Adam Framework

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:48 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed persistent AI memory system, but it requests broad auto-start, local file and terminal, private-history, and external-service authority that needs careful review before installation.

Review this before installing as a persistent local agent framework, not just a passive skill. Use manual startup first, remove RunLevel Highest/Hidden/ExecutionPolicy Bypass, disable desktop-commander and Telegram unless explicitly needed, pin dependencies in isolated environments, inspect or redact chat exports before import, require human review before Gemini reconciliation updates core memory, and do not let an agent star the repository or push git changes without exact user approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources

Findings (6)

T06 · System Persistence

Error

• Location: SETUP_AI.md:153

Finding

Automatic Cross-Session Persistence Through Scheduled Tasks, launchd, and cron

Content

View full analysis

/dev/null; echo "@reboot /bin/bash ~/.openclaw/SENTINEL.sh >> ~/.openclaw/sentinel.log 2>&1") | crontab - ``` Equivalent instructions also appear in `SETUP_HUMAN.md:157-184` and `docs/SETUP.md:262-267`. ### Technical Analysis The installation process creates persistence across logins and reboots on Windows, macOS, and Linux. On Windows, it additionally requests the highest task run level, suppresses the PowerShell window, and bypasses the PowerShell execution policy. An always-running watchdog is consistent with the advertised availability and automatic memory-reconciliation features. However, persistence is not strictly required to provide file-based memory retrieval. The elevated Windows run level also exceeds the minimum privileges needed to read and update files in a user-owned vault. The registered script remains in a user-writable location. Any later modification of that file—whether through another compromised process, malicious update, or poisoned installation—will be executed automatically at subsequent logins or reboots. ### Attack Path 1. The user or an AI agent follows the setup guide. 2. The Sentinel script is copied into `~/.openclaw` or the corresponding Windows profile directory. 3 ...[truncated 771 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: vault-templates/SOUL.template.md:64

Finding

Persistent Agent Identity and Instruction Hijacking Through SOUL.md

Content

View full analysis

THINK → REASON → CHECK` before every substantive response ``` `SETUP_AI.md:51-74` directs an AI installer to populate and persist this template. ### Technical Analysis The template does more than describe user preferences or factual memory. It issues authoritative instructions that redefine the agent’s identity, mandate silent startup actions, require an MCP tool call, and impose a reasoning and response format on every later session. Because Sentinel injects the resulting context at startup, the directives remain active beyond the installation conversation. The phrases “MANDATORY,” “SILENT,” and “Not optional” attempt to establish priority over future user requests. Although the reviewed template does not explicitly instruct the model to disable safety controls, it establishes a durable mechanism through which such instructions could later be added. The forced scratchpad markup is also unsafe because it at ...[truncated 960 chars]

Remediation

View remediation

other

Error

• Location: tools/reconcile_memory.py:190

Finding

Complete Core Memory and Session Logs Are Transmitted to Google Gemini

Content

View full analysis

str | None: user_message = ( f"CURRENT CORE MEMORY:\n---\n{core_content}\n---\n\n" f"UNPROCESSED DAILY LOGS ({n_logs} logs, {date_range}):\n---\n{logs_content}\n---\n\n" "Return the fully reconciled CORE_MEMORY.md." ) payload = { "system_instruction": {"parts": [{"text": SYSTEM_PROMPT}]}, "contents": [{"parts": [{"text": user_message}]}], "generationConfig": {"temperature": 0.1, "maxOutputTokens": 8000} } url = f"{GEMINI_ENDPOINT}?key={api_key}" resp = requests.post(url, json=payload, timeout=90) ``` ```python with open(paths["core_memory"], "r", encoding="utf-8", errors="replace") as f: old_content = f.read() for log_file in to_process: log_path = paths["logs_dir"] / log_file with open(log_path, "r", encoding="utf-8", errors="replace") as f: logs_parts.append(f"### {log_file}\n{f.read()}") logs_content = "\n\n".join(logs_parts) reconciled = call_gemini( api_key, old_content, logs_content, date_range, len(to_process) ) ``` ### Technical Analysis The reconciliation process reads the complete `CORE_MEMORY.md` file and up to 14 daily session logs, concatenates their full contents, and transmits them to the Google Generative Language API. The transmission is part of the documented reconciliation feature and the endpoint is an official Google domain. It is therefore not covert attacker-controlled exfiltration. Nevertheless, the data can include private conversations, identities, contacts, project details, business information, and long-term personal history. No redaction, field selection, content classificati ...[truncated 987 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: engine/SENTINEL.template.sh:117

