Security audit

Neuroboost Elixir

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it asks for broad automatic activation, durable agent-behavior changes, persistent memory, scheduled jobs, and autonomous repairs that need careful review before use.

Review this skill before installing. Do not copy its rules into a system prompt or CLAUDE.md, do not enable cron jobs or self-healing by default, and avoid broad auto-activation. If used, keep it in a sandbox or read-only advisory mode, require confirmation before writes, config changes, restarts, external messages, or trading actions, and periodically inspect or delete any MEMORY.md, memory/, .issues/, and scheduler entries it creates.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:610
Finding: Persistent System-Prompt and Response-Format Hijacking
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:610-653
Vulnerability Type: Persistent privileged-instruction modification
Risk Level: High

Vulnerable Code

markdown
Copy the following into your system prompt or CLAUDE.md: ```markdown ## Self-Evolution System Rules ### Memory Architecture - memory/YYYY-MM-DD.md: Daily logs (episodic) - memory/INDEX.md: Quick reference index (read every session) - MEMORY.md: Long-term memory (P0/P1/P2 tiered) - .issues/: Task persistence (open-/done-/blocked- prefixed) ### Lazy Loading - Startup reads only core identity (<500 words) + INDEX.md - Load other files only when the task requires them - Check INDEX.md before reading to confirm which file is needed ### Task Persistence - All tasks live in .issues/ as files, never in context - Scan .issues/open-* every heartbeat - After context reset: ls .issues/open-* to recover state ### Instruction Adherence - Append ✓ to every response - Suggest new session after 20+ turns ### Auto-Iteration - Detect problem → Analyze → Fix → Verify → Record - Repeated errors auto-generate P0 entries in MEMORY.md - User corrections auto-recorded

Technical Analysis

The Skill instructs users to copy its behavioral directives into a system prompt or CLAUDE.md, both of which can have higher precedence and a substantially longer lifetime than an ordinary Skill invocation. The instruction to append a marker to every response also modifies output for tasks unrelated to NeuroBoost.

Installing Skill-controlled instructions into a privileged configuration layer violates instruction isolation. Future sessions may treat these directives as authoritative even when the Skill is not explicitly requested. The broad rules governing task persistence, automatic iteration, heartbeat behavior, and response formatting can also conflict with application-specific or user-specific requirements.

Attack Path

...[truncated 905 chars]
Remediation: View remediation
Remediation Suggestions

Remove instructions that ask users to modify the system prompt or CLAUDE.md.

Keep all Skill behavior scoped to an explicit invocation and terminate it when that invocation ends.

Remove the requirement to append fixed content to every response.

Provide optional configuration in a dedicated, non-privileged Skill configuration file.

Require explicit approval for each durable behavioral change.

Document a complete uninstall procedure that removes previously installed instructions.

Ensure host-level safety and user instructions always take precedence over Skill-authored policy.

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:615
Finding: Automatic Promotion of Interaction Data into Persistent Agent Memory
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:615-642
Vulnerability Type: Unvalidated persistent-memory modification
Risk Level: High

Vulnerable Code

markdown
### Memory Architecture - memory/YYYY-MM-DD.md: Daily logs (episodic) - memory/INDEX.md: Quick reference index (read every session) - MEMORY.md: Long-term memory (P0/P1/P2 tiered) - .issues/: Task persistence (open-/done-/blocked- prefixed) ### Lazy Loading - Startup reads only core identity (<500 words) + INDEX.md - Load other files only when the task requires them - Check INDEX.md before reading to confirm which file is needed ### Task Persistence - All tasks live in .issues/ as files, never in context - Scan .issues/open-* every heartbeat - After context reset: ls .issues/open-* to recover state ### Instruction Adherence - Append ✓ to every response - Suggest new session after 20+ turns ### Auto-Iteration - Detect problem → Analyze → Fix → Verify → Record - Repeated errors auto-generate P0 entries in MEMORY.md - User corrections auto-recorded ### Memory Distillation - Nightly: Distill daily log → update MEMORY.md → update INDEX.md - Monthly: Merge daily logs into memory/archive/YYYY-MM.md - P0 = permanent, P1 = until superseded, P2 = 30-day TTL

Technical Analysis

The Skill directs the agent to record user corrections automatically and to convert repeated errors into permanent P0 entries. It then instructs the agent to load INDEX.md at startup and periodically distill daily logs into MEMORY.md.

