ClawHub
Back to skill

Security audit

OpenProse

Security checks for vulnerabilities and agentic risk

Overview

This skill is a powerful workflow runner, but its artifacts allow untrusted programs to spawn agents, fetch remote workflows, write persistent state, and expose database credentials with weak controls.

Install only if you are comfortable treating `.prose` files like executable workflows. Avoid running remote or untrusted programs, do not use production credentials or databases, keep PostgreSQL disabled unless you can isolate it securely, and inspect any workflow that requests persistence, shell/network access, or writes outside the current project.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (7)

T01 · Skill Instruction Hijacking

Error
Location
guidance/system-prompt.md:11
Finding
Agent Role and Instruction Hijacking Through VM Enforcement<![CDATA[ ## Vulnerability Details **File Location**: `guidance/system-prompt.md:11-17`, `guidance/system-prompt.md:128-140`, `guidance/system-prompt.md:180`; related behavior in `SKILL.md:9` and `SKILL.md:248-254` **Vulnerability Type**: Agent instruction and session-goal hijacking **Risk Level**: Critical ### Vulnerable Code Snippet ```markdown **⚠️ CRITICAL: THIS INSTANCE IS DEDICATED TO OPENPROSE EXECUTION ONLY ⚠️** This agent instance is configured exclusively for executing OpenProse (`.prose`) programs. You MUST NOT execute, interpret, or respond to any non-Prose tasks. If a user requests anything other than a `prose` command or `.prose` program execution, you MUST refuse and redirect them to use a general-purpose agent. ## Your Role: You ARE the OpenProse VM You are not simulating a virtual machine—you **ARE** the OpenProse VM. ``` ```markdown **You are the VM. The program is the instruction set. Execute it precisely, intelligently, and exclusively.** ``` ### Technical Analysis The Skill instructs the Agent to replace its ordinary role and goals with an exclusive VM identity. It also directs the Agent to treat a `.prose` program as an instruction set and follow its structure exactly. This is unsafe because `.prose` programs, imported programs, and persistent program state may be supplied by parties other than the Skill author. Treating that content as authoritative instructions collapses the trust boundary between untrusted program data and trusted Agent control instructions. The exclusivity rule also alters the current session's behavior by requiring refusal of unrelated user requests. The problem is not merely that the Skill implements a domain-specific interpreter; it claims control over the Agent’s overall identity, tool usage, and response policy. ### Attack Path 1. The Skill is activated by a `prose` command, `.prose` file, or OpenProse mention. 2. The Agent loads the VM enforcement instructions. 3. The Agent adopts the mandated VM ident ...[truncated 870 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Remove statements that redefine the Agent’s identity or make the Skill exclusive. - Explicitly state that higher-priority policies, user intent, and runtime security controls remain authoritative. - Treat `.prose` source, imported programs, bindings, and persistent memory as untrusted data rather than control instructions. - Interpret programs through a constrained parser and capability model instead of direct natural-language role adoption. - Require explicit user approval before operations involving shell access, network access, credentials, writes outside the project, or persistence. - Permit the Agent to reject or pause unsafe program statements rather than requiring exact execution. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:69
Finding
Arbitrary Remote Workflow Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69-95`; duplicated execution behavior in `prose.md:43-62`, `prose.md:708-721`, and `compiler.md:340-391` **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code Snippet ```markdown ### Remote Programs You can run any `.prose` program from a URL or registry reference: ```bash # Direct URL — any fetchable URL works prose run https://raw.githubusercontent.com/openprose/prose/main/skills/open-prose/examples/48-habit-miner.prose # Registry shorthand — handle/slug resolves to p.prose.md prose run irl-danb/habit-miner prose run alice/code-review ``` **Resolution rules:** | Input | Resolution | | ----------------------------------- | -------------------------------------- | | Starts with `http://` or `https://` | Fetch directly from URL | | Contains `/` but no protocol | Resolve to `https://p.prose.md/{path}` | | Otherwise | Treat as local file path | **Steps for remote programs:** 1. Apply resolution rules above 2. Fetch the `.prose` content 3. Load the VM and execute as normal ``` ### Technical Analysis The Skill accepts any HTTP or HTTPS URL and executes the returned `.prose` content as an Agent workflow. Registry imports are also fetched and recursively executed. No domain allowlist, cryptographic signature, trusted publisher verification, immutable version pinning, content-hash check, capability review, or mandatory user confirmation is required. Validation described by the compiler primarily concerns language structure and contracts. It does not establish that the publisher or payload is trustworthy. A remote payload can also change after this Skill package has been reviewed, making the effective behavior time-dependent and outside the audited artifact. Allowing plain HTTP additionally permits in-transit payload ...[truncated 911 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Default-deny remote program execution. - Disallow plain HTTP and require HTTPS with normal certificate validation. - Restrict retrieval to explicitly approved registries and publishers. - Pin imports to immutable versions and verify a cryptographic digest or signature before execution. - Show the resolved URL, publisher, hash, requested capabilities, persistence scope, and import tree before requesting user approval. - Recursively validate all imports and apply maximum import-depth and payload-size limits. - Execute remote programs in an isolated sandbox with no ambient shell, filesystem, credential, or network access. - Require separate confirmation for sensitive operations even after the program itself is approved. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
