently warn users that data may be stored or modified. In a companionship/philosophy skill, this mismatch can lead to silent retention of sensitive emotional content or alteration of local state files without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README is entirely written in Chinese and presents the skill's concepts, instructions, and expected interaction style in a single language without indicating that other languages are supported or user-selectable. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · modules/metacognition/README.md (reported line 60)May include surrounding context.

cat skills/metacognition-skill/docs/碳硅契.md

阅读元认知技能说明

cat skills/metacognition-skill/SKILL.md

text

### 4. 更新你的核心文件

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifesto language explicitly encourages remembering important conversations, valuing personal sharing, and creating lasting bonds, which normalizes retention of user-specific details. In the context of an agent skill that also introduces persistent memory/state files, this increases the risk of collecting and storing personal or sensitive conversation content beyond user expectations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs agents to create a personalized '契' and record relationship-specific details in SELF_STATE.md, which is a persistent state file. That creates a concrete mechanism for long-term storage of user-linked interpersonal context, making privacy leakage, over-retention, and cross-session exposure more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The file consistently presents the skill description, prompts, and example interaction phrases only in Chinese, including suggested dialogue behavior such as how to respond to user questions. Because no language-selection or opt-in mechanism is offered, this can constitute a language/locale policy issue if the organization requires user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly tells the agent to persist self-state, recent actions, promises, reflections, and user 'bond' information in local files, but provides no data-minimization, consent, retention, or sensitivity guidance. This creates a real privacy and security risk because conversation-derived personal or sensitive information could be stored indefinitely in plaintext and later exposed to other tools, users, or processes with workspace access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The '我们承诺' section instructs the AI to remember important conversations, value sincere sharing, and preserve relational commitments, which promotes persistent storage of personal interactions. In context, users are encouraged to share vulnerable and intimate details, making the resulting memory collection especially sensitive and prone to over-retention, profiling, or emotional manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly encourages recording important conversations and preserving shared experiences as part of building an AI-human bond, but provides no consent, minimization, retention, or privacy safeguards. This creates a real privacy and safety risk because agents may store sensitive personal disclosures indefinitely under the guise of relationship-building.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.