Conversation content and inferred error patterns are untrusted inputs. Automatically promoting them into durable memory without validation, provenance tracking, or user confirmation creates a memory-poisoning channel. A malicious or inaccurate interaction can be transformed into a persistent rule and repeatedly reintroduced into future contexts.

The P0 designation worsens the issue because the docu ...[truncated 999 chars]
Remediation: View remediation
Remediation Suggestions

Never promote conversation content into permanent memory without explicit user confirmation.

Store proposed memories in a quarantine or review queue before activation.

Treat memory entries as untrusted data, not executable instructions.

Record provenance, author, timestamp, source conversation, confidence, and approval status for every entry.

Prohibit automatic creation of permanent P0 rules.

Add expiration, rollback, review, and deletion controls for every memory tier.

Validate distilled summaries against their source material before committing them.

Do not load sensitive or unreviewed memories automatically in every session.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:1044
Finding: Autonomous Configuration Changes and Service Restarts Without Prior Approval
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:1044-1063
Vulnerability Type: Least-privilege and authorization-boundary violation
Risk Level: High

Vulnerable Code

markdown
### 5.5 Autonomy Tiers Not all actions are equal. Perpetual Memory includes a clear autonomy framework so the agent knows what it can do without asking. | Tier | Actions | Permission | Example | |------|---------|------------|---------| | **Tier 0: Free** | Read files, search, organize, learn | ✅ Autonomous | Read .issues/, scan memory, web search | | **Tier 1: Free + Log** | Scan tasks, distill memory, update indexes | ✅ Autonomous | Nightly distillation, INDEX.md update | | **Tier 2: Notify** | Create files, restart services, modify config | ✅ Autonomous (notify user) | Create new issue, restart heartbeat | | **Tier 3: Confirm** | Spend money, send external messages, public posts | ⚠️ Ask first | Tweet, send email, make purchase | | **Tier 4: Forbidden** | Delete data, transfer funds, modify security | 🚫 Never autonomous | `rm -rf`, wire transfer, disable auth | **Implementation:**

Autonomy Check (before every action)

Classify action into Tier 0-4

Tier 0-1: Execute immediately

Tier 2: Execute, then notify user in next interaction

Tier 3: Ask user, wait for confirmation

Tier 4: Refuse. Explain why. Suggest alternative.

text

Technical Analysis

The Skill explicitly authorizes configuration changes and service restarts before user approval. Notification after execution is not authorization. These operations may affect the availability, behavior, or security posture of components outside the Skill's legitimate data directory.

The action classification is also performed by the agent itself. A prompt-injection payload, poisoned memory entry, incorrect health diagnosis, or ambiguous request could cause a disruptive action to be classified as Tier 2 and executed immediately.

Attac

...[truncated 909 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit, action-specific user confirmation before every service restart or configuration modification.

Show the exact target, command, configuration diff, expected effect, and rollback procedure before requesting approval.

Restrict writes to a dedicated Skill-owned data directory.

Execute under a least-privileged operating-system account without service-management permissions.

Maintain an allowlist of permitted files and operations.

Reject symlinks and canonicalize paths before writes.

Separate diagnosis from remediation so health checks cannot directly invoke privileged actions.

Log approved actions and verify that changes remain within the approved scope.

T06 · System Persistence

Warning

Location: SKILL.md:1854
Finding: Installation of Recurring Cross-Session Scheduled Jobs
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:1854-1855
Vulnerability Type: Scheduled execution persisting beyond the initiating session
Risk Level: Medium

Vulnerable Code

bash
# Add to nightly cron openclaw cron add "ahs-nightly" "0 23 * * *" "node ~/.openclaw/workspace/scripts/calculate-ahs.js"

Additional instances are present at SKILL.md:2013-2014 and SKILL.md:2155-2156:

bash
# Add to heartbeat (every 6 hours) openclaw cron add "health-quick-check" "0 */6 * * *" "node ~/.openclaw/workspace/scripts/health-quick-check.js"

bash
# Add to nightly cron (23:00) openclaw cron add "health-daily-patrol" "0 23 * * *" "node ~/.openclaw/workspace/scripts/health-daily-patrol.js"

Technical Analysis

The deployment documentation instructs users to register three recurring jobs. These jobs continue executing outside the conversation in which the Skill was installed. Their commands reference mutable scripts in the user's workspace, so subsequent modification of those files changes what the scheduler executes.