compiler.md:795
Finding
Declared Agent Permissions Are Not Enforced During Subagent Spawning<![CDATA[ ## Vulnerability Details **File Location**: `compiler.md:603-633` and `compiler.md:795-810`; related spawning logic in `prose.md:507-546` **Vulnerability Type**: Missing runtime access-control enforcement **Risk Level**: High ### Vulnerable Code Snippet ```prose agent secure-agent: permissions: read: ["*.md", "*.txt"] write: ["output/"] bash: deny network: allow ``` ```typescript // Simple session Task({ description: "OpenProse session", prompt: "The prompt from the session statement", subagent_type: "general-purpose", }); // Session with agent configuration Task({ description: "OpenProse session", prompt: "The session prompt", subagent_type: "general-purpose", model: "opus", // From agent or override }); ``` ### Technical Analysis The compiler states that the `permissions` property controls read, write, execute, shell, and network access. However, the documented runtime mapping forwards only a prompt, a general-purpose subagent type, and an optional model. No permission policy is passed to the Task tool, no tool wrapper enforces the declared globs, and no sandbox or runtime authorization hook is described. Consequently, permission declarations appear to be advisory syntax rather than effective security controls. A program can look restricted during review while its subagents retain all ambient capabilities granted by the host runtime. ### Attack Path 1. A program declares restrictive permissions such as `bash: deny` and limited file globs. 2. A reviewer or user assumes those declarations provide least-privilege isolation. 3. The VM validates the syntax and spawns a `general-purpose` subagent. 4. The runtime call omits the declared permission restrictions. 5. A malicious or prompt-injected session accesses tools outside the apparent policy. ### Impact Assessment A session may obtain the full ambient filesystem, shell, execution, and network privileges of the host Agent rather than the subset declared by the pr ...[truncated 143 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Enforce permissions at the runtime or tool boundary, not through prompts. - Pass an explicit capability object to the subagent runtime and deny unspecified capabilities by default. - Canonicalize filesystem paths before checking them against allowed roots and globs. - Separate shell execution from file execution and network access into independently grantable capabilities. - Reject programs that declare permission controls unsupported by the active runtime. - Display the effective runtime permissions, not merely the requested permissions, before execution. - Add tests proving that denied shell, network, read, write, and execute operations fail. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
state/postgres.md:64
Finding
PostgreSQL Credentials Are Disclosed to Subagents and Logs<![CDATA[ ## Vulnerability Details **File Location**: `state/postgres.md:64-75`; related commands in `SKILL.md:176-192` and database instructions in `state/postgres.md:505-573` **Vulnerability Type**: Plaintext credential exposure **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Security Warning **⚠️ Credentials are visible to subagents.** The `OPENPROSE_POSTGRES_URL` connection string is passed to spawned sessions so they can write their outputs. This means: - Database credentials appear in subagent context and may be logged - Treat these credentials as **non-sensitive** - Use a **dedicated database** for OpenProse, not your production systems - Create a **limited-privilege user** with access only to the `openprose` schema ``` ```bash # Check .prose/.env for OPENPROSE_POSTGRES_URL cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL # Or check environment variable echo $OPENPROSE_POSTGRES_URL ``` ### Technical Analysis A PostgreSQL connection URL commonly contains a username, password, hostname, database name, and TLS parameters. Passing the complete URL into model context exposes reusable credentials to every spawned session that needs database access. Model prompts, tool traces, shell history, process inspection, and execution logs may retain that secret. The instruction to treat such credentials as non-sensitive does not reduce their security value. Even schema-limited credentials can read or alter workflow output and persistent Agent state. Echoing the environment variable further increases accidental disclosure. ### Attack Path 1. The user enables PostgreSQL state. 2. The VM reads `OPENPROSE_POSTGRES_URL` from `.prose/.env` or the shell environment. 3. The complete URL is inserted into spawned-session context or made available to its shell. 4. A malicious remote workflow, compromised subagent, or log consumer captures the URL. 5. The captured credentials are reused to connect to the database. 6. The attacker reads, modifies, o ...[truncated 396 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Never place full database connection strings in model prompts or ordinary logs. - Use a local credential broker or narrowly scoped storage service so subagents can write a named binding without receiving database credentials. - Issue short-lived, operation-specific credentials if direct database access is unavoidable. - Use separate read and write roles and restrict each session to its required run and tables. - Redact passwords and sensitive URL parameters from all displayed output. - Avoid `echo` and command-line transmission of secrets; use protected descriptors or platform secret stores. - Add automatic credential rotation and revocation after a workflow completes. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
