Habitat-GS-Navigator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:16 AM UTC
• Version: 0.1.1

Overview

The skill is mostly a coherent Habitat-GS navigation helper, but it also installs mutable third-party code and tells the agent to persist episode lessons and later change or create skills from them.

Review this skill before installing. Use a virtual environment or container, pin and inspect a trusted commit of habitat-gs-bridge before installation, keep the bridge bound to local trusted endpoints, and do not allow episode logs or generated lessons to update shared memory or skills without explicit human review.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned External Repository Is Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-16`; duplicated in `references/setup.md:10-14` **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:12-16`: ```bash git clone https://github.com/The0xKa1/habitat-gs-bridge.git cd habitat-gs-bridge pip install -e . ``` The same installation sequence appears in `references/setup.md:10-14`: ```bash git clone https://github.com/The0xKa1/habitat-gs-bridge.git cd habitat-gs-bridge pip install -e . ``` ### Technical Analysis The installation instructions clone the mutable default branch of a personal GitHub repository and install it in editable mode. They do not pin an immutable commit or release, verify a checksum or signature, or provide a reviewed dependency lock file. A Python package installation may execute package build hooks and installs code that will subsequently run under the installing user's account. Because the upstream revision is not constrained, the effective code installed by these instructions can change after this Skill has been reviewed. Compromise of the upstream account, repository, dependencies, or release process could therefore introduce arbitrary executable code. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, or an unpinned transitive dependency. 2. The attacker adds malicious Python code or installation/build hooks to the repository's default branch. 3. A user follows the documented `git clone` instructions, receiving the attacker-controlled revision. 4. The user runs `pip install -e .`, which may invoke malicious build logic and makes the package available for execution. 5. The malicious code executes during installation or when `hab-cli` or `habitat-gs-bridge` is subsequently invoked. ### Impact Assessment Successful exploitation can execute arbitrary code with the privileges of the user performing the installation or running the installed commands. D ...[truncated 508 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the repository to a reviewed, immutable commit hash or a signed release tag: ```bash git clone https://github.com/The0xKa1/habitat-gs-bridge.git cd habitat-gs-bridge git checkout --detach <reviewed-commit-sha> ``` 2. Publish and verify the expected commit hash, release signature, and artifact checksum through a trusted channel. 3. Replace editable installation with a reproducible, versioned package installation where practical. 4. Lock all transitive Python dependencies with hashes, such as through a hash-verified requirements or lock file. 5. Review package build metadata and installation hooks before installation. 6. Install and run the bridge in an isolated virtual environment, container, or dedicated least-privileged account. 7. Avoid exposing host credentials or sensitive directories to the simulator environment. 8. Update both `SKILL.md` and `references/setup.md` so insecure fallback instructions are not retained in either file. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:77
• Finding: Episode-Derived Content Can Be Promoted into Persistent Agent Memory and Skills<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:77-87` **Vulnerability Type**: Persistent memory poisoning through unvalidated episode-derived content **Risk Level**: Medium ### Vulnerable Code ```markdown ## Experience Logging After each episode, record to `~/.openclaw/workspace/memory/YYYY-MM-DD.md`: ```markdown ## [NAV] Episode <id> in <scene> - Result: success/fail (N steps, optimal: M steps) - Key decisions: <turning points> - Lesson: <what to do differently> ``` After 5+ episodes, review memory and extract recurring patterns into new skills or update this skill's heuristics. ``` ### Technical Analysis The Skill directs the Agent to persist episode-derived information in a cross-session memory file and later use that material to create new skills or modify existing heuristics. It does not define an allowlist of permitted fields, distinguish trusted observations from untrusted text, preserve provenance, escape instruction-like content, or require explicit user approval before persistent behavioral changes are made. Scene identifiers, episode context, user-provided values, simulator responses, or generated lessons may contain misleading or adversarial content. If such content is copied into memory and subsequently treated as authoritative guidance, it can influence later sessions. Promoting recurring memory content into a skill further increases persistence and the scope of the poisoned behavior. The supplied files do not demonstrate an active malicious payload. The risk arises from the documented persistence and promotion workflow lacking validation and approval controls. ### Attack Path 1. An attacker controls or influences scene metadata, episode identifiers, navigation context, simulator-provided text, or user-supplied task content. 2. The influenced content causes the Agent to generate an attacker-favorable “key decision” or “lesson.” 3. Following the Skill instructions, the Agent writes that lesson into `~/.openclaw/workspace/ ...[truncated 1021 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make experience logging opt-in and require explicit user consent before writing to long-term memory. 2. Store only structured, allowlisted fields such as numeric step counts, distances, collision flags, and predefined result values. 3. Treat scene metadata, simulator output, user-provided identifiers, and generated free-form lessons as untrusted data. 4. Escape or reject instruction-like content before persistence, and never interpret stored data as executable instructions. 5. Record provenance for every entry, including the source scene, simulator endpoint, timestamp, and whether a field was user-provided or model-generated. 6. Separate raw episode telemetry from trusted behavioral guidance. 7. Require explicit human review and confirmation before creating a new skill or changing an existing skill's instructions. 8. Apply integrity controls and access restrictions to memory and skill files. 9. Remove the automatic “after 5+ episodes” promotion rule; repetition alone must not establish trust. 10. Define retention and deletion controls so poisoned or obsolete entries can be identified and removed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Self-Modification

High

• Category: Rogue Agent

Content

- Lesson: <what to do differently>
```

After 5+ episodes, review memory and extract recurring patterns into new skills or update this skill's heuristics.

• Confidence: 97% confidence
• Finding: The instruction to 'extract recurring patterns into new skills or update this skill's heuristics' is a self-modification pathway derived from untrusted runtime experience. Allowing a skill to alter itself or spawn new skills from accumulated memory can propagate mistakes, encode prompt-injected content, and bypass review controls over future behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad terms such as 'navigate', 'habitat', 'embodied', and 'explore room', which can match ordinary conversation and cause the skill to activate outside its intended narrow context. Over-broad activation increases the chance that the agent invokes simulator-specific behaviors, external tooling, or persistence instructions when the user did not intend to use this capability.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to write episode outcomes, decisions, and lessons into a persistent user memory location unrelated to the core navigation function. This expands the skill from transient scene control into durable data retention, creating privacy and integrity risks if environment contents, user prompts, or derived behavioral patterns are stored without explicit consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs persistent logging of episode data to a user memory file without requiring notice or consent. Even if the data seems operational, it may contain scene names, goals, actions, or user-derived lessons that accumulate into a behavioral profile or contaminate shared memory used by other skills.

Static analysis

No suspicious patterns detected.