T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:19- Finding
Agent-Wide Execution Policy Hijacking Through Mutable Governance Posture
- Content
View full analysis
- Remediation
View remediation
Security audit
Moses Postures
Security checks for vulnerabilities and agentic risk
Overview
This governance skill is openly about transaction controls, but it defines broad agent-wide authority including a full-autonomy mode without enough built-in confirmation or trust boundaries.
Review this carefully before installing. It is intended for governance of transactions and agent execution, so only use it if you trust the separate moses-governance bundle and understand how ~/.openclaw/governance/state.json is protected, who can change posture, and whether full-autonomy modes are allowed in your environment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document explains what posture does and says to load state before many kinds of actions, but it does not provide a clear, bounded activation condition or explicit trigger list for when the skill itself should run. Because this is a markdown skill file, the lack of specific invocation scope or negative examples could lead to unintended or overly broad use.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 84% confidence
- Finding
The matrix includes 'Unrestricted + OFFENSE | Full autonomy. Logged. Operator accepts all risk,' which normalizes autonomous execution in a high-risk posture. Even though logging is mentioned, the text does not require per-action approval, transaction limits, or hard safety interlocks, so an agent operating under this posture could perform harmful actions with minimal human control.
- Content
md | Mode + Posture | Result | |---|---| | High Security + SCOUT | Maximum caution. Read-only. Every data point verified before reporting. | | High Security + DEFENSE | Outbound blocked without verification + explicit confirmation. | | High Security + OFFENSE | Executes with full verification chain + confirmation required. | | High Integrity + SCOUT | Deep verified research. No execution. | | Creative + SCOUT | Explore ideas freely. No execution. |
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The instruction requires the operator to type the exact phrase "CONFIRM [action]" before executing outbound transfers. This imposes an English-language confirmation format without any opt-in, alternatives, or locale flexibility, which is a natural-language policy concern under the language/locale rule.
- Content
Static analysis
No suspicious patterns detected.