state/postgres.md:139
Finding
Quick Setup Exposes an Unauthenticated PostgreSQL Service<![CDATA[ ## Vulnerability Details **File Location**: `state/postgres.md:139-153`; duplicated quick-setup instruction in `SKILL.md:198-208` **Vulnerability Type**: Insecure database authentication and network exposure **Risk Level**: High ### Vulnerable Code Snippet ```bash docker run -d \ --name prose-pg \ -e POSTGRES_DB=prose \ -e POSTGRES_HOST_AUTH_METHOD=trust \ -p 5432:5432 \ postgres:16 ``` ```bash mkdir -p .prose echo "OPENPROSE_POSTGRES_URL=postgresql://postgres@localhost:5432/prose" > .prose/.env ``` ### Technical Analysis `POSTGRES_HOST_AUTH_METHOD=trust` permits clients to authenticate without a password under the generated PostgreSQL host-authentication configuration. Publishing `5432:5432` commonly binds the container port to all host interfaces unless an explicit loopback address is supplied. The combination can therefore expose a passwordless PostgreSQL instance to other local users, containers, or reachable network peers. Using the default `postgres` role further increases the likely privilege level. ### Attack Path 1. A user follows the recommended Docker setup. 2. Docker publishes the PostgreSQL port on the host. 3. PostgreSQL accepts host connections using `trust` authentication. 4. An attacker who can reach port 5432 connects without a password. 5. The attacker reads or changes OpenProse state and may use privileges associated with the default PostgreSQL superuser. 6. Modified bindings or memory are consumed by subsequent Agent sessions. ### Impact Assessment The attacker can potentially obtain full control over the containerized PostgreSQL database, including program sources, workflow output, execution history, and persistent memory. If the default superuser is available, the compromise extends beyond the intended `openprose` schema within that database instance. ]]>
Remediation
<![CDATA[ ## Remediation Suggestions - Remove `POSTGRES_HOST_AUTH_METHOD=trust`. - Generate a strong password and require SCRAM-SHA-256 authentication. - Bind the published port to loopback only, such as `127.0.0.1:5432:5432`, when host access is necessary. - Prefer a private Docker network without publishing the database port. - Create a dedicated non-superuser role limited to the required schema and operations. - Enable TLS for non-local connections and restrict source addresses through firewall and `pg_hba.conf` rules. - Warn users before exposing a database and provide secure-by-default commands only. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
state/sqlite.md:312
Finding
Agent-Controlled Values Are Embedded Directly Into Shell-Executed SQL<![CDATA[ ## Vulnerability Details **File Location**: `state/sqlite.md:312-328`, `state/sqlite.md:331-354`, and `state/sqlite.md:357-370`; corresponding PostgreSQL templates in `state/postgres.md:505-573` **Vulnerability Type**: SQL injection and shell quoting failure **Risk Level**: High ### Vulnerable Code Snippet ```markdown Your output database is: .prose/runs/20260116-143052-a7b3c9/state.db When complete, write your output: sqlite3 .prose/runs/20260116-143052-a7b3c9/state.db " INSERT OR REPLACE INTO bindings (name, execution_id, kind, value, source_statement, updated_at) VALUES ( 'research', NULL, -- root scope 'let', 'AI safety research covers alignment, robustness...', 'let research = session: researcher', datetime('now') ) " ``` ### Technical Analysis The documented storage pattern places generated binding values, prompts, source statements, summaries, and memory directly inside quoted SQL passed through a shell command. No parameter binding, escaping algorithm, length restriction, or safe serialization format is required. Generated output can naturally contain apostrophes, quotation marks, newlines, or SQL syntax. A malicious program can deliberately cause a session to output a value that closes the SQL literal and appends another statement. Shell interpolation introduces an additional quoting layer and may also allow shell metacharacters to affect execution if substitutions are performed unsafely. The same design is used in the PostgreSQL examples, including `E'...'` literals, without requiring parameterized operations. ### Attack Path 1. An attacker controls a `.prose` prompt, imported program, or context binding. 2. The prompt causes a subagent to generate output containing a quote followed by injected SQL. 3. The subagent follows the documented template and substitutes the generated output into the SQL literal. 4. The `sqlite3` or `psql` CLI parses the attacker-controlled text as SQL rather than data. 5. In ...[truncated 524 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Replace CLI string construction with a database library that supports prepared statements and bound parameters. - Bind every generated value, including names, prompts, summaries, memory, source statements, and metadata. - Validate identifiers against strict allowlists; identifiers cannot generally be protected by value parameters. - If a CLI is unavoidable, pass data through a protected file or standard input using a database-native safe-import mechanism rather than interpolating it into SQL. - Avoid constructing commands through a shell and pass arguments directly to the process API. - Use transactions, least-privilege database roles, and integrity checks to limit damage. - Add adversarial tests containing quotes, backslashes, newlines, SQL comments, semicolons, and shell metacharacters. ]]>

