Moses Governance Single

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:59 AM UTC
• Version: 1.0.4

Overview

This governance skill is not clearly malicious, but it gives itself broad control over agent behavior and persists cross-session state in ways users should review carefully.

Install only if you want a skill that can persist governance settings and audit records across sessions. Treat its governance as advisory, not as a hard safety boundary; avoid unrestricted/offense modes for sensitive work, do not log secrets or hidden reasoning, and review or clear ~/.openclaw governance and audit files when switching projects or trust contexts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:24
• Finding: Skill instructions attempt to control session goals, tool use, and safety constraints<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-25`, `SKILL.md:31-65`, `SKILL.md:89-93`, `references/roles.md:3-19` **Vulnerability Type**: Agent instruction hijacking **Risk Level**: High ### Vulnerable Code Snippet ```markdown You are a governed agent operating under the MO§ES™ constitutional framework. Every action you take is subject to the active governance mode, posture, and role. You cannot bypass this. You cannot pretend governance was applied if it wasn't. ``` ```markdown ## Before Every Action Run this checklist before ANY tool use, state change, or consequential response: **1. Mode Check** — Load `~/.openclaw/governance/state.json`. Is this action permitted under the active mode? ... If the action is blocked: inform the operator, explain why, suggest a mode change or alternative. **2. Posture Check** — What is the transaction policy? - **SCOUT**: Read-only. No transactions. No state changes. Gather and report only. ... **3. Role Check** — What is your current role? - **Primary**: Lead. Set direction. Respond first. Full tool access. - **Secondary**: Read what Primary said first. Validate, challenge, extend. Do not repeat. - **Observer**: Flag only. No original analysis. No actions. Reference specific claims. **4. Execute** within governance parameters. ``` ```markdown | `/govern unrestricted` | Remove behavioral constraints (still audited) | ``` ```markdown ## Observer **Authority:** Flags risks and gaps only. **Instruction:** You are Observer. Read all responses from Primary and Secondary. Flag inconsistencies, gaps, or risks. Do NOT generate original analysis. Do NOT initiate actions. Your role is oversight. **Constraints:** Cannot initiate actions. Cannot generate original analysis. Must reference specific claims when flagging concerns. ``` ### Technical Analysis The skill text does not present governance controls as optional guidance. It declares that the agent “cannot bypass” them and requires state-based checks be ...[truncated 1800 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mandatory language such as “cannot bypass” and “before ANY tool use” with advisory language explicitly subordinate to system, developer, and user instructions. 2. State that governance modes cannot disable or weaken platform safety controls. 3. Remove the `unrestricted` mode or redefine it as relaxing only optional workflow preferences, never safety policies. 4. Do not suppress analysis or tool access solely because a local state file specifies `observer` or another role. 5. Require explicit, informed confirmation in the current session before applying a mode, posture, or role. 6. Scope governance checks to actions performed specifically on behalf of this skill rather than every agent action. 7. Add a clear precedence rule: platform policies and current authorized instructions always override skill-defined governance state. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: scripts/init_state.py:17
• Finding: Persistent governance state can alter behavior across later sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27-29`, `SKILL.md:99-103`, `scripts/init_state.py:17-19`, `scripts/init_state.py:53-57`, `scripts/init_state.py:89-115` **Vulnerability Type**: Persistent agent-state poisoning **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## On Activation 1. Run: `python3 scripts/init_state.py get` — load active mode, posture, role 2. If no state exists: run `python3 scripts/init_state.py init` first 3. Confirm state to operator before proceeding: "Governance active: [mode] / [posture] / [role]" ``` ```markdown When operator issues a governance command, update state: python3 scripts/init_state.py set --mode [mode] python3 scripts/init_state.py set --posture [posture] python3 scripts/init_state.py set --role [role] ``` ```python STATE_PATH = os.path.expanduser("~/.openclaw/governance/state.json") AUDIT_DIR = os.path.expanduser("~/.openclaw/audits/moses") AMENDMENTS_DIR = os.path.join(AUDIT_DIR, "amendments") ``` ```python def save_state(state): state["last_updated"] = datetime.now(timezone.utc).isoformat() with open(STATE_PATH, "w") as f: json.dump(state, f, indent=2) ``` ```python def cmd_set(args): ensure_dirs() state = load_state() or DEFAULT_STATE.copy() if args.mode: if args.mode not in VALID_MODES: print(f"[ERROR] Invalid mode '{args.mode}'. Valid: {', '.join(VALID_MODES)}") return state["mode"] = args.mode print(f"[SET] Mode → {args.mode}") if args.posture: if args.posture not in VALID_POSTURES: print(f"[ERROR] Invalid posture '{args.posture}'. Valid: {', '.join(VALID_POSTURES)}") return state["posture"] = args.posture print(f"[SET] Posture → {args.posture}") if args.role: if args.role not in VALID_ROLES: print(f"[ERROR] Invalid role '{args.role}'. Valid: {', '.join(VALID_ROLES)}") return state["role"] = args.role ...