Moses Coordinator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:59 AM UTC
• Version: 1.0.2

Overview

This skill is a local monitoring daemon, but it asks users to run persistent background code and execute an unbundled audit script while overstating what it actually enforces.

Review carefully before installing. Prefer foreground/manual use, avoid enabling the launchd KeepAlive service unless continuous monitoring is truly required, pin dependencies in a virtual environment, and do not rely on this skill for blocking or full governance enforcement. Verify the separate moses-governance audit script before allowing this coordinator to execute it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:124
• Finding: Persistent launch agent with automatic restart<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:124-143` **Vulnerability Type**: Persistent user-level startup service **Risk Level**: High ### Vulnerable Code ```xml **Persistent (macOS launchd):** Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`: ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key><string>com.elloCello.moses-coordinator</string> <key>ProgramArguments</key> <array> <string>/usr/bin/python3</string> <string>/Users/YOUR_USER/.openclaw/workspace/skills/moses-coordinator/scripts/coordinator.py</string> </array> <key>RunAtLoad</key><true/> <key>KeepAlive</key><true/> </dict> </plist> ``` Then: `launchctl load ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist` ``` ### Technical Analysis The documentation instructs the user to register the coordinator as a macOS launch agent with both `RunAtLoad` and `KeepAlive` enabled. This causes the script to start automatically when the user session loads and to be restarted whenever it exits. Persistent background operation is related to the declared monitoring function, but automatic cross-session startup and unconditional restart exceed the minimum privileges required to run the optional coordinator. Foreground execution or an explicitly bounded background process would provide the monitoring function without creating durable persistence. The launch agent executes a script from a user-writable workspace path. If that script or its imported dependencies are subsequently replaced, the modified code will be executed automatically under the affected user's account. ### Attack Path 1. A user follows the documented instructions and creates the launch-agent property list. 2. The user loads it using `launchctl`. 3. macOS executes `coordinator.py` when the user session starts. 4. `KeepAlive` causes launchd to restart the process after termination ...[truncated 652 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make foreground execution the documented default. - Require explicit, informed user consent before enabling launchd persistence. - Disable `KeepAlive` by default and only enable it when uninterrupted monitoring is demonstrably required. - Document how to stop, unload, and delete the service. - Use the modern `launchctl bootstrap` and `launchctl bootout` interfaces where applicable. - Store the executable in a directory that is not writable by untrusted local processes or users. - Verify the ownership and permissions of both the property list and the coordinator script before registration. - Use an isolated, pinned Python environment and configure `ProgramArguments` to invoke its exact interpreter. - Consider an application-managed, session-scoped process instead of a permanent login service. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:147
• Finding: Unpinned third-party dependency installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:147-151` **Vulnerability Type**: Unpinned runtime dependency **Risk Level**: Medium ### Vulnerable Code ```bash ## Dependencies ```bash pip3 install websockets ``` ``` ### Technical Analysis The installation command retrieves the current version of `websockets` and any transitive dependencies without a version constraint, lock file, integrity hash, or isolated environment. Consequently, installations are not reproducible and may silently receive incompatible or compromised future releases. The documented package name is not visibly misspelled or obfuscated, and the audit found no evidence that the current package is malicious. The risk arises from unconstrained supply-chain resolution, particularly because the imported dependency executes inside a daemon that may be configured for automatic persistent startup. ### Attack Path 1. A user runs the documented `pip3 install websockets` command. 2. `pip` resolves the package and transitive dependencies available from its configured index at that time. 3. A compromised, malicious, or unexpectedly incompatible release is installed. 4. `scripts/coordinator.py` imports the installed package when it starts. 5. Package initialization code executes with the coordinator user's permissions. 6. If the launch agent is configured, the dependency is loaded repeatedly and automatically. ### Impact Assessment A compromised dependency can execute arbitrary Python code with the privileges of the user running the coordinator. This may permit access to user-readable files, local services, environment data, and the OpenClaw workspace. No direct privilege escalation to root is demonstrated, but persistence configuration can amplify the duration and reliability of execution. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `websockets` to a reviewed, compatible version. - Maintain a lock file containing reviewed transitive dependency versions. - Use hash-verified installation, such as `pip install --require-hashes -r requirements.txt`. - Install dependencies in a dedicated virtual environment rather than the user's global Python environment. - Configure the launch agent to invoke the exact interpreter from that virtual environment. - Periodically review and deliberately update dependency versions after security testing. - Document the expected package index and avoid untrusted or implicit index sources. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/coordinator.py:24
• Finding: Execution of an unverified external audit script<![CDATA[ ## Vulnerability Details **File Location**: `scripts/coordinator.py:24-40` **Vulnerability Type**: Unverified external tool execution **Risk Level**: Medium ### Vulnerable Code ```python AUDIT_SCRIPT = os.path.expanduser( "~/.openclaw/workspace/skills/moses-governance/scripts/audit_stub.py" ) STATE_PATH = os.path.expanduser("~/.openclaw/governance/state.json") SEQUENCE = ["primary", "secondary", "observer"] def log_violation(detail: str): """Log a sequence violation to the governance audit trail.""" print(f"[COORDINATOR] VIOLATION — {detail}") try: subprocess.run([ "python3", AUDIT_SCRIPT, "log", "coordinator", "sequence_violation", "FAIL", "COORDINATOR", "DEFENSE", "Observer" ], check=False) ``` ### Technical Analysis On a detected sequence violation, the coordinator invokes a Python script located outside this Skill package. The project contains only `SKILL.md` and `scripts/coordinator.py`; the referenced `moses-governance/scripts/audit_stub.py` was therefore not available for this audit despite the documentation stating that it ships in the repository. The coordinator does not verify the target file's ownership, permissions, integrity, provenance, or expected contents before executing it. An argument array is used rather than a shell command, which prevents conventional shell metacharacter injection through arguments, but it does not protect against replacement of the script itself. The use of the generic `python3` executable also relies on executable resolution from the daemon's runtime environment. ### Attack Path 1. An attacker obtains write access to `~/.openclaw/workspace/skills/moses-governance/scripts/audit_stub.py`, or creates that path before the legitimate component is installed. 2. The attacker places malicious Python code at the expected location. 3. The coordinator connects to the local gateway and receives session events. 4. An event ordering violation invok ...[truncated 701 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bundle the audit implementation with this Skill so that all executed code can be reviewed together. - Resolve the audit script relative to the trusted installed Skill directory rather than a separate mutable workspace path. - Before execution, verify that the target is a regular file with expected ownership and restrictive permissions. - Verify the script against a packaged cryptographic digest or signature. - Use `sys.executable` or an absolute path to a controlled virtual-environment interpreter instead of relying on `python3` resolution. - Prefer implementing the required append-only JSONL logging directly in the coordinator, eliminating the external execution boundary. - If the external component is absent or fails validation, refuse to execute it and emit an explicit security error. - Check and handle the subprocess return code rather than using `check=False` without further validation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents shell-capable behavior such as running a Python daemon, installing dependencies, and invoking subprocesses, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent or operator grants broader execution than intended, making command execution and background-process behavior less transparent and less governable.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: Calling the component an 'external sequence enforcer' overstates its capability because the code only detects and records violations after the fact; it does not block, prevent, or mediate agent responses. That can mislead users into believing they have an active control layer when they only have passive monitoring, weakening operational security decisions.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The documentation claims checks for governance-mode compliance, prior audit-log append verification, and operator notification, but the provided code only validates agent order and logs a violation. This mismatch can create a false security assumption, causing operators to rely on protections that do not actually exist and potentially miss policy violations or response tampering.