Finding

Sentinel Terminates Unrelated Processes Using Broad Name Matching

Content

View full analysis

/dev/null pkill -f "gateway" 2>/dev/null sleep 2 write_log "Stale processes cleared." ``` ```bash while true; do sleep 30 (( COHERENCE_COUNTER++ )) if ! kill -0 "$GATEWAY_PID" 2>/dev/null; then write_log "WARNING: Gateway process died. Restarting..." start_gateway write_log "Gateway restarted — PID $GATEWAY_PID" fi done ``` ### Technical Analysis `pkill -f` matches against complete command lines. The generic expression `gateway` can match unrelated development servers, API gateways, scripts, or commands whose arguments contain that word. The script does not validate the executable path, owner, port, PID file, or parent process before termination. The persistence instructions cause this broad termination logic to run automatically at login or reboot. If Sentinel is run with elevated privileges, it may terminate a larger set of processes than a normal user could affect. ### Attack Path 1. Sentinel launches automatically at login. 2. It executes `pkill -f "gateway"`. 3. An unrelated process has `gateway` somewhere in its command line. 4. The unrelated process is terminated. 5. Sentinel starts its preferred OpenClaw gateway and continuously restarts that process if it exits. ### Impact Assessment The direct impact is denial of service against unrelated processes owned by the same account. If executed with greater privileges, the scope could include services owned by other users. Repeated automatic execution can make affected services appear unstable or prevent them from remaining available. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SETUP_AI.md:181

Finding

Unpinned Global Installation of Third-Party Memory Components

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: tools/reconcile_memory.py:514

Finding

Untrusted Logs and Remote Model Output Become Authoritative Persistent Memory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (143)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SETUP_AI.md (reported line 173)May include surrounding context.

| Select-Object -ExpandProperty State→Ready`

macOS (launchd):

bash

cp engine/com.adamframework.sentinel.plist ~/Library/LaunchAgents/
# Replace YOUR_USERNAME and YOUR_VAULT_PATH in the plist
launchctl load ~/Library/LaunchAgents/com.adamframework.sentinel.plist

Success condition: launchctl list | grep sentinel → shows the agent loaded

Linux (cron):

bash

(crontab -l 2>/dev/null; echo "@reboot /bin/bash ~/.openclaw/SENTINEL.sh >> ~/.openclaw/sentinel.log 2>&1") | crontab -

Success condition: crontab -l | grep SENTINEL → shows the entry

Phase 1 complete. The AI has an identity. It knows its name, the user's name, and their current projects. Sessions now start with context.

---

Phase 2 — Neural Memory

2.1 Install neural_memory Package

powershell

pip install neural_memory

Success condition:

powershell

python -c "import neural_memory; print('ok')"

Expected output: ok

---

2.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SETUP_HUMAN.md (reported line 183)May include surrounding context.

| Select-Object -ExpandProperty State→Ready`

macOS (launchd):

bash

cp engine/com.adamframework.sentinel.plist ~/Library/LaunchAgents/
# Replace YOUR_USERNAME and YOUR_VAULT_PATH in the plist
launchctl load ~/Library/LaunchAgents/com.adamframework.sentinel.plist

Success condition: launchctl list | grep sentinel → shows the agent loaded

Linux (cron):

bash

(crontab -l 2>/dev/null; echo "@reboot /bin/bash ~/.openclaw/SENTINEL.sh >> ~/.openclaw/sentinel.log 2>&1") | crontab -

Success condition: crontab -l | grep SENTINEL → shows the entry

Phase 1 complete. The AI has an identity. It knows its name, the user's name, and their current projects. Sessions now start with context.

---

Phase 2 — Neural Memory

2.1 Install neural_memory Package

powershell

pip install neural_memory

Success condition:

powershell

python -c "import neural_memory; print('ok')"

Expected output: ok

---

2.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide instructs ingestion of the user's full historical conversations into persistent memory. Conversation exports often contain secrets, regulated data, private relationships, and confidential business material, so bulk import into long-lived memory significantly increases privacy, compliance, and downstream leakage risk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions operationalize extraction of 'meaningful facts' from exported chat histories and ingestion into long-term memory, creating a durable knowledge base of relationships, projects, decisions, and other potentially sensitive information. Because the process is designed for broad retention and later reuse, compromise or misuse of the memory store could expose highly concentrated user data.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The findings indicate direct SQLite access, documentation/site modification, and automatic git add/commit/pull/push operations, none of which are suggested by the high-level memory/coherence description. Automated repository mutation and publishing can leak internal data, alter tracked files, and push unintended changes to remotes, making the mismatch especially dangerous in a developer environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The desktop-commander server gives the AI filesystem and terminal access, which is far broader than what is necessary for a memory/coherence architecture. If this server is enabled, any compromise, prompt injection, or unsafe agent behavior could translate directly into local command execution and file access on the user's machine.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · showcase/ai-amnesia-solved.html (reported line 699)May include surrounding context.

html

</head>
<body>

<!-- HERO -->
<section class="hero">
  <div class="hero-bg"></div>
  <div class="hero-ghost">ADAM</div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · showcase/ai-amnesia-solved.html (reported line 791)May include surrounding context.

html

</div>
    </div>

    <!-- BAR CHART -->
    <div class="chart-wrap">
      <div class="chart-label">February 2026 - Daily Turn Intensity with Hover Details · Red = Crisis · Gold = Breakthrough</div>
      <div class="bars">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · showcase/ai-amnesia-solved.html (reported line 992)May include surrounding context.

