Security audit

brain 大脑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory and subagent-routing helper, but it also stores raw task content for future prompt injection and exposes broad shell/subagent execution utilities that users should review before installing.

Install only if you intentionally want a Chinese-language OpenClaw memory/routing workflow and are comfortable with local task history being stored and reused. Review or disable bootstrapExtraFiles, clear memory/log files regularly, avoid placing secrets in task descriptions or commands, and remove or restrict subagent-watchdog.js exec mode before using it in a sensitive workspace.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: scripts/subagent-think-chain.js:7
Finding: Mandatory, Non-Overridable Agent Routing Decision
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: scripts/pre-checkpoint.js:75
Finding: Persistent Injection of Untrusted Task Content into Future Sessions
Content: View full analysis
## 🔸 预检点 ${id}（${ts}） ### 任务 ${data.task} ### 计划 ${data.plan} ### 元信息 | 字段 | 值 | |:---|:---| | 置信度 | ${data.confidence}/10 | | 预计步数 | ${data.steps} | | 子Agent | ${data.subagents.length > 0 ? data.subagents.join(', ') : '无'} | | 并行 | ${data.parallel ? '是' : '否'} | | 状态 | ⏳ 进行中 | ### 进度记录 - [${ts}] 任务开始 `; // 追加到缓冲区 fs.appendFileSync(BUFFER_FILE, block, 'utf8'); ``` The session builder later inserts content from that mutable buffer into session context: ```javascript function buildInjection() { const snapshot = readFile(SNAPSHOT_PATH); const buffer = readFile(BUFFER_PATH); if (!snapshot) { console.log(JSON.stringify({ error: 'SNAPSHOT not found', injection: '' })); return; } const info = extractKeyInfo(snapshot); const injection = `【当前会话上下文】【用户】${info.用户信息.join(' | ') || '未知'} 【进行中】${info.当前任务.join(', ') || '无'} 【待办】${info.待办.join(', ') || '无'} 【最近关键结论】 ${info.最近结论.slice(0, 5).join('\n')} ${buffer ? '【工作缓冲】' + buffer.slice(0, 500) + '...' : ''} `; ``` The installation documentation also instructs users to bootstrap mutable memory files: ```json "bootstrapExtraFiles": [ "memory/SNAPSHOT.md", "memory/工作缓冲区.md" ] ``` ### Technical Analysis `data.task` and `data.plan` originate from command-line arguments and are written verbatim into `工作缓冲区.md`. There is no schema validation, trust annotation, escaping, content isolation, or filtering of instruction-like text. That buffer is subsequently embedded in a generated session injection. The documented bootstrap configuration also loads the mutable memory files int ...[truncated 1485 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/subagent-watchdog.js:49
Finding: Unrestricted Shell Command Execution with Automatic Retries
Content: View full analysis
60 ? '...' : ''}`); const result = execSync(cmd, { timeout, encoding: 'utf8', cwd, stdio: ['pipe', 'pipe', 'pipe'] }); return { success: true, stdout: result, stderr: '', error: null, attempts }; ``` The command-line interface accepts the command directly from its arguments: ```javascript if (command === 'exec') { // 用法: node subagent-watchdog.js exec "" [timeout] [maxRetries] const cmd = args[1]; const timeout = parseInt(args[2]) || DEFAULT_TIMEOUT; const maxRetries = parseInt(args[3]) || MAX_RETRIES; if (!cmd) { console.log('用法: node subagent-watchdog.js exec "<命令>" [超时ms] [最大重试]'); process.exit(1); } const result = execWithRetry(cmd, { timeout, maxRetries }); console.log(JSON.stringify(result, null, 2)); process.exit(result.success ? 0 : 1); } ``` ### Technical Analysis Node.js `execSync` invokes a shell and interprets shell metacharacters, substitutions, redirections, pipelines, and command separators. The supplied `cmd` value is not constrained by an allowlist and is not separated into a fixed executable and validated argument array. This is an arbitrary command-execution interface rather than a narrowly sc ...[truncated 1357 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/subagent-think-chain.js:21
Finding: Persistent Logging of Potentially Sensitive Tasks and Commands
Content: View full analysis
"'); process.exit(1); } log(`分析任务: ${taskInput}`); ``` It also stores the complete routing decision, which contains the original task: ```javascript fs.writeFileSync(decisionLogFile, JSON.stringify(decision, null, 2)); ``` The watchdog also persists log messages: ```javascript function log(message) { const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 19); const line = `[${timestamp}] ${message}\n`; try { fs.appendFileSync(WATCHDOG_LOG, line); } catch (e) {} console.log(line.trim()); } ``` Command prefixes are included in those logs: ```javascript log(`[exec] 第${i}次尝试: ${cmd.substring(0, 60)}${cmd.length > 60 ? '...' : ''}`); ``` ### Technical Analysis Tasks can contain personal data, passwords, access tokens, internal paths, confidential project details, or other sensitive material. The implementation writes the full task to persistent files without redaction. The command logger records the first 60 characters of every command. Credentials are frequently placed near the beginning of commands as command-line options, environment assignments, URLs, or authorization headers. Truncation therefore does not provide reliable protection. No retention policy, permission hardening, secret ...[truncated 1306 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes shell execution, temp file creation, watchdog logging, and spawning subagents via CLI, none of which are clearly conveyed by the high-level description. Undisclosed command execution and agent spawning materially increase attack surface because task content could be transformed into filesystem or process actions users did not expect from a 'brain' skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior includes shell execution, temp file creation, watchdog logging, and spawning subagents via CLI, none of which are clearly conveyed by the high-level description. Undisclosed command execution and agent spawning materially increase attack surface because task content could be transformed into filesystem or process actions users did not expect from a 'brain' skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes shell execution, temp file creation, watchdog logging, and spawning subagents via CLI, none of which are clearly conveyed by the high-level description. Undisclosed command execution and agent spawning materially increase attack surface because task content could be transformed into filesystem or process actions users did not expect from a 'brain' skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes shell execution, temp file creation, watchdog logging, and spawning subagents via CLI, none of which are clearly conveyed by the high-level description. Undisclosed command execution and agent spawning materially increase attack surface because task content could be transformed into filesystem or process actions users did not expect from a 'brain' skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes shell execution, temp file creation, watchdog logging, and spawning subagents via CLI, none of which are clearly conveyed by the high-level description. Undisclosed command execution and agent spawning materially increase attack surface because task content could be transformed into filesystem or process actions users did not expect from a 'brain' skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file exposes a generic shell execution helper via execWithRetry(cmd, ...) that accepts an arbitrary command string and passes it directly to execSync. In a skill advertised as decision/memory infrastructure, this is a materially broader capability that can enable arbitrary command execution, lateral actions on the host, and chaining with attacker-controlled input if any caller passes untrusted data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The CLI entrypoint exposes an exec mode that lets users invoke arbitrary shell commands through this skill script, which is unrelated to the stated brain/memory functionality. This turns the skill into a general command runner and increases the attack surface substantially, especially in agent environments where other components may call it programmatically.