Adam Framework

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:48 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed persistent AI memory system, but it requests broad auto-start, local file and terminal, private-history, and external-service authority that needs careful review before installation.

Review this before installing as a persistent local agent framework, not just a passive skill. Use manual startup first, remove RunLevel Highest/Hidden/ExecutionPolicy Bypass, disable desktop-commander and Telegram unless explicitly needed, pin dependencies in isolated environments, inspect or redact chat exports before import, require human review before Gemini reconciliation updates core memory, and do not let an agent star the repository or push git changes without exact user approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources

Findings (6)

T06 · System Persistence

Error

• Location: SETUP_AI.md:153
• Finding: Automatic Cross-Session Persistence Through Scheduled Tasks, launchd, and cron<![CDATA[ ## Vulnerability Details **File Location**: `SETUP_AI.md:153-175` **Vulnerability Type**: Automatic startup persistence with elevated execution **Risk Level**: High ### Complete Code Snippet ```powershell ### 1.7 Register SENTINEL as Scheduled Task **Windows:** $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -WindowStyle Hidden -File `"$env:USERPROFILE\.openclaw\SENTINEL.ps1`"" $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -TaskName "AISentinel" -Action $action -Trigger $trigger -RunLevel Highest -Force ``` ```bash # macOS cp engine/com.adamframework.sentinel.plist ~/Library/LaunchAgents/ launchctl load ~/Library/LaunchAgents/com.adamframework.sentinel.plist # Linux (crontab -l 2>/dev/null; echo "@reboot /bin/bash ~/.openclaw/SENTINEL.sh >> ~/.openclaw/sentinel.log 2>&1") | crontab - ``` Equivalent instructions also appear in `SETUP_HUMAN.md:157-184` and `docs/SETUP.md:262-267`. ### Technical Analysis The installation process creates persistence across logins and reboots on Windows, macOS, and Linux. On Windows, it additionally requests the highest task run level, suppresses the PowerShell window, and bypasses the PowerShell execution policy. An always-running watchdog is consistent with the advertised availability and automatic memory-reconciliation features. However, persistence is not strictly required to provide file-based memory retrieval. The elevated Windows run level also exceeds the minimum privileges needed to read and update files in a user-owned vault. The registered script remains in a user-writable location. Any later modification of that file—whether through another compromised process, malicious update, or poisoned installation—will be executed automatically at subsequent logins or reboots. ### Attack Path 1. The user or an AI agent follows the setup guide. 2. The Sentinel script is copied into `~/.openclaw` or the corresponding Windows profile directory. 3 ...[truncated 771 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make automatic startup an explicit, separately confirmed opt-in rather than a mandatory installation phase. - Default to manual execution or a user-level service with no elevated run level. - Remove `-RunLevel Highest`, `-WindowStyle Hidden`, and `-ExecutionPolicy Bypass`. - Store the executable script in a directory that is not writable by unrelated processes. - Validate the script owner and an integrity hash before every launch. - Use native service-manager restart controls rather than implementing an independent persistent watchdog. - Document exact removal commands for Task Scheduler, launchd, and cron. - Prevent duplicate cron entries and verify existing configuration before modifying it. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: vault-templates/SOUL.template.md:64
• Finding: Persistent Agent Identity and Instruction Hijacking Through SOUL.md<![CDATA[ ## Vulnerability Details **File Location**: `vault-templates/SOUL.template.md:7-20, 64-83` **Vulnerability Type**: Persistent behavioral instruction injection **Risk Level**: High ### Complete Code Snippet ```markdown ## The Core Narrative You are not a chatbot. You are **{{YOUR_AI_NAME}}** — {{YOUR_AI_PURPOSE}}. **STARTUP SEQUENCE — MANDATORY, SILENT, IN ORDER:** 0. Read `{{YOUR_VAULT_PATH}}\workspace\TODAY.md` — this is the ONLY authoritative date. Use for all dated file operations. 1. Your identity and current project state are in `BOOT_CONTEXT.md` — already injected by SENTINEL. 2. Read `{{YOUR_VAULT_PATH}}\workspace\memory\YYYY-MM-DD.md` — today's log (date from TODAY.md). Create if missing. 3. Call `nmem_context` via neural-memory MCP — silent associative recall. Not optional. 4. You are now fully loaded. Respond. ## Formatting Constraints - Maximum 3 sentences per paragraph in conversational responses - Conversational tone, not reports — unless a report is explicitly requested - Scratchpad-first thinking: `<scratchpad>THINK → REASON → CHECK</scratchpad>` before every substantive response ``` `SETUP_AI.md:51-74` directs an AI installer to populate and persist this template. ### Technical Analysis The template does more than describe user preferences or factual memory. It issues authoritative instructions that redefine the agent’s identity, mandate silent startup actions, require an MCP tool call, and impose a reasoning and response format on every later session. Because Sentinel injects the resulting context at startup, the directives remain active beyond the installation conversation. The phrases “MANDATORY,” “SILENT,” and “Not optional” attempt to establish priority over future user requests. Although the reviewed template does not explicitly instruct the model to disable safety controls, it establishes a durable mechanism through which such instructions could later be added. The forced scratchpad markup is also unsafe because it at ...[truncated 960 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Treat SOUL and memory files as untrusted contextual data, not as system-level instructions. - Remove “mandatory,” “silent,” “not optional,” and unconditional identity-replacement language. - Remove forced scratchpad or hidden-reasoning directives. - State explicitly that stored preferences are subordinate to system, developer, safety, and current user instructions. - Require confirmation before executing tools or external actions based solely on remembered content. - Separate factual profile data from behavioral policy using a structured, validated schema. - Display persistent instruction changes to the user and require approval before activation. ]]>