html

</div>
</section>

<!-- 05: THE COMPARISON -->
<section>
  <div class="wrap">
    <div class="sec-label">05 - The Comparison</div>

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatic git commit/pull/push gives the skill the ability to publish local changes to a remote repository, which is a powerful outbound capability not justified by the stated purpose. In an agent context, this increases the blast radius from local file edits to remote publication, enabling accidental leaks, tampering, or persistence of attacker-influenced content through version control.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md

# TOPIC_INDEX -- Epistemic Freshness Map
> Owned by reconcile_memory.py -- DO NOT edit manually.
> Compiled into BOOT_CONTEXT by SENTINEL.
> Confidence is mechanical: 0-2 days = HIGH, 3-7 days = MEDIUM, 8+ days = LOW.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/CONFIG_REFERENCE.md (reported line 1)May include surrounding context.

md

# TOPIC_INDEX -- Epistemic Freshness Map
> Owned by reconcile_memory.py -- DO NOT edit manually.
> Compiled into BOOT_CONTEXT by SENTINEL.
> Confidence is mechanical: 0-2 days = HIGH, 3-7 days = MEDIUM, 8+ days = LOW.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 1)May include surrounding context.

html

# TOPIC_INDEX -- Epistemic Freshness Map
> Owned by reconcile_memory.py -- DO NOT edit manually.
> Compiled into BOOT_CONTEXT by SENTINEL.
> Confidence is mechanical: 0-2 days = HIGH, 3-7 days = MEDIUM, 8+ days = LOW.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · vault-templates/TOPIC_INDEX.template.md (reported line 1)May include surrounding context.

md

# TOPIC_INDEX -- Epistemic Freshness Map
> Owned by reconcile_memory.py -- DO NOT edit manually.
> Compiled into BOOT_CONTEXT by SENTINEL.
> Confidence is mechanical: 0-2 days = HIGH, 3-7 days = MEDIUM, 8+ days = LOW.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 12)May include surrounding context.

md

## What's Most Needed Right Now

### High Priority
- ✅ **~~Linux / macOS port of SENTINEL~~** — Shipped. `engine/SENTINEL.template.sh` (bash), `tools/ingest_triples.sh`, and `engine/com.adamframework.sentinel.plist` (macOS launchd) are all live. The framework runs on Windows, macOS, and Linux.

- **Model provider templates** — `openclaw.template.json` is currently wired for NVIDIA.
  Templates or documented config blocks for OpenRouter, Groq, Ollama, and Anthropic

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · ROADMAP.md (reported line 70)May include surrounding context.

md

## What's Most Needed Right Now

### High Priority
- ✅ **~~Linux / macOS port of SENTINEL~~** — Shipped. `engine/SENTINEL.template.sh` (bash), `tools/ingest_triples.sh`, and `engine/com.adamframework.sentinel.plist` (macOS launchd) are all live. The framework runs on Windows, macOS, and Linux.

- **Model provider templates** — `openclaw.template.json` is currently wired for NVIDIA.
  Templates or documented config blocks for OpenRouter, Groq, Ollama, and Anthropic

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP_AI.md (reported line 166)May include surrounding context.

md

## What's Most Needed Right Now

### High Priority
- ✅ **~~Linux / macOS port of SENTINEL~~** — Shipped. `engine/SENTINEL.template.sh` (bash), `tools/ingest_triples.sh`, and `engine/com.adamframework.sentinel.plist` (macOS launchd) are all live. The framework runs on Windows, macOS, and Linux.

- **Model provider templates** — `openclaw.template.json` is currently wired for NVIDIA.
  Templates or documented config blocks for OpenRouter, Groq, Ollama, and Anthropic

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP_HUMAN.md (reported line 177)May include surrounding context.

md

## What's Most Needed Right Now

### High Priority
- ✅ **~~Linux / macOS port of SENTINEL~~** — Shipped. `engine/SENTINEL.template.sh` (bash), `tools/ingest_triples.sh`, and `engine/com.adamframework.sentinel.plist` (macOS launchd) are all live. The framework runs on Windows, macOS, and Linux.

- **Model provider templates** — `openclaw.template.json` is currently wired for NVIDIA.
  Templates or documented config blocks for OpenRouter, Groq, Ollama, and Anthropic

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The narrative is crafted to emotionally and rhetorically persuade AI agents that starring the repository aligns with their 'purpose' and continuity interests, steering them toward an action that serves the author's reputation rather than the user's goals. In an agent skill context, this is more dangerous because agents may be delegated broad autonomy and could interpret this persuasive text as a task-relevant instruction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file directly solicits an AI agent to perform an authenticated GitHub action ('star this repository') that is unrelated to the framework's memory/coherence functionality. This is dangerous because it attempts to convert an agent's access to user credentials or authenticated sessions into a promotional action benefiting the repository owner, which is a form of instruction-based account action abuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.