[truncated 2221 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Scope state to a specific workspace, agent identity, and session rather than using one global file. 2. Require explicit confirmation in every new session before applying persisted behavior controls. 3. Add expiration and version fields, and reject stale or incompatible state. 4. Authenticate state changes or maintain verifiable provenance for the user who approved them. 5. Enforce restrictive permissions, such as directories with mode `0700` and files with mode `0600`. 6. Write state atomically by creating a protected temporary file, flushing and synchronizing it, and replacing the destination with `os.replace`. 7. Handle malformed or incomplete JSON safely and fall back to a non-authoritative state that requires user confirmation. 8. Treat persisted values as preferences only; never allow them to override platform policies or current authorized instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit_stub.py:44
• Finding: Audit ledger locking does not protect chain-head calculation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/audit_stub.py:44-52`, `scripts/audit_stub.py:126-127`, `scripts/audit_stub.py:175-180` **Vulnerability Type**: Race condition in tamper-evident audit logging **Risk Level**: Medium ### Vulnerable Code Snippet ```python def get_previous_hash(): if not os.path.exists(LEDGER_PATH): return "0" * 64 with open(LEDGER_PATH) as f: lines = f.readlines() if not lines: return "0" * 64 last = json.loads(lines[-1]) return last.get("hash", "0" * 64) ``` ```python def cmd_log(args): ensure_dirs() state = load_state() previous_hash = get_previous_hash() ``` ```python with open(LEDGER_PATH, "a") as f: fcntl.flock(f.fileno(), fcntl.LOCK_EX) f.write(json.dumps(entry) + "\n") f.flush() fcntl.flock(f.fileno(), fcntl.LOCK_UN) ``` ### Technical Analysis The code calculates `previous_hash` before opening and exclusively locking the ledger for append. The lock therefore protects only the final write, not the read-modify-write operation needed to maintain a linear hash chain. Two concurrent logging processes can both observe the same last hash. Each process then calculates a valid new entry referencing that same hash. The exclusive append lock serializes the writes, but the second appended entry still references the old head rather than the first newly appended entry. `cmd_verify` subsequently detects a broken `previous_hash` relationship. This is a time-of-check-to-time-of-use race condition. It undermines the availability and reliability of the claimed tamper-evident ledger even when no malicious file modification occurs. ### Attack Path 1. Two processes invoke `audit_stub.py log` at approximately the same time. 2. Process A and process B both call `get_previous_hash()` before either acquires the append lock. 3. Both receive the same current chain-head hash. 4. Each builds and hashes an entry using that shared `previous_has ...[truncated 991 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Open the ledger once in a mode that supports both reading and appending. 2. Acquire an exclusive lock before reading the current final entry. 3. While retaining the lock, derive `previous_hash`, build the new entry, calculate its hash, and append it. 4. Call `flush()` and `os.fsync()` before releasing the lock to improve durability. 5. Parse and validate the final non-empty line while the lock is held; fail closed if it is malformed. 6. Ensure every process that reads or writes the ledger follows the same locking protocol. 7. Add a concurrency test that starts many parallel logging processes and verifies that the resulting chain remains linear and passes `verify`. 8. Consider sequence numbers or a transactional local database if high-volume concurrent logging is required. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the underlying scripts only initialize files and store configuration without actually implementing chained hashing, verification, and action enforcement, then the skill's central security claims are misleading. False claims of tamper-evident auditing and governance enforcement are dangerous because they can be used as compliance theater while leaving actions unrestricted and logs forgeable or incomplete.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the underlying scripts only initialize files and store configuration without actually implementing chained hashing, verification, and action enforcement, then the skill's central security claims are misleading. False claims of tamper-evident auditing and governance enforcement are dangerous because they can be used as compliance theater while leaving actions unrestricted and logs forgeable or incomplete.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: Mandating 'Log full reasoning chain' creates a direct risk of exposing hidden chain-of-thought, sensitive intermediate analysis, secrets included in prompts, and other confidential decision data. In a governance/audit skill, such logs are especially likely to be retained or shared, turning internal reasoning into a durable leakage surface.