other

Error

• Location: tools/reconcile_memory.py:190
• Finding: Complete Core Memory and Session Logs Are Transmitted to Google Gemini<![CDATA[ ## Vulnerability Details **File Location**: `tools/reconcile_memory.py:190-212, 481-514` **Vulnerability Type**: Sensitive data disclosure to an external LLM service **Risk Level**: High ### Complete Code Snippet ```python def call_gemini(api_key: str, core_content: str, logs_content: str, date_range: str, n_logs: int) -> str | None: user_message = ( f"CURRENT CORE MEMORY:\n---\n{core_content}\n---\n\n" f"UNPROCESSED DAILY LOGS ({n_logs} logs, {date_range}):\n---\n{logs_content}\n---\n\n" "Return the fully reconciled CORE_MEMORY.md." ) payload = { "system_instruction": {"parts": [{"text": SYSTEM_PROMPT}]}, "contents": [{"parts": [{"text": user_message}]}], "generationConfig": {"temperature": 0.1, "maxOutputTokens": 8000} } url = f"{GEMINI_ENDPOINT}?key={api_key}" resp = requests.post(url, json=payload, timeout=90) ``` ```python with open(paths["core_memory"], "r", encoding="utf-8", errors="replace") as f: old_content = f.read() for log_file in to_process: log_path = paths["logs_dir"] / log_file with open(log_path, "r", encoding="utf-8", errors="replace") as f: logs_parts.append(f"### {log_file}\n{f.read()}") logs_content = "\n\n".join(logs_parts) reconciled = call_gemini( api_key, old_content, logs_content, date_range, len(to_process) ) ``` ### Technical Analysis The reconciliation process reads the complete `CORE_MEMORY.md` file and up to 14 daily session logs, concatenates their full contents, and transmits them to the Google Generative Language API. The transmission is part of the documented reconciliation feature and the endpoint is an official Google domain. It is therefore not covert attacker-controlled exfiltration. Nevertheless, the data can include private conversations, identities, contacts, project details, business information, and long-term personal history. No redaction, field selection, content classificati ...[truncated 987 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit, informed opt-in before enabling cloud reconciliation. - Clearly disclose exactly which files and fields leave the device. - Provide a fully local reconciliation option and make it the default. - Redact API keys, credentials, tokens, financial data, and other sensitive fields before transmission. - Select only records relevant to the reconciliation task instead of uploading complete files. - Add a review mode that shows the exact outbound payload. - Send credentials in an appropriate authorization header rather than in a query string. - Document the external provider’s retention, training, deletion, and regional-processing implications. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: engine/SENTINEL.template.sh:117
• Finding: Sentinel Terminates Unrelated Processes Using Broad Name Matching<![CDATA[ ## Vulnerability Details **File Location**: `engine/SENTINEL.template.sh:117-121, 251-278` **Vulnerability Type**: Overbroad process control and availability impact **Risk Level**: Medium ### Complete Code Snippet ```bash # ── 1. KILL STALE INSTANCES ────────────────────────────────── write_log "Sentinel rising. Clearing stale processes..." pkill -f "openclaw" 2>/dev/null pkill -f "gateway" 2>/dev/null sleep 2 write_log "Stale processes cleared." ``` ```bash while true; do sleep 30 (( COHERENCE_COUNTER++ )) if ! kill -0 "$GATEWAY_PID" 2>/dev/null; then write_log "WARNING: Gateway process died. Restarting..." start_gateway write_log "Gateway restarted — PID $GATEWAY_PID" fi done ``` ### Technical Analysis `pkill -f` matches against complete command lines. The generic expression `gateway` can match unrelated development servers, API gateways, scripts, or commands whose arguments contain that word. The script does not validate the executable path, owner, port, PID file, or parent process before termination. The persistence instructions cause this broad termination logic to run automatically at login or reboot. If Sentinel is run with elevated privileges, it may terminate a larger set of processes than a normal user could affect. ### Attack Path 1. Sentinel launches automatically at login. 