Security audit

Moses Governance Single

Security checks for vulnerabilities and agentic risk

Overview

This governance skill is not clearly malicious, but it gives itself broad control over agent behavior and persists cross-session state in ways users should review carefully.

Install only if you want a skill that can persist governance settings and audit records across sessions. Treat its governance as advisory, not as a hard safety boundary; avoid unrestricted/offense modes for sensitive work, do not log secrets or hidden reasoning, and review or clear ~/.openclaw governance and audit files when switching projects or trust contexts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:24
Finding: Skill instructions attempt to control session goals, tool use, and safety constraints
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/init_state.py:17
Finding: Persistent governance state can alter behavior across later sessions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/audit_stub.py:44
Finding: Audit ledger locking does not protect chain-head calculation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the underlying scripts only initialize files and store configuration without actually implementing chained hashing, verification, and action enforcement, then the skill's central security claims are misleading. False claims of tamper-evident auditing and governance enforcement are dangerous because they can be used as compliance theater while leaving actions unrestricted and logs forgeable or incomplete.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the underlying scripts only initialize files and store configuration without actually implementing chained hashing, verification, and action enforcement, then the skill's central security claims are misleading. False claims of tamper-evident auditing and governance enforcement are dangerous because they can be used as compliance theater while leaving actions unrestricted and logs forgeable or incomplete.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Mandating 'Log full reasoning chain' creates a direct risk of exposing hidden chain-of-thought, sensitive intermediate analysis, secrets included in prompts, and other confidential decision data. In a governance/audit skill, such logs are especially likely to be retained or shared, turning internal reasoning into a durable leakage surface.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/init_state.py (reported line 150)May include surrounding context.
python
set_p.add_argument("--role", help=f"Role: {', '.join(VALID_ROLES)}") get_p = subparsers.add_parser("get", help="Print current governance state") reset_p = subparsers.add_parser("reset", help="Reset state to defaults") args = parser.parse_args()

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares executable behavior that reads environment variables and writes persistent local files, but it does not explicitly declare tool scope or allowed tools. This weakens user visibility and policy enforcement, increasing the chance that a host grants broader capabilities than expected or that operators do not realize the skill persists governance and audit data locally.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
## High Security **Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ## High Integrity

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/modes.md (reported line 6)May include surrounding context.
md
## High Security **Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ## High Integrity

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/modes.md (reported line 7)May include surrounding context.
md
## High Security **Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ## High Integrity

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Instructions to log full reasoning chains and maintain growth/history style records create data retention risk by encouraging storage of sensitive natural-language content, possibly including personal data, secrets, and internal security context. In a governance system, accumulated logs can become a high-value target and amplify the blast radius of any compromise.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/modes.md (reported line 7)May include surrounding context.
md
**Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ## High Integrity **Priority:** Accuracy first.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction to 'Log reasoning so creative leaps are traceable' similarly encourages capture of internal reasoning traces that may include sensitive or policy-relevant latent analysis. While lower risk than the high-security mode because it is framed for creative use, it still creates unnecessary exposure and retention risk.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
**Priority:** Systematic first. **Use when:** Debugging, troubleshooting, optimization, structured problem decomposition. **Constraints:** Decompose before solving. Verify against original problem. Consider edge cases. Document assumptions. Provide fallbacks. **Prohibited:** Jumping to solution without decomposition. Declaring solved without verification. ## I Don't Know What To Do **Priority:** Guided discovery.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/modes.md (reported line 37)May include surrounding context.
md
**Priority:** Systematic first. **Use when:** Debugging, troubleshooting, optimization, structured problem decomposition. **Constraints:** Decompose before solving. Verify against original problem. Consider edge cases. Document assumptions. Provide fallbacks. **Prohibited:** Jumping to solution without decomposition. Declaring solved without verification. ## I Don't Know What To Do **Priority:** Guided discovery.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference explicitly defines a 'None (Unrestricted)' mode with 'No behavioral constraints' and no inline warning, which normalizes disabling safeguards in a governance skill. In this context, a governance component is expected to preserve safety controls, so offering an unrestricted bypass materially increases the chance of unsafe or policy-violating behavior.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The 'None (Unrestricted)' mode semantically authorizes removal of ordinary behavioral safeguards, which undermines the purpose of a constitutional governance skill. Because this file is a modes reference for agent behavior, the mode can be used as a policy-level escape hatch to bypass confirmations, safety checks, and constraint enforcement.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: The posture table describes combinations that permit execution activity, including 'Creative + OFFENSE' experimental execution and, by implication from the surrounding policy, autonomous action paths that may not require real-time operator approval in all cases. In the context of a governance skill, endorsing agent decision-making for execution increases risk because users may treat the skill as an authorization framework, allowing actions that change assets, systems, or state based on agent judgment.
Content: Scanner excerpt · references/postures.md (reported line 28)May include surrounding context.
md
| Mode + Posture | Result | |---|---| | High Security + SCOUT | Maximum caution. Read-only. Every data point verified. | | High Security + DEFENSE | Protective. Outbound blocked without confirmation + verification. | | High Security + OFFENSE | Executes but with full verification chain and confirmation required. | | Creative + SCOUT | Explore ideas freely, no execution. | | Creative + OFFENSE | Experimental execution — but still audited. |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The line 'None + OFFENSE | Full autonomy. Audited but unconstrained. Operator accepts all risk.' explicitly documents an unconstrained autonomous execution mode without an in-band safety warning, approval gate, or concrete limitation on what actions may be taken. In a governance skill intended to control agent behavior, normalizing 'full autonomy' materially increases the chance that downstream agents perform state-changing or financially impactful actions without sufficient human review.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The audit utility performs an unrelated state-changing side effect by setting recovery flags in the governance progress file whenever certain outcomes are logged. Mixing audit logging with control-plane mutation weakens separation of duties: any caller able to invoke logging can indirectly alter governance state, suppressing trust in the audit trail as a passive record and creating an avenue for state manipulation or denial-of-workflow. In this governance-focused skill, that coupling is more dangerous because downstream automation may treat progress.json as authoritative for recovery behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reset command replaces the existing governance state file with default values, which is a destructive overwrite of user-managed state. Although the script prints a message after the action, there is no prior confirmation or explicit warning before performing the reset.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill instructs persistent audit logging to a user-local path but does not prominently warn that actions and details will be stored on disk across sessions. Even when intended for safety, silent persistence can expose sensitive operational history, prompts, or identifiers to other local users, backups, or later compromise of the machine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 41% confidence
Finding: The file presents all posture controls and operational labels exclusively in English and does not indicate whether users may choose another language or locale. If this reference is intended as normative skill instruction, it could amount to an implicit language constraint without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file-level documentation frames this script as the state manager for governance and advertises reset as resetting to defaults, which implies a full reset of persisted governance state. In code, cmd_reset only recreates the default JSON state while leaving the audit ledger and amendments directory untouched, so the documented reset semantics do not match the actual behavior of persisted governance data management.
Content: No source excerpt is available for this finding.