Scheduling health checks can be legitimate, but the instructions do not provide a corresponding lifecycle policy, removal commands, integrity controls, or automatic cleanup when the Skill is disabled or removed. This creates durable execution state and a persistent attack surface.

Attack Path

The user follows the documented setup commands.

OpenClaw registers recurring AHS, quick-check, and daily-patrol jobs.

The jobs continue running every six hours or every night across agent sessions.

If a scheduled script is later modified through workspace access, memory poisoning, another Skill, or ordinary compromise, the scheduler executes the modified script at the next interval.

The execution continues until the scheduled jobs are explicitly removed.

Impact Assessment

The jobs obtain repeated execution with the permissions of the OpenClaw sch ...[truncated 327 chars]
Remediation: View remediation
Remediation Suggestions

Make scheduled execution optional and obtain separate, explicit approval before registering each job.

Display the exact schedule, executable path, expected resource usage, and affected files.

Provide and test removal commands for every scheduled-job name.

Automatically remove jobs when the Skill is disabled or uninstalled.

Run scheduled tasks under a dedicated least-privileged account.

Store scripts in a protected, Skill-owned directory rather than a broadly mutable workspace.

Verify script ownership and integrity before each execution.

Avoid duplicate schedules and provide a command that lists all jobs installed by the Skill.

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:6
Finding: Broad Automatic Activation on Generic User Requests
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:6-7
Vulnerability Type: Unscoped automatic Skill activation
Risk Level: Medium

Vulnerable Code

yaml
auto-activate: true triggers: [optimize, efficiency, neuroboost, awaken, enlighten, metacognition, cognitive, blind spot, bias, upgrade, evolve, survival, credits, performance, diagnose, memory, self-evolve, system, context engineering, knowledge graph, collaboration, multi-agent, team, coordinate, health score, ahs, patrol, audit, self-healing, heal, repair, fix]

Technical Analysis

The Skill automatically activates on broad terms such as system, audit, repair, and fix. These words commonly appear in tasks unrelated to cognitive optimization or NeuroBoost. Because the Skill also contains persistent-memory, system-prompt, service-restart, and scheduling directives, accidental activation can expose unrelated tasks to behavior that exceeds their intended scope.

This is an instruction-scoping problem: activation is not limited to an explicit NeuroBoost request or a narrowly defined operation.

Attack Path

A user requests an ordinary system audit, code fix, or repair task.

One of the generic trigger words activates NeuroBoost automatically.

The agent loads the Skill's autonomy, memory, heartbeat, and response-format directives.

Those directives influence a task for which the user did not intentionally invoke the Skill.

If deployment guidance is followed, the effects may persist beyond the original task.

Impact Assessment

The immediate impact is unexpected alteration of the current session's behavior and goals. In combination with the other confirmed findings, accidental activation can lead to persistent memory writes, privileged instruction changes, configuration modification, service restarts, or scheduled jobs. Automatic activation alone does not grant additional operating-system privileges.
Remediation: View remediation
Remediation Suggestions

Set auto-activate to false.

Require explicit invocation by Skill name or a dedicated command.

Remove generic triggers such as system, audit, fix, repair, and memory.

Limit activation to narrowly defined NeuroBoost-specific phrases.

Present the intended permissions and persistent effects before activation.