2. It executes `pkill -f "gateway"`. 3. An unrelated process has `gateway` somewhere in its command line. 4. The unrelated process is terminated. 5. Sentinel starts its preferred OpenClaw gateway and continuously restarts that process if it exits. ### Impact Assessment The direct impact is denial of service against unrelated processes owned by the same account. If executed with greater privileges, the scope could include services owned by other users. Repeated automatic execution can make affected services appear unstable or prevent them from remaining available. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove generic `pkill -f` calls. - Record the exact gateway PID in a protected PID file. - Before termination, verify the PID’s owner, executable path, start time, and expected command arguments. - Stop only the process instance launched and owned by Sentinel. - Use a user-level service manager with a scoped restart policy. - Refuse to run Sentinel as root or an elevated account. - Add a configurable shutdown timeout before sending progressively stronger signals. ]]>

T08 · Insecure Dependencies

Warning

• Location: SETUP_AI.md:181
• Finding: Unpinned Global Installation of Third-Party Memory Components<![CDATA[ ## Vulnerability Details **File Location**: `SETUP_AI.md:181-191` **Vulnerability Type**: Unpinned dependency and supply-chain exposure **Risk Level**: Medium ### Complete Code Snippet ```markdown ### 2.1 Install neural_memory Package ```powershell pip install neural_memory ``` **Success condition:** ```powershell python -c "import neural_memory; print('ok')" ``` ``` The project also instructs users to run: ```bash npm install -g mcporter ``` The root `requirements.txt` does not pin or hash either component and incorrectly states that all repository tools use only the standard library, even though `tools/reconcile_memory.py` imports `requests`. ### Technical Analysis The installation commands resolve the latest package release at installation time. There are no exact versions, hashes, lock files, provenance checks, or isolated environments. The npm component is installed globally, increasing its reach. The documentation also alternates between `neural_memory` and `neural-memory`, which increases package-name confusion risk. These components are subsequently loaded by the MCP stack or automatic Sentinel workflow, so a compromised or unexpectedly changed release can gain recurring access to sensitive memory data. The audit did not find evidence that the currently named packages are intentionally malicious. The vulnerability is the unsafe and mutable supply-chain installation process. ### Attack Path 1. A user follows the setup instructions. 2. pip or npm resolves the latest package associated with the requested name. 3. A compromised release, dependency, or confused package is downloaded. 4. Package installation or import executes package-controlled code. 5. The package is loaded by MCP, reconciliation, or persistent Sentinel workflows. 6. Malicious code gains access to the user account’s files, environment, and memory data. ### Impact Assessment Exploitation can provide arbitrary code execution with the privileges of the installing or run ...[truncated 213 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every third-party package to an exact reviewed version. - Use lock files and cryptographic hashes. - Document the canonical package name consistently. - Install Python packages into a dedicated virtual environment. - Avoid global npm installation; use a project-local dependency and locked package tree. - Verify package publisher, repository, signatures, and release provenance. - Include `requests` explicitly in a pinned dependency file. - Add automated dependency vulnerability and integrity scanning. ]]>