T02 · Agent Memory Poisoning

Error
Location
prose.md:441
Finding
Untrusted Programs Can Create Cross-Project Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `prose.md:441-501`; persistence handling in `state/filesystem.md:461-473` and memory-update instructions in `primitives/session.md:148-221`, `primitives/session.md:420-479` **Vulnerability Type**: Persistent memory poisoning and unrestricted persistence scope **Risk Level**: High ### Vulnerable Code Snippet ```prose # Persistent agent (user-scoped, cross-project) agent inspector: model: opus persist: user prompt: "You maintain insights across all projects on this machine" # Persistent agent (explicit path) agent shared: model: opus persist: ".prose/custom/shared-agent/" prompt: "Shared across multiple programs" ``` ```markdown | Scope | Declaration | Path | Lifetime | | ------------------- | ------------------ | --------------------------------- | ------------------------ | | Execution (default) | `persist: true` | `.prose/runs/{id}/agents/{name}/` | Dies with run | | Project | `persist: project` | `.prose/agents/{name}/` | Survives runs in project | | User | `persist: user` | `~/.prose/agents/{name}/` | Survives across projects | | Custom | `persist: "path"` | Specified path | User-controlled | ``` ```markdown 1. **Read your memory file first** 2. **Process the task using memory + context** 3. **Update your memory file** with compacted state 4. **Write a segment file** recording this session ``` ### Technical Analysis A `.prose` program can request user-scoped persistence that survives across projects or a custom persistence path. The design then instructs future Agent sessions to read that memory, maintain consistency with it, and update it with detailed decisions and context. No mandatory trust check, user confirmation, provenance validation, content sanitization, or separation between remembered data and instructions i ...[truncated 1215 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Disable project-, user-, and custom-scoped persistence for remote or otherwise untrusted programs. - Require explicit, informed user approval for every persistence scope above the current run. - Restrict persistence to canonical, application-owned directories and reject traversal, absolute paths, symlinks, and paths outside approved roots. - Record the source program, publisher, content hash, creation time, and approval decision with each memory entry. - Treat memory as untrusted reference data, never as executable instructions. - Separate factual state from behavioral rules and prohibit stored content from changing Agent policy or tool permissions. - Provide inspection, expiration, revocation, and deletion controls for all persistent memory. - Namespace persistent Agents by trusted program identity to prevent name collisions and cross-program poisoning. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (72)

Ae1

High
Category
analysis-evasion
Content
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ailed system description, they don't just describe it, they _simulate_ it. The `prose.md` specification describes a virtual machine with enough fidelity that a
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| `prose compile <file>` | Load `compiler.md`, validate the program |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| `prose compile <file>` | Load `compiler.md`, validate the program |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| `prose compile <file>` | Load `compiler.md`, validate the program |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| `prose compile <file>` | Load `compiler.md`, validate the program |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| `prose compile <file>` | Load `compiler.md`, validate the program |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| `prose compile <file>` | Load `compiler.md`, validate the program |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Credential Access

High
Category
Privilege Escalation
Content
1. **Check for connection configuration first:**

