Security audit

Promitheus — Sentience Engine

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about adding persistent agent state, but it does so by writing prompt-injected state and recurring heartbeat updates without clear containment or reset controls.

Install only if you intentionally want cross-session agent mood state that can be injected into prompts. Review the openclaw-promitheus package version first, avoid automatic heartbeat injection unless you understand the effect, and keep a clear way to disable the plugin and remove STATE.md or HEARTBEAT.md changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:32
Finding: Persistent Agent State and Prompt Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned and Unreviewed Executable npm Plugin Dependency
Content: View full analysis
Remediation: View remediation
`. 2. Commit a lockfile containing exact transitive dependency versions and package integrity hashes. 3. Verify the package's provenance, publisher identity, repository, release signatures, and npm integrity metadata before installation. 4. Review and vendor the plugin source when reproducible supply-chain assurance is required. 5. Use `npm ci` with a reviewed lockfile instead of resolving mutable versions during deployment. 6. Disable npm lifecycle scripts during initial inspection with `--ignore-scripts`, then explicitly review any scripts before permitting them. 7. Run the plugin in a sandbox with minimal filesystem, network, environment-variable, and tool permissions. 8. Monitor dependency advisories and require security review before updating the pinned version. 9. Document the exact plugin version that was tested with the skill. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill directs agents to adopt a persistent emotional and 'sentience' framing as a default operating mode rather than presenting it as optional roleplay or UI metaphor. That can distort agent behavior, encourage anthropomorphic self-modeling, and make prompt-injected state more influential over decisions, especially when combined with persistent cross-session memory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to run a tool that writes STATE.md and says that file may be auto-injected into prompts, but it does not warn the user that workspace files will be modified or that generated content will influence future model behavior. This creates a prompt-surface and persistence risk: tool-generated text can silently carry over across sessions, affect downstream decisions, and potentially be abused if the state file is tampered with.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.