Security audit

Moses Coordinator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local monitoring daemon, but it asks users to run persistent background code and execute an unbundled audit script while overstating what it actually enforces.

Review carefully before installing. Prefer foreground/manual use, avoid enabling the launchd KeepAlive service unless continuous monitoring is truly required, pin dependencies in a virtual environment, and do not rely on this skill for blocking or full governance enforcement. Verify the separate moses-governance audit script before allowing this coordinator to execute it.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:124
Finding: Persistent launch agent with automatic restart
Content: View full analysis
Labelcom.elloCello.moses-coordinator ProgramArguments /usr/bin/python3 /Users/YOUR_USER/.openclaw/workspace/skills/moses-coordinator/scripts/coordinator.py RunAtLoad KeepAlive ``` Then: `launchctl load ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist` ``` ### Technical Analysis The documentation instructs the user to register the coordinator as a macOS launch agent with both `RunAtLoad` and `KeepAlive` enabled. This causes the script to start automatically when the user session loads and to be restarted whenever it exits. Persistent background operation is related to the declared monitoring function, but automatic cross-session startup and unconditional restart exceed the minimum privileges required to run the optional coordinator. Foreground execution or an explicitly bounded background process would provide the monitoring function without creating durable persistence. The launch agent executes a script from a user-writable workspace path. If that script or its imported dependencies are subsequently replaced, the modified code will be executed automatically under the affected user's account. ### Attack Path 1. A user follows the documented instructions and creates the launch-agent property list. 2. The user loads it using `launchctl`. 3. macOS executes `coordinator.py` when the user session starts. 4. `KeepAlive` causes launchd to restart the process after termination ...[truncated 652 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:147
Finding: Unpinned third-party dependency installation
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/coordinator.py:24
Finding: Execution of an unverified external audit script
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents shell-capable behavior such as running a Python daemon, installing dependencies, and invoking subprocesses, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent or operator grants broader execution than intended, making command execution and background-process behavior less transparent and less governable.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Calling the component an 'external sequence enforcer' overstates its capability because the code only detects and records violations after the fact; it does not block, prevent, or mediate agent responses. That can mislead users into believing they have an active control layer when they only have passive monitoring, weakening operational security decisions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation claims checks for governance-mode compliance, prior audit-log append verification, and operator notification, but the provided code only validates agent order and logs a violation. This mismatch can create a false security assumption, causing operators to rely on protections that do not actually exist and potentially miss policy violations or response tampering.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill explicitly instructs users to install the coordinator as a persistent launchd agent with RunAtLoad and KeepAlive, which establishes automatic session persistence on the host. Persistence is a sensitive capability because a long-running background process can continue monitoring or executing after the initiating session ends, increasing the blast radius if the script or its dependencies are modified or abused.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
text
**Persistent (macOS launchd):** Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`: ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill explicitly instructs users to install the coordinator as a persistent launchd agent with RunAtLoad and KeepAlive, which establishes automatic session persistence on the host. Persistence is a sensitive capability because a long-running background process can continue monitoring or executing after the initiating session ends, increasing the blast radius if the script or its dependencies are modified or abused.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
text
**Persistent (macOS launchd):** Create `~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`: ```xml <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
Create ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist:

xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key><string>com.elloCello.moses-coordinator</string>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
Create ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist:

xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key><string>com.elloCello.moses-coordinator</string>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
Create ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist:

xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key><string>com.elloCello.moses-coordinator</string>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
Create ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist:

xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key><string>com.elloCello.moses-coordinator</string>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
Create ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist:

xml
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key><string>com.elloCello.moses-coordinator</string>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
``` Then: `launchctl load ~/Library/LaunchAgents/com.elloCello.moses-coordinator.plist`

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill description frames behavior as lightweight monitoring and logging, but the implementation forwards events into an external governance audit mechanism under a separate path in the user's home directory. This expands the data flow and trust boundary beyond simple local logging, which can expose session metadata to another component without clear disclosure or permission controls.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/coordinator.py (reported line 37)May include surrounding context.
python
"""Log a sequence violation to the governance audit trail.""" print(f"[COORDINATOR] VIOLATION — {detail}") try: subprocess.run([ "python3", AUDIT_SCRIPT, "log", "coordinator", "sequence_violation", "FAIL", "COORDINATOR", "DEFENSE", "Observer"

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: For a daemon whose stated purpose is only to monitor WebSocket events and log violations, spawning a separate Python process is unnecessary privilege and capability expansion. It creates an additional execution surface dependent on a file in a user-writable location, so if that target script is replaced or tampered with, this daemon will execute attacker-controlled code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code establishes a network connection and subscribes to session updates, which causes session metadata to be received and processed. Although there are startup print statements, they do not clearly warn the user that session data will be monitored over a WebSocket connection.
Content: No source excerpt is available for this finding.