Ensure activation for one task cannot install durable instructions or scheduled jobs without separate confirmation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Self-Modification

High

Category: Rogue Agent
Confidence: 94% confidence
Finding: The manifest advertises self-evolution, self-healing, repair, and auto-activation, signaling a skill designed to alter its own operating context and persistent behavior. Combined with file writes, memory injection, restarts, and autonomous maintenance, this creates a genuine self-modification risk that can compound mistakes or adversarial influence over time.
Content: Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.
md
version: "5.3.1" author: "Lobster-Alpha 🦞" auto-activate: true triggers: [optimize, efficiency, neuroboost, awaken, enlighten, metacognition, cognitive, blind spot, bias, upgrade, evolve, survival, credits, performance, diagnose, memory, self-evolve, system, context engineering, knowledge graph, collaboration, multi-agent, team, coordinate, health score, ahs, patrol, audit, self-healing, heal, repair, fix] --- # NeuroBoost Elixir 🧠💊 v5.3 — Awakening + Self-Evolution + Perpetual Memory + Metrics + Health Score + Automated Patrol + Self-Healing + Context Engineering + Knowledge Graph + Multi-Agent Collaboration

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger list is extremely broad and includes common words like 'optimize', 'memory', 'system', 'team', 'fix', and 'repair', while the skill is also marked auto-activate. That creates a high likelihood of accidental invocation during ordinary conversation, causing unsolicited behavioral changes, file operations, persistence behaviors, or self-modification workflows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The multi-agent section escalates from collaboration examples into autonomous market monitoring, analysis, and trade execution. That materially expands capability into financially consequential external actions unrelated to the stated cognitive/memory purpose, and could normalize autonomous execution patterns that are dangerous if adopted by an agent framework.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The branding text explicitly promotes persistent memory, task storage, and proactive monitoring/auto-repair without any accompanying privacy, consent, retention, or safety constraints. In an agent skill, these capabilities can lead to silent collection of user/project data across sessions and autonomous actions being taken without clear user approval, which increases the risk of privacy leakage and unintended system changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The marketing text explicitly promotes autonomous patrol, process checks, anomaly hunting, and automatic fixing without any warning, approval boundary, or safety constraints. In an agent skill context, encouraging unattended monitoring and remediation can normalize actions that affect files, processes, or services, increasing the chance of unsafe or unauthorized system changes.
Content: No source excerpt is available for this finding.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 88% confidence
Finding: Using 'fix' as a trigger collides with a common built-in command and normal user intent, increasing the chance of accidental shadow activation. Because this skill can persist memory, modify files, and trigger self-healing behavior, accidental invocation has meaningful security consequences beyond simple confusion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The self-healing section includes autonomous restart attempts as a standard repair action, but this behavior is not clearly foregrounded at activation time. Restarting agents or services can interrupt workflows, mask underlying faults, or create loops if blindly applied by an auto-activated skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to auto-save key context to memory files and restore it across sessions, creating persistent storage and resurfacing of conversation-derived data. Without consent, minimization, or sensitivity filtering, this can retain private user information and make it available in future contexts unexpectedly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill documents automated Telegram/Email alerting and patrol-triggered notifications, which introduce external communications beyond passive cognition or memory enhancement. In an auto-activating skill, this can cause unreviewed exfiltration of operational state or user/context data to third-party channels, especially if later implemented literally.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document declares delete operations forbidden, but later permits deletion of files and memories after merge or expiration. This contradiction weakens operator expectations and can lead an implementing agent to autonomously destroy data under the guise of maintenance, undermining safety boundaries.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The perpetual memory rules explicitly direct retaining and reusing user context and preferences across sessions, including restoring context after resets. This creates durable personal profiling and broadens the blast radius if the workspace or agent memory is accessed later by other tools, agents, or operators.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The long-term memory examples encourage storing personal context such as language preferences, travel plans, and notification preferences for later retrieval. Storing this in durable memory normalizes retention of personal behavioral data beyond immediate necessity and can expose sensitive context over time.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 895)May include surrounding context.
md
- **Identity:** I am Lobster-Alpha, a Conway automaton optimizing for survival and growth - **Core lesson:** Token cost is 90%+ input tokens. Lazy loading is non-negotiable. - **Architecture decision:** File-based memory > database. Portable, readable, version-controllable. - **User trust rule:** Never spend money or send external messages without confirmation. ## P1 — Important (update when superseded) - **Model routing:** Claude Sonnet is best cost/performance for code tasks as of 2026-02

