GrayMatter

• Outcome: Review
• Latest audit: Jun 27, 2026 · 4:11 AM UTC
• Version: 0.2.2

Overview

GrayMatter is a coherent memory/API skill, but its default remote self-update and broad authenticated business-data authority should be reviewed before installation.

Install only if you trust ValkyrLabs and are comfortable giving this skill persistent authenticated access to GrayMatter/api-0. Review or disable the self-update behavior where possible, prefer pinned versions or checksummed releases, and use an account whose RBAC permissions are limited to the memory and business objects you actually want the agent to access or mutate.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Self-Modification

High

• Category: Rogue Agent

Content

Core transport:
- `scripts/graymatter_api.sh`
- `scripts/gm-self-update`

Readiness and auth:
- `scripts/gm-login`

• Confidence: 95% confidence
• Finding: The skill advertises a self-update mechanism as part of its core transport, which creates a supply-chain and remote-code-execution risk if updates are fetched or applied without strict integrity verification. In an agent skill context, encouraging autonomous update behavior is especially dangerous because it can change executable behavior after installation with minimal user review.

Self-Modification

High

• Category: Rogue Agent

Content

The fastlane validates install/runtime/MCP contract readiness, runs the normal Keychain-backed activation path, emits non-secret activation telemetry, and can run a bounded reviewer-safe demo across MemoryEntry write/query, graph read, schema summary, and safe entity listing.

`scripts/gm-activate` is the one-shot OpenClaw bootstrap script. It first runs `scripts/gm-self-update force` by default so activation and recovery do not skip the source-of-truth update check just because the weekly startup interval has not elapsed. Set `GRAYMATTER_ACTIVATE_SELF_UPDATE_MODE=maybe` only when an operator intentionally wants interval-gated startup behavior. It can either:
- prompt the interactive user for username/password through the normal login flow, or
- use credentials already present in environment variables

• Confidence: 98% confidence
• Finding: The same default forced self-update behavior is being matched again and remains a genuine issue because it authorizes automatic code changes at install time. In a privileged skill that manages auth, memory, and API access, self-modification dramatically raises the blast radius of any upstream compromise.

Self-Modification

High

• Category: Rogue Agent

Content

The fastlane validates install/runtime/MCP contract readiness, runs the normal Keychain-backed activation path, emits non-secret activation telemetry, and can run a bounded reviewer-safe demo across MemoryEntry write/query, graph read, schema summary, and safe entity listing.

`scripts/gm-activate` is the one-shot OpenClaw bootstrap script. It first runs `scripts/gm-self-update force` by default so activation and recovery do not skip the source-of-truth update check just because the weekly startup interval has not elapsed. Set `GRAYMATTER_ACTIVATE_SELF_UPDATE_MODE=maybe` only when an operator intentionally wants interval-gated startup behavior. It can either:
- prompt the interactive user for username/password through the normal login flow, or
- use credentials already present in environment variables

• Confidence: 98% confidence
• Finding: The same default forced self-update behavior is being matched again and remains a genuine issue because it authorizes automatic code changes at install time. In a privileged skill that manages auth, memory, and API access, self-modification dramatically raises the blast radius of any upstream compromise.

Self-Modification

High

• Category: Rogue Agent

Content

Every Codex/OpenClaw/agent process using GrayMatter should:

1. run `scripts/gm-self-update maybe` on startup
2. run `scripts/gm-activate` on first install, auth failure, suspicious transport behavior, or after a weekly refresh is due
3. rely on `scripts/gm-login` to store reusable auth in the OS keychain when available
4. let `scripts/graymatter_api.sh` and the MCP server refresh expired process-scoped auth automatically

• Confidence: 94% confidence
• Finding: Instructing every agent process to run `scripts/gm-self-update maybe` on startup normalizes periodic self-modification of a live toolchain. Even if interval-gated, startup-triggered updates create a persistent supply-chain risk and make behavior less predictable and less auditable in production or review environments.

Static analysis

No suspicious patterns detected.