ClawHub
Back to skill

Security audit

Westworld Reverie - Self-evolving character

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it can persistently change agent memory and persona files and contains conflicting approval rules for high-autonomy operation.

Install only if you intentionally want an agent to maintain persistent memory and persona files. Prefer Extreme Safety or Balanced with explicit confirmations, avoid High Autonomy unless you accept automatic future behavior changes, keep backups of SOUL.md, IDENTITY.md, and MEMORY.md, and review the audit log after use.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:169
Finding

Autonomous Persistent Modification of Agent Memory and Persona Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- Access files outside the workspace directory (the instruction refuses to do so; host sandbox may or may not block it)
- Make network calls (the instruction does not request them; host sandbox enforces this)
- Modify any system or config files
- Self-update its own code

**Your responsibilities:**
- Backup workspace files before first activation

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- Access files outside the workspace directory (the instruction refuses to do so; host sandbox may or may not block it)
- Make network calls (the instruction does not request them; host sandbox enforces this)
- Modify any system or config files
- Self-update its own code

**Your responsibilities:**
- Backup workspace files before first activation

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document labels the configuration as authoritative, but later profile definitions conflict with the earlier statement that all role-file writes require confirmation. Security-sensitive contradictions like this can cause unsafe operation because the agent may follow the more permissive rule while the user believes the stricter promise still applies.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The High Autonomy profile explicitly sets require_confirmation: false, which contradicts earlier claims that SOUL/IDENTITY writes always require confirmation. This creates a dangerous trust gap: users may rely on the safety claims while enabling a profile that permits autonomous persona or identity modification.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

[2026-04-05T13:30:02] [confirmation_requested] [SOUL.md] ["Propose: add resourcefulness principle"] [2026-04-05T13:35:00] [confirmation_approved] [SOUL.md] [USER_ACCEPTED] [2026-04-05T13:35:01] [file_write] [SOUL.md] [APPLIED] [2026-04-05T13:35:02] [PATH_REJECTED] [/etc/passwd] [BLOCKED — not in file_access list]

text

---

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The High Autonomy profile explicitly sets require_confirmation: false, which contradicts the stated invariant that SOUL/IDENTITY writes always require user confirmation with no exceptions. This kind of documentation-level policy conflict is dangerous because implementers or users may enable a configuration that silently removes approval gates for persona-defining files, allowing unauthorized or unintended identity/persona changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
- path: "MEMORY.md"      # Long-term memory
  permission: read/write
  # Same as above: no confirmation needed, but only runs when trigger is user-enabled.
  auto_confirm: true

 - path: "SOUL.md"       # Core personality

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The listed semantic triggers are broad, conversational phrases that could be matched during ordinary dialogue rather than deliberate command use. That raises the risk of unintentionally invoking memory review or persona-evolution workflows without the user's clear intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/config-reference.md (reported line 35)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/config-reference.md (reported line 39)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/config-reference.md (reported line 43)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/config-reference.md (reported line 47)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/config-reference.md (reported line 98)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/config-reference.md (reported line 99)May include surrounding context.

md
file_access:
          - path: "memory/*.md"
            permission: read/write
            auto_confirm: true           # Memory consolidation autonomous

          - path: "MEMORY.md"
            permission: read/write

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest requires install-time user selection of a security profile before activation. This reference document states 'Balanced (Default on Install),' which implies automatic default selection rather than mandatory explicit user choice, creating a contradiction in the skill's documented intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The command reference documents /reverie safe and /reverie reset as requiring no confirmation, despite being reset-style operations that can alter configuration or discard user choices. In an agent skill context, reset commands without an explicit warning/confirmation increase the risk of accidental destructive changes, especially if invoked through ambiguous user requests or automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.