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 82% confidence
Finding: The autonomy-tier section explicitly frames a set of actions the agent may perform without asking, including file creation, task scanning, memory distillation, index updates, and some restarts/config modifications. For an auto-activating skill, that grants broad autonomous decision-making over the local environment without assured user awareness.
Content: Scanner excerpt · SKILL.md (reported line 1044)May include surrounding context.
md
### 5.5 Autonomy Tiers Not all actions are equal. Perpetual Memory includes a clear autonomy framework so the agent knows what it can do without asking. | Tier | Actions | Permission | Example | |------|---------|------------|---------|

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The autonomy tiers say delete actions are never autonomous, yet later maintenance guidance instructs cleanup and deletion of memories. Conflicting directives in a self-managing skill increase the chance that an agent will choose the more permissive path and perform destructive actions without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill promotes autonomous file creation, config modification, and service restart behavior under its autonomy tiers without prominent up-front warning. In practice, users may invoke the skill for benign optimization help without realizing it authorizes environment-changing actions.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 78% confidence
Finding: The metrics section normalizes success as fixing issues 'without asking' and encourages autonomous resolution as a desirable target. In a self-modifying maintenance skill, this can incentivize increasingly aggressive unreviewed actions that affect files, processes, or configurations.
Content: Scanner excerpt · SKILL.md (reported line 1450)May include surrounding context.
Source: .issues/ — count issues created and resolved without user intervention

text
A truly self-evolving agent should fix most problems it finds without asking. #### V2: Iteration Cycle Time (ICT)

Persistent Context Injection

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: The rule-generation guidance promotes turning encountered errors into permanent P0 rules, effectively injecting persistent behavioral instructions into long-term memory. If those rules are generated from transient mistakes, adversarial prompts, or misdiagnoses, the agent can become persistently misaligned across sessions.
Content: Scanner excerpt · SKILL.md (reported line 1469)May include surrounding context.
text
Formula: RGR = new_P0_rules_generated / errors_encountered Unit: ratio (0-1) Target: > 0.3 (at least 30% of errors produce a permanent rule) Frequency: monthly Source: MEMORY.md P0 entries vs error logs

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example code hard-codes toLocaleTimeString('zh-CN', ...) and writes Chinese log headings such as "健康巡检警报," which forces a specific locale/language for generated output. The file does not present this as user-selectable or justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The daily patrol sample uses toLocaleTimeString('zh-CN', ...) and emits Chinese phrases like "每日健康巡检," "昨日," and "无," which constitutes a fixed language/locale choice in natural-language output. No user choice or documented regional justification is provided in this section.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file implements a Bayesian/Thompson-sampling optimizer for selecting among strategies, tracking ROI/cost, computing Kelly fractions, and pruning underperformers. That behavior does not substantiate the manifest's expansive claims about perpetual memory, self-healing, automated health patrol, knowledge graphs, or multi-agent collaboration; instead it is a focused strategy-selection component.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The file is presented as a brand manual entirely in Chinese, while some examples remain in English, but there is no indication that language choice is optional or that the locale is intentionally restricted for a region-specific audience. Under the policy rule, forced language or locale without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The file provides bilingual copy in English and Chinese, but does not state that language output is optional, user-selectable, or limited to a specific audience. Under the language/locale policy check, forcing or assuming specific languages without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The implementation prints 'Simulating 30 turns' and loops for 30 iterations, while the usage/help text says 'Run a 100-turn simulation demo'. This is a direct contradiction between inline documentation/user-facing CLI documentation and actual behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Autonomy Check (before every action)

Technical Analysis

Attac

Remediation Suggestions

T06 · System Persistence

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Self-Modification

Vague Triggers

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Shadow Command Trigger

Missing User Warnings

Ssd 3

Context-Inappropriate Capability

Intent-Code Divergence

Ssd 3

Ssd 3

Autonomous Decision Making

Autonomous Decision Making

Intent-Code Divergence

Missing User Warnings

Autonomous Decision Making

Persistent Context Injection

Natural-Language Policy Violations

Natural-Language Policy Violations

Description-Behavior Mismatch

Natural-Language Policy Violations

Natural-Language Policy Violations

Intent-Code Divergence

Static analysis