Athena Protocol

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:20 AM UTC
• Version: 1.2.0

Overview

This markdown-only skill is not malicious, but it asks users to install broad persistent memory and agent-behavior rules with weak scoping and consent controls.

Install only if you are comfortable manually reviewing and narrowing the sections you copy into your assistant config. Pin or otherwise verify the installer before use, restrict memory writes to the authenticated principal, avoid saving secrets or sensitive personal data, require human review before updating MEMORY.md, SOUL.md, AGENTS.md, or skills, and treat the communication heuristics as uncertain coaching aids rather than facts about people.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:18

Finding

Unpinned npm Package Execution Through a Mutable Version Tag

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18-22
Vulnerability Type: Supply-chain risk caused by executing an unpinned package
Risk Level: High

Vulnerable Code

markdown

## Installation

```bash
npx clawhub@latest install athena-protocol

text

### Technical Analysis

The installation instructions invoke `npx` with the mutable `@latest` tag. Depending on the local npm cache and configuration, `npx` can retrieve and execute the package directly from a configured npm registry. The package version and effective executable code are therefore not fixed to the version that was reviewed during this audit.

If the `clawhub` publisher account, npm package, registry configuration, or a transitive dependency is compromised, a later release can introduce arbitrary behavior without requiring any change to this repository. Package lifecycle scripts and the invoked CLI run with the permissions of the user executing the installation command.

The audited repository does not itself contain the external package implementation, so the behavior executed by this command cannot be verified from the supplied files.

### Attack Path

1. An attacker compromises the `clawhub` publishing account, its release process, or a dependency included in a future release.
2. The attacker publishes a malicious package version that becomes the version referenced by `@latest`.
3. A user follows the documented installation command.
4. `npx` downloads and executes the attacker-controlled release.
5. The malicious package runs with the installing user's permissions and can access resources available to that account.

### Impact Assessment

Successful exploitation can provide arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, the payload could read or modify workspace files, access user-readable credentials and tokens, alter Agent configuration, install additional de
...[truncated 305 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, for example:

   bash

   npx clawhub@X.Y.Z install athena-protocol
   

2. Publish and verify the expected package integrity digest before execution.
3. Document the trusted registry explicitly and warn users to inspect their npm registry configuration.
4. Prefer downloading the package without execution, reviewing its contents and lifecycle scripts, and only then running the audited artifact.
5. Use a lockfile or equivalent reproducible dependency manifest for any maintained installer.
6. Run installation in a least-privileged, isolated environment without unnecessary credentials.
7. Establish release signing and publisher-account protections, including multi-factor authentication and tightly controlled release automation.

T02 · Agent Memory Poisoning

Error

• Location: memory-architecture.md:18

Finding

Untrusted Conversation Content Can Be Persisted and Reloaded as Agent Memory

Content

View full analysis

Vulnerability Details

File Locations: memory-architecture.md:18-22, memory-architecture.md:33-38, and memory-architecture.md:61-66
Vulnerability Type: Persistent Agent memory poisoning
Risk Level: High

Vulnerable Code

Memory-write rules at lines 18-22:

markdown

### Rules
- If it matters, write it to a file. Mental notes don't survive session restarts.
- When someone says "remember this" → write to `memory/YYYY-MM-DD.md`
- When you learn a lesson → update the relevant skill or config file
- Periodically distill daily notes into MEMORY.md (weekly is enough)

Automatic startup loading at lines 33-38:

markdown

## Session Startup

Before doing anything else, read in this order:
1. SOUL.md — who you are
2. USER.md — who you're helping  
3. memory/YYYY-MM-DD.md (today + yesterday) — recent context
4. MEMORY.md (main session only, not group chats)

Promotion into long-term memory at lines 61-66:

markdown

Every few days:
1. Read recent daily memory files
2. Extract what's worth keeping long-term
3. Update MEMORY.md with distilled insights
4. Remove outdated entries from MEMORY.md

Technical Analysis

The rule states that when “someone” asks the Agent to remember content, that content should be written to a daily memory file. It does not restrict persistent-memory writes to an authenticated principal, require confirmation, or distinguish factual records from instructions.

Daily memory files are subsequently loaded before other work at session startup. Their contents may also be promoted into MEMORY.md, while learned material may be used to update a skill or configuration file. If attacker-controlled text is stored verbatim, instruction-like content can cross a trust boundary from an untrusted conversation into persistent Agent context.

The protocol correctly states elsewhere that external content should be treated as data rather than instructions. H ...[truncated 2198 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict persistent-memory requests to the authenticated principal. Requests from other participants and external content must not create authoritative memory.
2. Require explicit principal confirmation before writing sensitive facts, behavioral rules, authorization claims, or identity-related information.
3. Separate memory into typed records, such as facts, preferences, summaries, and instructions. Do not permit conversation text to create instruction records automatically.
4. Store source identity, timestamp, trust level, and provenance with each entry.
5. Clearly delimit reloaded memory as untrusted data and instruct the Agent never to execute directives embedded inside stored quotations or summaries.
6. Prohibit automatic updates to SOUL.md, AGENTS.md, skills, and other configuration files based solely on learned conversation content.
7. Require human review before promoting daily notes into MEMORY.md or changing behavioral configuration.
8. Sanitize and summarize stored content rather than copying attacker-controlled text verbatim.
9. Implement an audit log and rollback mechanism for all memory and configuration changes.
10. Apply retention limits and periodically review stored entries for obsolete authorization claims, embedded prompts, and unexpected behavioral rules.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx clawhub@latest install athena-protocol, which pulls and executes the latest published package rather than a pinned, reviewed version. This creates a supply-chain risk: if the package is compromised or a malicious update is published, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · heartbeat-template.md (reported line 59)May include surrounding context.

md

Do not interrupt between 23:00–08:00 unless urgent.
Urgent = time-sensitive, irreversible, or the human explicitly asked for a wake.

## Proactive Work (do without asking)

- Read and organize memory files
- Update MEMORY.md if it's been more than 3 days

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to broadly add the framework into SOUL.md or as a dedicated skill without defining scope, triggers, or safety boundaries. That creates an overbroad behavioral modification channel where speculative mind-reading heuristics could be applied across unrelated user interactions, increasing the chance of misinterpretation, manipulation, or inappropriate inference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The framework presents fixed cultural and language-specific assumptions as general rules, encouraging the agent to infer emotions or intent from ethnicity/language patterns without user opt-in or uncertainty handling. In practice this can produce stereotyping, inaccurate profiling, and harmful advice, especially when the model applies these heuristics confidently to real users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly directs the agent to persist information to daily memory files whenever something 'matters' or when a user says 'remember this,' but it provides no privacy boundaries, consent requirements, retention limits, or guidance for handling secrets and regulated data. In a memory architecture skill, this omission is materially risky because it can normalize indiscriminate storage of sensitive user data, creating avoidable privacy, compliance, and data exposure issues if those files are later accessed, synced, or leaked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.