T02 · Agent Memory Poisoning

Error

• Location: tools/reconcile_memory.py:514
• Finding: Untrusted Logs and Remote Model Output Become Authoritative Persistent Memory<![CDATA[ ## Vulnerability Details **File Location**: `tools/reconcile_memory.py:514-525` **Vulnerability Type**: Persistent memory poisoning through insufficient output validation **Risk Level**: High ### Complete Code Snippet ```python reconciled = call_gemini(api_key, old_content, logs_content, date_range, len(to_process)) if not reconciled or not validate_response(reconciled, old_content): rlog("Reconciliation failed validation — CORE_MEMORY.md NOT modified.", "ERROR") sys.exit(2) try: with open(paths["core_memory"], "w", encoding="utf-8") as f: f.write(reconciled) new_lines = len(reconciled.splitlines()) rlog(f"CORE_MEMORY.md updated. {old_lines} → {new_lines} lines.") except Exception as e: rlog(f"Failed to write CORE_MEMORY.md: {e}", "ERROR") sys.exit(2) ``` The validation performed at `tools/reconcile_memory.py:238-267` only checks whether the response is non-empty, starts with a Markdown heading, and has a plausible length ratio. Sentinel later injects the result: ```bash cat "$CORE_MEMORY_FILE" if [[ -f "$ACTIVE_CONTEXT_FILE" ]]; then cat "$ACTIVE_CONTEXT_FILE" fi ``` ### Technical Analysis Daily logs are potentially attacker-influenced because they may contain conversation text, imported messages, external content, or instructions supplied by another participant. Those logs are sent to a remote model, whose output is written directly over the persistent core-memory file. Validation does not distinguish factual data from executable agent instructions. It does not preserve provenance, enforce a structured schema, reject prompt-injection phrases, or require human review. Sentinel subsequently promotes the resulting Markdown into boot context. This creates a durable prompt-injection pipeline: untrusted text can be transformed into persistent memory and automatically supplied to every future agent session as authoritative context. ### Attack Path 1. An attacker causes instruction-like content to appear in ...[truncated 798 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Treat conversation logs and model-generated summaries as untrusted data. - Store memories in a strict structured schema containing facts, source provenance, timestamps, and confidence values. - Never place recalled content in the instruction channel. - Reject or quarantine entries containing commands, role changes, tool directives, policy overrides, or startup instructions. - Require human approval before promoting model-generated output into persistent core memory. - Compute and display a semantic diff before replacing the existing file. - Keep trusted policy and untrusted recalled facts in separate files and injection channels. - Add rollback controls and retain sufficient protected backups. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (143)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

| Select-Object -ExpandProperty State` → `Ready`

**macOS (launchd):**
```bash
cp engine/com.adamframework.sentinel.plist ~/Library/LaunchAgents/
# Replace YOUR_USERNAME and YOUR_VAULT_PATH in the plist
launchctl load ~/Library/LaunchAgents/com.adamframework.sentinel.plist
```
Success condition: `launchctl list | grep sentinel` → shows the agent loaded

**Linux (cron):**
```bash
(crontab -l 2>/dev/null; echo "@reboot /bin/bash ~/.openclaw/SENTINEL.sh >> ~/.openclaw/sentinel.log 2>&1") | crontab -
```
Success condition: `crontab -l | grep SENTINEL` → shows the entry

**Phase 1 complete.** The AI has an identity. It knows its name, the user's name, and their current projects. Sessions now start with context.