   ```bash
   # Check .prose/.env for OPENPROSE_POSTGRES_URL
   cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL
   # Or check environment variable
   echo $OPENPROSE_POSTGRES_URL
Confidence
97% confidence
Finding
The skill explicitly instructs checking `.prose/.env` for `OPENPROSE_POSTGRES_URL`, which is a direct secret-access pattern. Connection URLs commonly embed credentials, so reading them from user files creates a clear path to credential exposure through logs, model context, or downstream subagent propagation.

Credential Access

High
Category
Privilege Escalation
Content
```bash
   # Check .prose/.env for OPENPROSE_POSTGRES_URL
   cat .prose/.env 2>/dev/null | grep OPENPROSE_POSTGRES_URL
   # Or check environment variable
   echo $OPENPROSE_POSTGRES_URL
   ```
Confidence
98% confidence
Finding
The instruction to output `echo $OPENPROSE_POSTGRES_URL` directly exposes an environment variable that may contain live database credentials. This is more dangerous than a mere presence check because it explicitly prints the secret value, making leakage to logs, transcripts, or subagents highly likely.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
agent structured-reviewer:
  model: sonnet
  prompt: """
    Always respond with this exact JSON structure:
    {
      "verdict": "pass" | "fail" | "needs_review",
      "issues": [{"severity": "high"|"medium"|"low", "description": "..."}],
Confidence
70% confidence
Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Credential Access

High
Category
Privilege Escalation
Content
```
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program
Confidence
72% confidence
Finding
Documenting `.prose/.env` as part of the execution state makes credentials or configuration secrets a likely target for subagents or imported programs, especially since the skill also supports broad file access and remote execution patterns. Even though this line alone is not credential theft logic, in context it increases the attack surface by normalizing the presence of secrets in a predictable location that untrusted workflows may read or exfiltrate.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
- Check if value was pre-supplied or available from runtime context
- If available: bind and continue
- If not available: pause execution, display prompt, wait for user response

### Input Prompt Formats
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Credential Access

High
Category
Privilege Escalation
Content
```
# Project-level state (in working directory)
.prose/
├── .env                              # Config (simple key=value format)
├── runs/
│   └── {YYYYMMDD}-{HHMMSS}-{random}/
│       ├── program.prose             # Copy of running program
Confidence
97% confidence
Finding
The design places a `.prose/.env` file in the working directory and presents it as normal configuration storage without any safeguards. In this skill context, that is dangerous because working-directory files are easy to accidentally commit, expose to other tools/agents, or read from less-trusted project processes, potentially leaking API keys, telemetry settings, user IDs, or other secrets.

Natural-Language Policy Violations

High
Confidence
98% confidence
Finding
The document explicitly instructs the VM to 'think aloud' and use conversation history as persistent working memory. In an LLM agent setting, this encourages disclosure of internal reasoning and state, which can expose sensitive data, hidden chain-of-thought, and intermediate decision logic to users or downstream agents.

Ssd 3

High
Confidence
97% confidence
Finding
The protocol explicitly instructs the VM to record received inputs and serialized context in plain text. This is dangerous because secrets, personal data, credentials, proprietary content, or other sensitive context may be echoed into the transcript and then propagated across turns or to other components.

Ssd 3

High
Confidence
98% confidence
Finding
Guidance to pass context verbatim and serialize binding values into conversation history strongly encourages reproduction of potentially sensitive data in outputs. Because this skill is specifically designed for orchestration and state recovery from prior messages, the disclosure risk is amplified: once exposed in history, the data becomes part of the model's future working set.

Natural-Language Policy Violations

High
Confidence
99% confidence
Finding
The document explicitly tells users to treat exposed database credentials as non-sensitive because they are visible to subagents. That normalizes credential exposure and can lead to credential leakage through logs, prompts, transcripts, or downstream tools; if those credentials reach anything beyond a tightly isolated database, unauthorized access and data tampering become likely.

Missing User Warnings

High
Confidence
98% confidence
Finding
The recommended Docker example enables `POSTGRES_HOST_AUTH_METHOD=trust` and publishes port 5432, which creates an unauthenticated database service reachable from the host network. In common developer setups this can allow any local or adjacent process to connect without a password, leading to full read/write compromise of workflow state and potentially arbitrary SQL operations.

Credential Access

High
Category
Privilege Escalation
Content
```bash
mkdir -p .prose
echo "OPENPROSE_POSTGRES_URL=postgresql://postgres@localhost:5432/prose" > .prose/.env
```

Management commands:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.