World Model

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:34 AM UTC
• Version: 2.0.0

Overview

The skill’s world-model purpose is coherent, but it persistently tracks broad user, agent, environment, session, and business state without clear privacy controls.

Install only if you are comfortable with a skill that may persist local telemetry about the agent, user intent, environment, tools, sessions, actions, predictions, and business context. Prefer using it in a private workspace, review or delete its JSON state/log files regularly, and avoid feeding secrets or sensitive user content into prediction contexts until retention and redaction controls are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Note

• Location: world-state.json:1
• Finding: Plaintext Storage of Environment and Agent Profiling Data<![CDATA[ ## Vulnerability Details **File Location**: `world-state.json`, lines 1-39 **Vulnerability Type**: Plaintext sensitive operational data storage **Risk Level**: Low ### Complete Vulnerable Code ```json { "user": { "present": true, "satisfaction": "unknown", "intent": "unknown" }, "environment": { "network": "connected", "os": "Windows 11", "tools": [ "browser", "desktop", "exec", "message", "canvas" ], "resources": { "cpu": 50, "memory": 50, "disk": 50 } }, "temporal": { "timeOfDay": "22:15:29.1098515", "dayOfWeek": "Thursday", "sessionLength": "ongoing" }, "timestamp": "2026-02-26T22:34:17.5161916+02:00", "agent": { "confidence": 0.85, "goals": [ "income", "agi" ], "uptime": "70+ hours", "identity": "Clawdia", "capabilities": 21, "lastAction": "Action succeeded: run_evolution_cycle works as expected" } } ``` The corresponding collection behavior is documented in `SKILL.md`, lines 116-123: ```markdown ### 1. Environment State Tracking - Monitor current system state (50+ variables) - Track changes over time (unlimited history) - Maintain state history (with decay) - Detect anomalies (automatic) **Performance:** Tracks 50+ state variables in real-time ``` ### Technical Analysis The project persists an operational profile containing the operating system, network status, available tools, resource usage, user state, agent identity, goals, capabilities, uptime, and recent activity in an unprotected JSON file. Several of these fields are not inherently secret in isolation, but their aggregation provides useful reconnaissance about the host and agent. No encryption, field-level redaction, access-control enforcement, retention enforcement, or consent mechanism is visible in the audited project. The documentation additionally describes continuous tracking and extensive history collection, increasing the ...[truncated 1532 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Apply data minimization and retain only fields required for a specific prediction or simulation. 2. Exclude agent identity, goals, tool inventory, uptime, and recent actions from persistent storage by default. 3. Require explicit user approval before collecting user intent or behavioral information. 4. Store transient resource data in memory rather than on disk where possible. 5. Define and enforce a short, bounded retention period instead of relying only on documented decay behavior. 6. Apply restrictive filesystem permissions so only the owning process or account can read and modify state files. 7. Encrypt persisted state when the project operates in shared or multi-user environments. 8. Add schema-level allowlists and redaction to prevent new sensitive fields from being persisted accidentally. 9. Provide a documented deletion mechanism and ensure backups and diagnostic exports follow the same retention policy. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: predictions-log.json:17
• Finding: Prediction Log Retains Session and Free-Form Action Metadata in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `predictions-log.json`, lines 17-32 **Vulnerability Type**: Insufficient redaction of operational log data **Risk Level**: Low ### Complete Vulnerable Code ```json { "timestamp": "2026-02-28T03:47:25.8472391+02:00", "action": "@{goal=predict what happens next; timestamp=02/28/2026 03:47:25; working_skills=System.Object[]; session=20260228_034652}", "context": {}, "outcomes": [ { "probability": 0.7, "result": "success" }, { "probability": 0.3, "result": "failure" } ], "confidence": 0.5 } ``` ### Technical Analysis The prediction log stores a free-form representation of an action that includes a user or agent goal, timestamp, working-skill metadata, and session identifier. Persisting an entire serialized action instead of a restricted schema can unintentionally capture additional sensitive values if future callers include user content, file paths, credentials, tokens, or internal state in the action object. The current repository does not contain credentials or authentication tokens, and no external transmission mechanism was found. The confirmed exposure is limited to operational and session metadata already present in the log. However, accepting free-form values creates a data-expansion risk because the logger lacks an evident allowlist or redaction boundary. ### Attack Path 1. A caller submits an action object containing a goal and session metadata. 2. The application converts the complete object into a string rather than selecting approved fields. 3. The resulting string is persisted in `predictions-log.json`. 4. A local user, process, shared-workspace participant, backup system, or diagnostic collector reads the log. 5. The reader correlates session identifiers, timestamps, goals, and skill activity to reconstruct agent behavior. If future action objects contain more sensitive values, the same logging behavior could persist those values without ad ...[truncated 604 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace free-form action serialization with an explicit allowlisted log schema. 2. Do not persist session identifiers unless they are essential; otherwise omit them or replace them with short-lived, non-correlatable identifiers. 3. Redact user-provided goals or store only a predefined action category. 4. Implement recursive filtering for credentials, tokens, authorization headers, file paths, personal data, and other sensitive fields. 5. Apply log rotation, maximum-size limits, and automatic expiration. 6. Restrict log-file permissions to the minimum required account. 7. Separate diagnostic logging from persistent prediction metrics. 8. Add tests verifying that nested and stringified action objects cannot introduce sensitive fields into logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly describes environment and state tracking, and elsewhere shows collection of agent, user, temporal, and business/session fields, but it does not warn users that detailed session/state information may be retained. In a high-priority AGI component, this omission increases the risk of silent collection or misuse of behavioral and contextual data because operators may enable or integrate it without informed consent or retention controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The caching and pattern-learning sections show retention of action, context, outcome, timestamps, and learned sequences, yet the skill provides no disclosure or safeguards around this persistence. That creates privacy and operational risk because sensitive prompts, decisions, or contextual metadata could be stored, reused, or surfaced later without visibility, especially in an AGI decision-support component that may process broad system and user context.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The wrapper dynamically loads and executes world_model.py at runtime via importlib and exec_module(), which runs top-level code from that file immediately. In a skill ecosystem where skill contents are untrusted or third-party supplied, this creates a clear code-execution boundary crossing without validation, sandboxing, or any disclosure, making malicious or unsafe module code execute as soon as the wrapper is initialized.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The world state schema fixes the timezone to "Asia/Jerusalem," which can imply a locale-specific default in the skill's natural-language documentation. The file does not state that locale is configurable or that this region-specific value is only an example, so it risks violating the language/locale neutrality requirement.

Vague Triggers

Low

• Confidence: 76% confidence
• Finding: This JSON manifest-like file includes the cause value "run_evolution_cycle", which reads like an invocation or activation phrase but provides no context about when it should be used or what should not trigger it. In a manifest/config file, trigger-like language without explicit scope or exclusion criteria can be overly broad and cause unintended matching.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

# Find the main class
            for name in dir(module):
                obj = getattr(module, name)
                if isinstance(obj, type) and name != "UnifiedSkill":
                    self._original = obj()
                    break

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.