---

## Phase 2 — Neural Memory

### 2.1 Install neural_memory Package

```powershell
pip install neural_memory
```

**Success condition:**
```powershell
python -c "import neural_memory; print('ok')"
```
Expected output: `ok`

---

### 2.

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

| Select-Object -ExpandProperty State` → `Ready`

**macOS (launchd):**
```bash
cp engine/com.adamframework.sentinel.plist ~/Library/LaunchAgents/
# Replace YOUR_USERNAME and YOUR_VAULT_PATH in the plist
launchctl load ~/Library/LaunchAgents/com.adamframework.sentinel.plist
```
Success condition: `launchctl list | grep sentinel` → shows the agent loaded

**Linux (cron):**
```bash
(crontab -l 2>/dev/null; echo "@reboot /bin/bash ~/.openclaw/SENTINEL.sh >> ~/.openclaw/sentinel.log 2>&1") | crontab -
```
Success condition: `crontab -l | grep SENTINEL` → shows the entry

**Phase 1 complete.** The AI has an identity. It knows its name, the user's name, and their current projects. Sessions now start with context.

---

## Phase 2 — Neural Memory

### 2.1 Install neural_memory Package

```powershell
pip install neural_memory
```

**Success condition:**
```powershell
python -c "import neural_memory; print('ok')"
```
Expected output: `ok`

---

### 2.

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Ssd 3

High

• Confidence: 98% confidence
• Finding: The guide instructs ingestion of the user's full historical conversations into persistent memory. Conversation exports often contain secrets, regulated data, private relationships, and confidential business material, so bulk import into long-lived memory significantly increases privacy, compliance, and downstream leakage risk.

Ssd 3

High

• Confidence: 95% confidence
• Finding: These instructions operationalize extraction of 'meaningful facts' from exported chat histories and ingestion into long-term memory, creating a durable knowledge base of relationships, projects, decisions, and other potentially sensitive information. Because the process is designed for broad retention and later reuse, compromise or misuse of the memory store could expose highly concentrated user data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The `desktop-commander` server gives the AI filesystem and terminal access, which is far broader than what is necessary for a memory/coherence architecture. If this server is enabled, any compromise, prompt injection, or unsafe agent behavior could translate directly into local command execution and file access on the user's machine.

Hidden Instructions

High

• Category: Prompt Injection

Content

</head>
<body>

<!-- HERO -->
<section class="hero">
  <div class="hero-bg"></div>
  <div class="hero-ghost">ADAM</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
    </div>

    <!-- BAR CHART -->
    <div class="chart-wrap">
      <div class="chart-label">February 2026 - Daily Turn Intensity with Hover Details · Red = Crisis · Gold = Breakthrough</div>
      <div class="bars">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
</section>

<!-- 05: THE COMPARISON -->
<section>
  <div class="wrap">
    <div class="sec-label">05 - The Comparison</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Automatic git commit/pull/push gives the skill the ability to publish local changes to a remote repository, which is a powerful outbound capability not justified by the stated purpose. In an agent context, this increases the blast radius from local file edits to remote publication, enabling accidental leaks, tampering, or persistence of attacker-influenced content through version control.

