GrayMatter

• Outcome: Review
• Latest audit: May 28, 2026 · 8:48 AM UTC
• Version: 0.2.0

Overview

GrayMatter is a disclosed business-memory integration, but it gives an agent broad authenticated access to live organizational data with automatic credential reuse and limited scoping controls.

Install only if you want this agent to use a ValkyrAI account as durable memory and to inspect or create RBAC-permitted business records. Use a dedicated least-privilege account or per-request token, avoid shared admin tokens, confirm which workspace/account Keychain credentials will be reused, and treat entity creation or generic API calls as actions requiring explicit user intent.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs use of powerful capabilities including shell execution, network access, file reads/writes, and environment-variable handling, but it does not declare permissions. This weakens operator visibility and consent, making it easier for a user or host system to grant broad access without understanding that the skill can authenticate, persist data, call remote APIs, and modify local state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The described purpose is memory/schema access, but the skill text also directs packaging local servers, performing credential workflows, opening signup/credit UX, registering agents, and creating arbitrary business entities. That mismatch is dangerous because users may trust the skill for limited memory use while it actually has a much broader operational and data-modifying footprint across a live business API.

Credential Access

High

• Category: Privilege Escalation

Content

- `VALKYR_JWT_SESSION` as a compatible env fallback

Preferred auth behavior is OpenClaw-first:
- check Keychain for `VALKYR_AUTH` first
- if present, reuse it automatically
- otherwise prompt for username/password
- exchange for a `VALKYR_AUTH` token

• Confidence: 84% confidence
• Finding: The skill directs automatic reuse of any existing Keychain token before prompting, which can cause an agent to silently inherit previously stored credentials and act against a live RBAC-scoped business API without fresh user confirmation. In this skill's context, that is more dangerous because the same token enables memory access, schema discovery, agent registration, and business-object operations across organizational data.

Credential Access

High

• Category: Privilege Escalation

Content

- if present, reuse it automatically
- otherwise prompt for username/password
- exchange for a `VALKYR_AUTH` token
- store it in Keychain

If activation can write/read by id and register the agent but semantic memory query is blocked by missing credits, treat that as a degraded startup state rather than total activation failure. Preserve auth, register the agent, sync the schema, and surface that query/list capability is limited until credits are available.

• Confidence: 87% confidence
• Finding: The workflow instructs the skill to prompt for username/password, exchange them for a token, and store that token in Keychain for future automatic use. Handling raw credentials inside a broadly capable skill increases exposure if the surrounding scripts, prompts, shell environment, or logs are compromised, and persistent token storage amplifies the blast radius because the token is reused for future live API operations.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: mcp-server/index.js:649

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: mcp-server/test/server.test.js:139

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: mcp-server/test/server.test.js:142

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/gm_install_check_test.sh:43

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/gm_login_test.sh:169