Session Persistence

Medium

• Category: Rogue Agent

Content

```

**Persistent (macOS launchd):**
Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`:
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">

• Confidence: 88% confidence
• Finding: The skill explicitly instructs users to install the coordinator as a persistent launchd agent with RunAtLoad and KeepAlive, which establishes automatic session persistence on the host. Persistence is a sensitive capability because a long-running background process can continue monitoring or executing after the initiating session ends, increasing the blast radius if the script or its dependencies are modified or abused.

Session Persistence

Medium

• Category: Rogue Agent

Content

```

**Persistent (macOS launchd):**
Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`:
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">

• Confidence: 88% confidence
• Finding: The skill explicitly instructs users to install the coordinator as a persistent launchd agent with RunAtLoad and KeepAlive, which establishes automatic session persistence on the host. Persistence is a sensitive capability because a long-running background process can continue monitoring or executing after the initiating session ends, increasing the blast radius if the script or its dependencies are modified or abused.

Session Persistence

Medium

• Category: Rogue Agent

Content

Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`:
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.elloCello.moses-coordinator</string>

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`:
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.elloCello.moses-coordinator</string>

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`:
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.elloCello.moses-coordinator</string>

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`:
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.elloCello.moses-coordinator</string>

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`:
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.elloCello.moses-coordinator</string>

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

</dict>
</plist>
```
Then: `launchctl load ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`

---

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill description frames behavior as lightweight monitoring and logging, but the implementation forwards events into an external governance audit mechanism under a separate path in the user's home directory. This expands the data flow and trust boundary beyond simple local logging, which can expose session metadata to another component without clear disclosure or permission controls.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Log a sequence violation to the governance audit trail."""
    print(f"[COORDINATOR] VIOLATION — {detail}")
    try:
        subprocess.run([
            "python3", AUDIT_SCRIPT, "log",
            "coordinator", "sequence_violation", "FAIL",
            "COORDINATOR", "DEFENSE", "Observer"

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: For a daemon whose stated purpose is only to monitor WebSocket events and log violations, spawning a separate Python process is unnecessary privilege and capability expansion. It creates an additional execution surface dependent on a file in a user-writable location, so if that target script is replaced or tampered with, this daemon will execute attacker-controlled code.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code establishes a network connection and subscribes to session updates, which causes session metadata to be received and processed. Although there are startup print statements, they do not clearly warn the user that session data will be monitored over a WebSocket connection.

Static analysis

No suspicious patterns detected.