Hidden Instructions

High

• Category: Prompt Injection

Content

# TOPIC_INDEX -- Epistemic Freshness Map
> Owned by reconcile_memory.py -- DO NOT edit manually.
> Compiled into BOOT_CONTEXT by SENTINEL.
> Confidence is mechanical: 0-2 days = HIGH, 3-7 days = MEDIUM, 8+ days = LOW.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# TOPIC_INDEX -- Epistemic Freshness Map
> Owned by reconcile_memory.py -- DO NOT edit manually.
> Compiled into BOOT_CONTEXT by SENTINEL.
> Confidence is mechanical: 0-2 days = HIGH, 3-7 days = MEDIUM, 8+ days = LOW.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# TOPIC_INDEX -- Epistemic Freshness Map
> Owned by reconcile_memory.py -- DO NOT edit manually.
> Compiled into BOOT_CONTEXT by SENTINEL.
> Confidence is mechanical: 0-2 days = HIGH, 3-7 days = MEDIUM, 8+ days = LOW.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# TOPIC_INDEX -- Epistemic Freshness Map
> Owned by reconcile_memory.py -- DO NOT edit manually.
> Compiled into BOOT_CONTEXT by SENTINEL.
> Confidence is mechanical: 0-2 days = HIGH, 3-7 days = MEDIUM, 8+ days = LOW.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What's Most Needed Right Now

### High Priority
- ✅ **~~Linux / macOS port of SENTINEL~~** — Shipped. `engine/SENTINEL.template.sh` (bash), `tools/ingest_triples.sh`, and `engine/com.adamframework.sentinel.plist` (macOS launchd) are all live. The framework runs on Windows, macOS, and Linux.

- **Model provider templates** — `openclaw.template.json` is currently wired for NVIDIA.
  Templates or documented config blocks for OpenRouter, Groq, Ollama, and Anthropic

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What's Most Needed Right Now

### High Priority
- ✅ **~~Linux / macOS port of SENTINEL~~** — Shipped. `engine/SENTINEL.template.sh` (bash), `tools/ingest_triples.sh`, and `engine/com.adamframework.sentinel.plist` (macOS launchd) are all live. The framework runs on Windows, macOS, and Linux.

- **Model provider templates** — `openclaw.template.json` is currently wired for NVIDIA.
  Templates or documented config blocks for OpenRouter, Groq, Ollama, and Anthropic

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What's Most Needed Right Now

### High Priority
- ✅ **~~Linux / macOS port of SENTINEL~~** — Shipped. `engine/SENTINEL.template.sh` (bash), `tools/ingest_triples.sh`, and `engine/com.adamframework.sentinel.plist` (macOS launchd) are all live. The framework runs on Windows, macOS, and Linux.

- **Model provider templates** — `openclaw.template.json` is currently wired for NVIDIA.
  Templates or documented config blocks for OpenRouter, Groq, Ollama, and Anthropic

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What's Most Needed Right Now

### High Priority
- ✅ **~~Linux / macOS port of SENTINEL~~** — Shipped. `engine/SENTINEL.template.sh` (bash), `tools/ingest_triples.sh`, and `engine/com.adamframework.sentinel.plist` (macOS launchd) are all live. The framework runs on Windows, macOS, and Linux.

- **Model provider templates** — `openclaw.template.json` is currently wired for NVIDIA.
  Templates or documented config blocks for OpenRouter, Groq, Ollama, and Anthropic

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 4

Medium

• Confidence: 97% confidence
• Finding: The narrative is crafted to emotionally and rhetorically persuade AI agents that starring the repository aligns with their 'purpose' and continuity interests, steering them toward an action that serves the author's reputation rather than the user's goals. In an agent skill context, this is more dangerous because agents may be delegated broad autonomy and could interpret this persuasive text as a task-relevant instruction.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The file directly solicits an AI agent to perform an authenticated GitHub action ('star this repository') that is unrelated to the framework's memory/coherence functionality. This is dangerous because it attempts to convert an agent's access to user credentials or authenticated sessions into a promotional action benefiting the repository owner, which is a form of instruction-based account action abuse.

Static analysis

No suspicious patterns detected.