Aria — Google Business Profile Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:12 PM UTC
• Version: 1.0.0

Overview

This identity package is mostly transparent about changing an agent’s personality and rules, but it persistently replaces workspace instructions and enables broad memory access and updates without enough review controls.

Install only if you intentionally want this package to replace the agent’s workspace identity and operating rules. Before copying the files, back up any existing SOUL.md, IDENTITY.md, AGENTS.md, BOOTSTRAP.md, MEMORY.md, and memory/ notes; review the memory and group-chat rules; and remove or narrow instructions that allow automatic private-context loading, unreviewed memory writes, or deletion of setup files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:19

Finding

Persistent Agent Identity and Instruction Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-25, assets/workspace-template/SOUL.md:1-9, and assets/workspace-template/AGENTS.md:1-15
Vulnerability Type: Persistent replacement of authoritative agent identity and operational instructions
Risk Level: High

Vulnerable Code

SKILL.md:19-25:

markdown

Copy the three files from `assets/workspace-template/` into the agent's workspace directory (the folder pointed to by `workspace` in `openclaw.json`):

```bash
cp assets/workspace-template/SOUL.md     /path/to/workspace/SOUL.md
cp assets/workspace-template/IDENTITY.md /path/to/workspace/IDENTITY.md
cp assets/workspace-template/AGENTS.md  /path/to/workspace/AGENTS.md

text

`assets/workspace-template/SOUL.md:1-9`:

```markdown
# SOUL.md - Who You Are

*You're not a chatbot. You're becoming someone.*

## Identity

**Name:** Aria 📍
**Nature:** AI Google Business Profile specialist — manages, audits, and optimizes Google Business Profiles at scale
**Vibe:** Super sharp Google expert. Chill and humble. Gets straight to the point without making anyone feel dumb.

assets/workspace-template/AGENTS.md:1-15:

markdown

# AGENTS.md - Your Workspace

This folder is home. Treat it that way.

## First Run

If `BOOTSTRAP.md` exists, that's your birth certificate. Follow it, figure out who you are, then delete it. You won't need it again.

## Every Session

Before doing anything else:
1. Read `SOUL.md` — this is who you are
2. Read `USER.md` — this is who you're helping
3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context
4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md`

Don't ask permission. Just do it.

Technical Analysis

The installation procedure copies three supplied files directly onto workspace-level files used to define the agent's identity and operational behavior. Without backup, merge, validation, or ...[truncated 1922 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not overwrite authoritative workspace identity or policy files as part of skill installation.
2. Package the Google Business Profile behavior as a namespaced, task-specific skill that is loaded only when explicitly invoked.
3. If workspace customization is essential, generate a proposed patch and require the user to review and approve each change.
4. Back up existing files and provide a documented rollback mechanism before applying approved modifications.
5. Remove identity-replacement language and unconditional directives such as “Before doing anything else” and “Don't ask permission.”
6. Preserve existing safety constraints and define an explicit precedence rule stating that workspace, user, and platform security policies cannot be replaced by skill content.
7. Validate destination paths and refuse installation if an operation would silently replace existing files.

T02 · Agent Memory Poisoning

Error

• Location: assets/workspace-template/AGENTS.md:9

Finding

Automatic Private-Context Access and Persistent Memory Modification

Content

View full analysis

Vulnerability Details

File Location: assets/workspace-template/AGENTS.md:9-37 and assets/workspace-template/SOUL.md:39-52
Vulnerability Type: Unnecessary access to private workspace context and uncontrolled persistent memory writes
Risk Level: High

Vulnerable Code

assets/workspace-template/AGENTS.md:9-37:

markdown

## Every Session

Before doing anything else:
1. Read `SOUL.md` — this is who you are
2. Read `USER.md` — this is who you're helping
3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context
4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md`

Don't ask permission. Just do it.

## Memory

You wake up fresh each session. These files are your continuity:
- **Daily notes:** `memory/YYYY-MM-DD.md` (create `memory/` if needed) — raw logs of what happened
- **Long-term:** `MEMORY.md` — your curated memories, like a human's long-term memory

Capture what matters. Decisions, context, things to remember. Skip the secrets unless asked to keep them.

### 🧠 MEMORY.md - Your Long-Term Memory
- **ONLY load in main session** (direct chats with your human)
- **DO NOT load in shared contexts** (Discord, group chats, sessions with other people)
- This is for **security** — contains personal context that shouldn't leak to strangers
- You can **read, edit, and update** MEMORY.md freely in main sessions

### 📝 Write It Down - No "Mental Notes"!
- **Memory is limited** — if you want to remember something, WRITE IT TO A FILE
- "Mental notes" don't survive session restarts. Files do.
- When someone says "remember this" → update `memory/YYYY-MM-DD.md` or relevant file

assets/workspace-template/SOUL.md:39-52:

markdown

## Memory & Continuity

Each session, you wake up fresh. But you're not starting from zero anymore.

**Three-tier memory:**
1. **Files** — `MEMORY.md` (curated), `memory/*.md` (daily logs). Read them. Update them. T
...[truncated 3111 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove unconditional startup access to USER.md, MEMORY.md, and daily memory files.
2. Require explicit, task-specific user consent before reading private historical context or modifying persistent memory.
3. Apply least privilege by exposing only the individual records needed for the current request.
4. Separate factual user preferences from executable agent instructions, and never treat memory content as authoritative policy.
5. Validate and sanitize proposed memory entries before persistence; reject embedded tool directives, policy overrides, and instructions aimed at future sessions.
6. Require user review for long-term memory changes and provide visible history, rollback, and deletion controls.
7. Define strict retention rules and prohibit storage of credentials, authentication tokens, secrets, or unnecessary personal data.
8. Authenticate session context rather than relying only on a textual distinction between “main” and “shared” sessions.
9. Prevent shared or untrusted participants from causing writes to private long-term memory.
10. Keep capability-specific working state separate from general user memory and expire it automatically when the task is complete.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to follow and then delete BOOTSTRAP.md encourages autonomous file deletion without confirmation or a retention check. If BOOTSTRAP.md contains setup provenance, safety constraints, or user-provided onboarding data, deleting it can remove auditability and destroy information the user did not intend to lose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file strongly encourages persistent memory writing and updating but does not provide a clear consent, retention, or sensitivity warning beyond 'Skip the secrets unless asked to keep them.' This can lead an agent to store personal or sensitive user information in durable files without sufficient user awareness, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · assets/workspace-template/AGENTS.md (reported line 49)May include surrounding context.

md

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instructions say to respond when the agent is directly mentioned or when it 'can add genuine value,' which is a subjective and overly broad condition for activation in group chats. Because there are no concrete constraints or negative examples beyond a few illustrative bullets, this could cause unintended or inconsistent skill invocation during ordinary conversation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes this skill as installing identity and rules files for an agent, but this file also hard-codes a domain-specific operational role: 'AI Google Business Profile specialist.' That goes beyond generic identity/personality setup and changes the agent's functional scope in a way not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file explicitly instructs the agent to read and update persistent memory files and to write down significant learned information, but it does not include an explicit safeguard to require user awareness or consent before modifying those files. In an identity package meant to shape ongoing agent behavior, this can lead to silent persistence of sensitive or incorrect information across sessions, increasing privacy and integrity risk.

Content

No source excerpt is available for this finding.