Security audit

Habitat-GS-Navigator

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Habitat-GS navigation helper, but it also installs mutable third-party code and tells the agent to persist episode lessons and later change or create skills from them.

Review this skill before installing. Use a virtual environment or container, pin and inspect a trusted commit of habitat-gs-bridge before installation, keep the bridge bound to local trusted endpoints, and do not allow episode logs or generated lessons to update shared memory or skills without explicit human review.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned External Repository Is Installed and Executed
Content: View full analysis
Remediation: View remediation
``` 2. Publish and verify the expected commit hash, release signature, and artifact checksum through a trusted channel. 3. Replace editable installation with a reproducible, versioned package installation where practical. 4. Lock all transitive Python dependencies with hashes, such as through a hash-verified requirements or lock file. 5. Review package build metadata and installation hooks before installation. 6. Install and run the bridge in an isolated virtual environment, container, or dedicated least-privileged account. 7. Avoid exposing host credentials or sensitive directories to the simulator environment. 8. Update both `SKILL.md` and `references/setup.md` so insecure fallback instructions are not retained in either file. ]]>

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:77
Finding: Episode-Derived Content Can Be Promoted into Persistent Agent Memory and Skills
Content: View full analysis
in - Result: success/fail (N steps, optimal: M steps) - Key decisions: - Lesson: ``` After 5+ episodes, review memory and extract recurring patterns into new skills or update this skill's heuristics. ``` ### Technical Analysis The Skill directs the Agent to persist episode-derived information in a cross-session memory file and later use that material to create new skills or modify existing heuristics. It does not define an allowlist of permitted fields, distinguish trusted observations from untrusted text, preserve provenance, escape instruction-like content, or require explicit user approval before persistent behavioral changes are made. Scene identifiers, episode context, user-provided values, simulator responses, or generated lessons may contain misleading or adversarial content. If such content is copied into memory and subsequently treated as authoritative guidance, it can influence later sessions. Promoting recurring memory content into a skill further increases persistence and the scope of the poisoned behavior. The supplied files do not demonstrate an active malicious payload. The risk arises from the documented persistence and promotion workflow lacking validation and approval controls. ### Attack Path 1. An attacker controls or influences scene metadata, episode identifiers, navigation context, simulator-provided text, or user-supplied task content. 2. The influenced content causes the Agent to generate an attacker-favorable “key decision” or “lesson.” 3. Following the Skill instructions, the Agent writes that lesson into `~/.openclaw/workspace/ ...[truncated 1021 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Self-Modification

High

Category: Rogue Agent
Confidence: 97% confidence
Finding: The instruction to 'extract recurring patterns into new skills or update this skill's heuristics' is a self-modification pathway derived from untrusted runtime experience. Allowing a skill to alter itself or spawn new skills from accumulated memory can propagate mistakes, encode prompt-injected content, and bypass review controls over future behavior.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

Lesson:

text
After 5+ episodes, review memory and extract recurring patterns into new skills or update this skill's heuristics.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad terms such as 'navigate', 'habitat', 'embodied', and 'explore room', which can match ordinary conversation and cause the skill to activate outside its intended narrow context. Over-broad activation increases the chance that the agent invokes simulator-specific behaviors, external tooling, or persistence instructions when the user did not intend to use this capability.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to write episode outcomes, decisions, and lessons into a persistent user memory location unrelated to the core navigation function. This expands the skill from transient scene control into durable data retention, creating privacy and integrity risks if environment contents, user prompts, or derived behavioral patterns are stored without explicit consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs persistent logging of episode data to a user memory file without requiring notice or consent. Even if the data seems operational, it may contain scene names, goals, actions, or user-derived lessons that accumulate into a behavioral profile or contaminate shared memory used by other skills.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.