Scan Report
5 /100
ocas-corvus
Corvus: exploratory pattern analysis engine for the system knowledge graph and skill journals. Detects routines, emerging interests, anomalies, stalled threads, and cross-domain opportunities.
Corvus is a purely declarative skill containing only documentation and JSON metadata; no executable scripts exist. The flagged base64 usage is standard GitHub API response decoding in the documented self-update mechanism, not code obfuscation.
Safe to install
No action needed. The skill is safe to use as-is.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | skill.json: reads ~/openclaw/data/ocas-corvus/, ~/openclaw/journals/*/, chronicl… |
| Filesystem | WRITE | WRITE | ✓ Aligned | skill.json: writes ~/openclaw/data/ocas-corvus/, ~/openclaw/journals/ocas-corvus… |
| Shell | NONE | NONE | — | No shell commands in any file. Self-update uses gh cli, documented and scoped to… |
| Network | NONE | READ | ✓ Aligned | Self-update fetches remote version from GitHub API — documented in SKILL.md |
1 Critical 2 findings
Critical Encoded Execution Base64 编码执行（代码混淆）
base64 -d SKILL.md:240 Info Email 邮箱地址
[email protected] skill.json:6 File Tree
7 files · 24.3 KB · 623 lines Markdown 6f · 604L
JSON 1f · 19L
├─
▾
references
│ ├─
curiosity_engine.md
Markdown
│ ├─
journal.md
Markdown
│ ├─
pattern_engines.md
Markdown
│ └─
schemas.md
Markdown
├─
README.md
Markdown
├─
skill.json
JSON
└─
SKILL.md
Markdown
Security Positives
✓ No executable scripts or code files — entire package is declarative documentation and JSON
✓ All filesystem access is explicitly declared and scoped to specific project directories
✓ Self-update mechanism is fully documented with source verification via gh CLI
✓ base64 -d at SKILL.md:240 decodes a GitHub API JSON response (standard format), not hidden code
✓ No sensitive path access (no ~/.ssh, ~/.aws, .env access)
✓ No credential harvesting or environment variable iteration
✓ No obfuscation techniques — all Markdown files are human-readable
✓ No cron/scheduled task hooks beyond documented background jobs registered via openclaw CLI