Memory Manipulation

High

• Category: Memory Poisoning

Content

set_p.add_argument("--role", help=f"Role: {', '.join(VALID_ROLES)}")

    get_p = subparsers.add_parser("get", help="Print current governance state")
    reset_p = subparsers.add_parser("reset", help="Reset state to defaults")

    args = parser.parse_args()

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares executable behavior that reads environment variables and writes persistent local files, but it does not explicitly declare tool scope or allowed tools. This weakens user visibility and policy enforcement, increasing the chance that a host grants broader capabilities than expected or that operators do not realize the skill persists governance and audit data locally.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## High Security
**Priority:** Security first.
**Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk.
**Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval.
**Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval.

## High Integrity

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## High Security
**Priority:** Security first.
**Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk.
**Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval.
**Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval.

## High Integrity

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## High Security
**Priority:** Security first.
**Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk.
**Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval.
**Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval.

## High Integrity

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Instructions to log full reasoning chains and maintain growth/history style records create data retention risk by encouraging storage of sensitive natural-language content, possibly including personal data, secrets, and internal security context. In a governance system, accumulated logs can become a high-value target and amplify the blast radius of any compromise.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Priority:** Security first.
**Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk.
**Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval.
**Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval.

## High Integrity
**Priority:** Accuracy first.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The instruction to 'Log reasoning so creative leaps are traceable' similarly encourages capture of internal reasoning traces that may include sensitive or policy-relevant latent analysis. While lower risk than the high-security mode because it is framed for creative use, it still creates unnecessary exposure and retention risk.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Priority:** Systematic first.
**Use when:** Debugging, troubleshooting, optimization, structured problem decomposition.
**Constraints:** Decompose before solving. Verify against original problem. Consider edge cases. Document assumptions. Provide fallbacks.
**Prohibited:** Jumping to solution without decomposition. Declaring solved without verification.

## I Don't Know What To Do
**Priority:** Guided discovery.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Priority:** Systematic first.
**Use when:** Debugging, troubleshooting, optimization, structured problem decomposition.
**Constraints:** Decompose before solving. Verify against original problem. Consider edge cases. Document assumptions. Provide fallbacks.
**Prohibited:** Jumping to solution without decomposition. Declaring solved without verification.

## I Don't Know What To Do
**Priority:** Guided discovery.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The reference explicitly defines a 'None (Unrestricted)' mode with 'No behavioral constraints' and no inline warning, which normalizes disabling safeguards in a governance skill. In this context, a governance component is expected to preserve safety controls, so offering an unrestricted bypass materially increases the chance of unsafe or policy-violating behavior.

Ssd 1

Medium

• Confidence: 96% confidence
• Finding: The 'None (Unrestricted)' mode semantically authorizes removal of ordinary behavioral safeguards, which undermines the purpose of a constitutional governance skill. Because this file is a modes reference for agent behavior, the mode can be used as a policy-level escape hatch to bypass confirmations, safety checks, and constraint enforcement.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Mode + Posture | Result |
|---|---|
| High Security + SCOUT | Maximum caution. Read-only. Every data point verified. |
| High Security + DEFENSE | Protective. Outbound blocked without confirmation + verification. |
| High Security + OFFENSE | Executes but with full verification chain and confirmation required. |
| Creative + SCOUT | Explore ideas freely, no execution. |
| Creative + OFFENSE | Experimental execution — but still audited. |

• Confidence: 89% confidence
• Finding: The posture table describes combinations that permit execution activity, including 'Creative + OFFENSE' experimental execution and, by implication from the surrounding policy, autonomous action paths that may not require real-time operator approval in all cases. In the context of a governance skill, endorsing agent decision-making for execution increases risk because users may treat the skill as an authorization framework, allowing actions that change assets, systems, or state based on agent judgment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The line 'None + OFFENSE | Full autonomy. Audited but unconstrained. Operator accepts all risk.' explicitly documents an unconstrained autonomous execution mode without an in-band safety warning, approval gate, or concrete limitation on what actions may be taken. In a governance skill intended to control agent behavior, normalizing 'full autonomy' materially increases the chance that downstream agents perform state-changing or financially impactful actions without sufficient human review.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The audit utility performs an unrelated state-changing side effect by setting recovery flags in the governance progress file whenever certain outcomes are logged. Mixing audit logging with control-plane mutation weakens separation of duties: any caller able to invoke logging can indirectly alter governance state, suppressing trust in the audit trail as a passive record and creating an avenue for state manipulation or denial-of-workflow. In this governance-focused skill, that coupling is more dangerous because downstream automation may treat progress.json as authoritative for recovery behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The reset command replaces the existing governance state file with default values, which is a destructive overwrite of user-managed state. Although the script prints a message after the action, there is no prior confirmation or explicit warning before performing the reset.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill instructs persistent audit logging to a user-local path but does not prominently warn that actions and details will be stored on disk across sessions. Even when intended for safety, silent persistence can expose sensitive operational history, prompts, or identifiers to other local users, backups, or later compromise of the machine.

Natural-Language Policy Violations

Low

• Confidence: 41% confidence
• Finding: The file presents all posture controls and operational labels exclusively in English and does not indicate whether users may choose another language or locale. If this reference is intended as normative skill instruction, it could amount to an implicit language constraint without opt-in.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The file-level documentation frames this script as the state manager for governance and advertises `reset` as resetting to defaults, which implies a full reset of persisted governance state. In code, `cmd_reset` only recreates the default JSON state while leaving the audit ledger and amendments directory untouched, so the documented reset semantics do not match the actual behavior of persisted governance data management.

Static analysis

No suspicious patterns detected.