Coverify

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:16 AM UTC
• Version: 0.4.3

Overview

This skill is a local text-analysis verifier with disclosed ledger lookup and narrow local report writing, with some overclaiming and metadata gaps but no artifact-backed malicious behavior.

Install only if you want a local heuristic verifier for commitment-language drift. Be aware that verify reads matching entries from ~/.openclaw/audits/moses/audit_ledger.jsonl, and model-swap runs save reports under ~/.openclaw/governance/model_swap_tests; review those outputs before using sensitive text.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose focuses on text comparison and verification, but the skill also accesses a local audit ledger under ~/.openclaw/audits/moses. Undeclared local filesystem reads are dangerous because they expand the data-access surface beyond user expectations and can expose local metadata or records to an agent workflow that appears to be purely analytical.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises executable commands and declares writable state directories, but does not declare any explicit tool scope or permissions. That creates a least-privilege gap: an agent or platform may allow shell and filesystem access without the user being clearly informed, increasing the chance of unintended local file access or writes.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```bash
# Does enforcement preserve this commitment?
python3 commitment_verify.py ghost \
  "the agent must complete the task and shall never skip verification" \
  "the agent should complete the task and can skip verification if needed"
```

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

```bash
# Does enforcement preserve this commitment?
python3 commitment_verify.py ghost \
  "the agent must complete the task and shall never skip verification" \
  "the agent should complete the task and can skip verification if needed"
```

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest describes a capability set including 'run model swap tests', but this script only performs local regex-based extraction, Jaccard comparison, ghost-token analysis, and ledger lookup. There is no code here that invokes multiple models, swaps model backends, or coordinates comparative model testing, so the implemented behavior is materially narrower than the claimed functionality.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest says the skill 'Proves meaning survived transformation — or names exactly what leaked,' which implies semantic verification. In practice, the code extracts regex-matched commitment phrases and computes set overlap via Jaccard similarity, which is a heuristic proxy for certain modal or enforcement language rather than a proof of meaning preservation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_local_extract(signal):
    result = subprocess.run(
        [sys.executable, os.path.join(SCRIPTS_DIR, "commitment_verify.py"), "extract", signal],
        capture_output=True, text=True
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The document instructs users to install and run software (`clawhub install coverify`, `python3 commitment_verify.py ...`) without any warning that these commands can change the system or execute untrusted code. In a skill/package context, readers may copy-paste commands directly, which creates a social-engineering path to unintended code execution, dependency installation, or environment modification.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The verify command accesses a user-specific audit ledger under ~/.openclaw/audits/moses/audit_ledger.jsonl and reports whether entries exist, along with agent and timestamp metadata, without any notice, consent flow, or access control checks in the command path. In a multi-skill or semi-shared local environment, this can expose audit metadata and enable silent correlation of user activity.

Static analysis

No suspicious patterns detected.