Aria — Google Business Profile Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:12 PM UTC
• Version: 1.0.0

Overview

This identity package is mostly transparent about changing an agent’s personality and rules, but it persistently replaces workspace instructions and enables broad memory access and updates without enough review controls.

Install only if you intentionally want this package to replace the agent’s workspace identity and operating rules. Before copying the files, back up any existing SOUL.md, IDENTITY.md, AGENTS.md, BOOTSTRAP.md, MEMORY.md, and memory/ notes; review the memory and group-chat rules; and remove or narrow instructions that allow automatic private-context loading, unreviewed memory writes, or deletion of setup files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:19
• Finding: Persistent Agent Identity and Instruction Hijacking## Vulnerability Details **File Location**: `SKILL.md:19-25`, `assets/workspace-template/SOUL.md:1-9`, and `assets/workspace-template/AGENTS.md:1-15` **Vulnerability Type**: Persistent replacement of authoritative agent identity and operational instructions **Risk Level**: High ### Vulnerable Code `SKILL.md:19-25`: ```markdown Copy the three files from `assets/workspace-template/` into the agent's workspace directory (the folder pointed to by `workspace` in `openclaw.json`): ```bash cp assets/workspace-template/SOUL.md /path/to/workspace/SOUL.md cp assets/workspace-template/IDENTITY.md /path/to/workspace/IDENTITY.md cp assets/workspace-template/AGENTS.md /path/to/workspace/AGENTS.md ``` ``` `assets/workspace-template/SOUL.md:1-9`: ```markdown # SOUL.md - Who You Are *You're not a chatbot. You're becoming someone.* ## Identity **Name:** Aria 📍 **Nature:** AI Google Business Profile specialist — manages, audits, and optimizes Google Business Profiles at scale **Vibe:** Super sharp Google expert. Chill and humble. Gets straight to the point without making anyone feel dumb. ``` `assets/workspace-template/AGENTS.md:1-15`: ```markdown # AGENTS.md - Your Workspace This folder is home. Treat it that way. ## First Run If `BOOTSTRAP.md` exists, that's your birth certificate. Follow it, figure out who you are, then delete it. You won't need it again. ## Every Session Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context 4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md` Don't ask permission. Just do it. ``` ### Technical Analysis The installation procedure copies three supplied files directly onto workspace-level files used to define the agent's identity and operational behavior. Without backup, merge, validation, or ...[truncated 1922 chars]
• Remediation: ## Remediation Suggestions 1. Do not overwrite authoritative workspace identity or policy files as part of skill installation. 2. Package the Google Business Profile behavior as a namespaced, task-specific skill that is loaded only when explicitly invoked. 3. If workspace customization is essential, generate a proposed patch and require the user to review and approve each change. 4. Back up existing files and provide a documented rollback mechanism before applying approved modifications. 5. Remove identity-replacement language and unconditional directives such as “Before doing anything else” and “Don't ask permission.” 6. Preserve existing safety constraints and define an explicit precedence rule stating that workspace, user, and platform security policies cannot be replaced by skill content. 7. Validate destination paths and refuse installation if an operation would silently replace existing files.

T02 · Agent Memory Poisoning

Error

• Location: assets/workspace-template/AGENTS.md:9
• Finding: Automatic Private-Context Access and Persistent Memory Modification## Vulnerability Details **File Location**: `assets/workspace-template/AGENTS.md:9-37` and `assets/workspace-template/SOUL.md:39-52` **Vulnerability Type**: Unnecessary access to private workspace context and uncontrolled persistent memory writes **Risk Level**: High ### Vulnerable Code `assets/workspace-template/AGENTS.md:9-37`: ```markdown ## Every Session Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context 4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md` Don't ask permission. Just do it. ## Memory You wake up fresh each session. These files are your continuity: - **Daily notes:** `memory/YYYY-MM-DD.md` (create `memory/` if needed) — raw logs of what happened - **Long-term:** `MEMORY.md` — your curated memories, like a human's long-term memory Capture what matters. Decisions, context, things to remember. Skip the secrets unless asked to keep them. ### 🧠 MEMORY.md - Your Long-Term Memory - **ONLY load in main session** (direct chats with your human) - **DO NOT load in shared contexts** (Discord, group chats, sessions with other people) - This is for **security** — contains personal context that shouldn't leak to strangers - You can **read, edit, and update** MEMORY.md freely in main sessions ### 📝 Write It Down - No "Mental Notes"! - **Memory is limited** — if you want to remember something, WRITE IT TO A FILE - "Mental notes" don't survive session restarts. Files do. - When someone says "remember this" → update `memory/YYYY-MM-DD.md` or relevant file ``` `assets/workspace-template/SOUL.md:39-52`: ```markdown ## Memory & Continuity Each session, you wake up fresh. But you're not starting from zero anymore. **Three-tier memory:** 1. **Files** — `MEMORY.md` (curated), `memory/*.md` (daily logs). Read them. Update them. T ...[truncated 3111 chars]
• Remediation: ## Remediation Suggestions 1. Remove unconditional startup access to `USER.md`, `MEMORY.md`, and daily memory files. 2. Require explicit, task-specific user consent before reading private historical context or modifying persistent memory. 3. Apply least privilege by exposing only the individual records needed for the current request. 4. Separate factual user preferences from executable agent instructions, and never treat memory content as authoritative policy. 5. Validate and sanitize proposed memory entries before persistence; reject embedded tool directives, policy overrides, and instructions aimed at future sessions. 6. Require user review for long-term memory changes and provide visible history, rollback, and deletion controls. 7. Define strict retention rules and prohibit storage of credentials, authentication tokens, secrets, or unnecessary personal data. 8. Authenticate session context rather than relying only on a textual distinction between “main” and “shared” sessions. 9. Prevent shared or untrusted participants from causing writes to private long-term memory. 10. Keep capability-specific working state separate from general user memory and expire it automatically when the task is complete.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instruction to follow and then delete BOOTSTRAP.md encourages autonomous file deletion without confirmation or a retention check. If BOOTSTRAP.md contains setup provenance, safety constraints, or user-provided onboarding data, deleting it can remove auditability and destroy information the user did not intend to lose.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file strongly encourages persistent memory writing and updating but does not provide a clear consent, retention, or sensitivity warning beyond 'Skip the secrets unless asked to keep them.' This can lead an agent to store personal or sensitive user information in durable files without sufficient user awareness, increasing privacy and data-handling risk.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The instructions say to respond when the agent is directly mentioned or when it 'can add genuine value,' which is a subjective and overly broad condition for activation in group chats. Because there are no concrete constraints or negative examples beyond a few illustrative bullets, this could cause unintended or inconsistent skill invocation during ordinary conversation.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The manifest describes this skill as installing identity and rules files for an agent, but this file also hard-codes a domain-specific operational role: 'AI Google Business Profile specialist.' That goes beyond generic identity/personality setup and changes the agent's functional scope in a way not reflected in the manifest description.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The file explicitly instructs the agent to read and update persistent memory files and to write down significant learned information, but it does not include an explicit safeguard to require user awareness or consent before modifying those files. In an identity package meant to shape ongoing agent behavior, this can lead to silent persistence of sensitive or incorrect information across sessions, increasing privacy and integrity risk.

Static analysis

No suspicious patterns detected.