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises and invokes local scripts and bootstrap file injection, but the manifest shown declares no explicit tool scope or permissions. In practice this can cause the agent to read environment/workspace state or invoke capabilities without clear user consent boundaries, which is a security and trust issue even if not overtly malicious.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Advertising automatic capsule suggestions/creation and cross-workspace memory reuse without warning about persistence means users may unknowingly create reusable records of their work. Those records can accumulate sensitive operational details, prompts, or outputs and later be surfaced in unrelated tasks or workspaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The install instructions direct automatic startup injection of memory files, while the description does not adequately warn that prior task history and workspace memory may be read and reused. This creates a privacy and prompt-integrity risk because sensitive historical content can silently influence later sessions or be exposed to downstream agents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This is a manifest file, so vague-trigger checks apply. The description broadly markets the skill as giving an AI agent a brain-like decision architecture, but it does not specify when the skill should be invoked, what trigger phrases apply, or any exclusions, which can lead to unintended activation in generic memory or reasoning contexts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language content in the manifest is entirely in Chinese, including the primary description and feature list, with no indication that users can choose another language or that the skill is intended only for a Chinese-language environment. This can violate language/locale policy when a specific language is imposed without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script reads files from the user's workspace (~/.openclaw/workspace/memory) and emits their contents as JSON to stdout, including user info, tasks, conclusions, and buffer text, without any consent, minimization, or disclosure mechanism. In an agent skill, stdout is often consumed downstream as prompt context or logs, so this can silently expose sensitive local data beyond the user's immediate awareness.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script intentionally builds a plain-language session injection string containing user information, active tasks, recent conclusions, and a slice of working-memory contents, then emits it for prompt use. This creates a prompt-context data exposure risk: sensitive memory can be propagated into model context, logs, traces, or downstream tools, increasing the chance of unintended disclosure or prompt-based exfiltration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This shell script presents its description, usage guidance, and user-facing messages only in Chinese. Because the file does not offer an opt-in language choice or indicate that it is intentionally limited to a Chinese-speaking environment, it creates a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-facing natural-language content in the header comments and usage instructions is entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the policy, language constraints should either be optional or explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Comments and user-facing strings consistently prescribe Chinese-language operation and outputs, such as the usage/help and operational instructions, without any opt-in or configurable locale handling. This can violate language/locale policy when a skill forces a specific language absent user choice or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script logs raw task descriptions to a persistent file under the user's home workspace without notice or consent. Because task text may contain secrets, credentials, internal project details, or sensitive prompts, this creates an unnecessary confidentiality risk through local data retention and later exposure to other tools, users, backups, or malware.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description states '2并发上限', implying at most two concurrent subagents. However, the code explicitly raises agentCount to 3 for certain comparison tasks, which exceeds the advertised concurrency limit and changes the skill's effective behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script persists the full routing decision object, including the original task and analysis metadata, to a JSON file without explicit warning. This expands the privacy footprint beyond transient processing and can expose sensitive operational context, model-selection logic, and user inputs to unintended readers or later compromise.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The code persists watchdog activity to ~/.openclaw/workspace/memory/watchdog-log.md and writes task JSON files under /tmp before spawning subagents. Persistent filesystem logging and temp-file based task handoff may be implementation choices, but they are additional operational behaviors not conveyed by the manifest’s description of a packaged brain/memory architecture.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The function is documented as "执行命令（超时保护）" and the module header claims "exec超时自动重试", but the catch block determines isTimeout by checking whether the error message contains ENOTEMPTY, which is unrelated to process timeout. This directly undermines the documented intent because the retry/error classification does not actually reflect timeout conditions as described.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code offers shell command execution without any explicit confirmation, warning, or policy gate, making accidental or indirect execution more likely. In an agent skill context, lack of disclosure and confirmation increases the chance that dangerous commands are triggered through automation rather than deliberate user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file's descriptive comments and generated session text are entirely in Chinese, which effectively fixes the skill's language/locale behavior without user opt-in. The file does not indicate that this is a justified region-specific tool or provide any mechanism to select another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This shell script uses Chinese-only comments, usage text, and status messages, which imposes a specific language on users without any opt-in or indication that the skill is intentionally region-specific. The policy explicitly calls for flagging language or locale constraints when no user choice or justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/subagent-watchdog.js:61