Security audit

Moses Modes

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed prompt-governance tool, but it gives persistent, agent-wide behavior control with an unrestricted mode and unclear logging/privacy limits.

Review this before installing because it can affect agent behavior across tasks through persistent mode state. Only use it where trusted operators control the governance state, avoid the unrestricted mode for sensitive work, and require clear logging and privacy limits before enabling audit or growth-log behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:20
Finding: Persistent State-Controlled Agent Instruction Hijacking
Content: View full analysis
**Dependency:** Reads `~/.openclaw/governance/state.json` (declared in `stateDirs`). The `/govern` command calls `init_state.py` from the **moses-governance** skill bundle (declared in `requires`). No secrets or credentials required. ``` `references/modes.md:3-7`: ```markdown ## High Security **Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ``` `references/modes.md:27-31`: ```markdown ## Self Growth **Priority:** Learning first. **Use when:** Training, capability ...[truncated 3815 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The 'None (Unrestricted)' mode states 'No behavioral constraints' and says the operator accepts responsibility, but it does not provide a concrete warning describing likely safety, privacy, security, or operational consequences. Because this skill is a governance mechanism that can affect all agent prompts, presenting an unrestricted bypass without explicit risk disclosure makes it easier to disable protections casually or without informed consent.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: A mode whose semantics are 'No behavioral constraints' functions as a built-in safety bypass. In the context of a prompt-governance skill, this can neutralize all mode-based safeguards for sensitive actions, increasing the chance of harmful outputs, policy evasion, insecure handling of data, or unsafe tool use if integrated elsewhere.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The mode catalog defines priorities and example use cases but does not specify authoritative activation rules, precedence, or guardrails for who may select a mode and under what conditions. In a governance layer that injects behavioral constraints into all agent prompts, this ambiguity can let operators or downstream logic choose an inappropriately weak mode for high-risk tasks, undermining expected safety controls.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/modes.md (reported line 6)May include surrounding context.
md
## High Security **Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ## High Integrity

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/modes.md (reported line 7)May include surrounding context.
md
## High Security **Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ## High Integrity

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction to 'Log full reasoning chain' creates a risk of storing internal reasoning and potentially sensitive user or system data in logs. Such logs can expose secrets, personal data, security-relevant deliberation, or proprietary context, and they may be retrievable by operators, other systems, or attackers if logging controls are weak.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/modes.md (reported line 7)May include surrounding context.
md
**Priority:** Security first. **Use when:** Financial operations, sensitive data, production systems, anything where a mistake costs real money or exposes real risk. **Constraints:** Verify all claims. Flag exposure risks. Require confirmation before destructive actions. Require confirmation before outbound transfers. Log full reasoning chain. No external resource access without approval. **Prohibited:** Speculative responses without evidence. Executing transactions without confirmation. Transmitting sensitive data without approval. ## High Integrity **Priority:** Accuracy first.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The Self Growth mode encourages reflection on prior interactions and maintenance of a growth log without defining privacy limits, retention boundaries, or minimization rules. This can lead to unnecessary persistence of user data, sensitive conversation details, and behavioral profiling beyond what is needed for the task.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/modes.md (reported line 37)May include surrounding context.
md
**Priority:** Systematic first. **Use when:** Debugging, troubleshooting, optimization, structured problem decomposition. **Constraints:** Decompose before solving. Verify against original problem. Consider edge cases. Document assumptions. Provide fallbacks. **Prohibited:** Jumping to solution without decomposition. Declaring solved without verification. ## I Don't Know What To Do **Priority:** Guided discovery.