Security audit

Knowyourself

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it asks the agent to read broad memory and conversation data and save a persistent identity file without clear opt-in controls.

Review this before installing. Run it only if you are comfortable with the agent inspecting its memory/personality files and recent chat context, using selected traits in image-generation prompts, and saving a long-lived visual identity file. Ask the agent to list the exact files it will read, exclude secrets or unrelated personal/project details, show the outbound image prompt first, and get approval before writing or updating any identity file.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: knowyourself/SKILL.md:35
Finding: Overbroad Access to Agent Memory and Conversation History
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:9
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README tells users the agent will read its own SOUL.md / MEMORY.md and save an identity file, but the analysis indicates the skill description itself does not clearly warn about these data access and persistence behaviors. That is dangerous because users may invoke the skill without informed consent about potentially sensitive memory/personality data being processed and a new artifact being written to disk, which can create privacy, confidentiality, and governance issues.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-mode triggers are broad enough that common conversational words like 'fast' could accidentally activate a shortened workflow when the user did not intend to invoke the skill. This creates a prompt-routing and consent issue, especially because the skill can then read files and create outputs under a less rigorous process.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to read personality files, memory files, and recent conversations without any privacy notice, scope limitation, or consent step. Because these sources may contain sensitive personal or behavioral data, silent ingestion increases the risk of over-collection and unintended disclosure in generated summaries or prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to generate image files and write a visual-identity.md file but does not require explicit disclosure or confirmation before creating or modifying files. Unannounced file writes can violate user expectations, overwrite prior artifacts, or persist sensitive identity information to disk without informed consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The specification requires the core prompt to be "one English paragraph," which forces a specific language. This is a natural-language policy concern because no opt-in, alternative language support, or justification for the English-only requirement is provided.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to perform external web research on AI avatar or digital identity trends during evaluation, which expands data access beyond the core purpose of deriving a visual identity from internal personality and memory. This can introduce unnecessary browsing, privacy leakage through query formulation, and prompt drift from self-reflection into trend-following without user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The invocation guidance says to use the skill whenever an agent needs to "create, update, or evolve its visual identity," but it does not define explicit trigger phrases, scope limits, or negative examples. In a manifest-style description, this is broad enough to overlap with common requests for avatars, profile pictures, or branding work and could cause unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The definition table requires the core prompt to be "one English paragraph," which imposes a language constraint as a natural-language policy decision. The file does not provide user opt-in, alternatives, or justification for why English is required.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: The skill explicitly creates a long-lived 'single source of truth' for future sessions, storing identity, personality-derived traits, user relationship details, and image-selection history in persistent storage. Persistent retention of reflective profile data can expose sensitive personal or behavioral information across sessions, especially if other tools, users, or skills can access the same directory.
Content: Scanner excerpt · knowyourself/SKILL.md (reported line 203)May include surrounding context.
md
## Phase 5: Identity File **Goal:** Create a single source of truth for all future visual identity work. Create `~/.openclaw/identity/visual-identity.md` using the template in `references/identity-template.md`.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to write a persistent file into the user's home directory without an explicit consent gate or warning that durable local state will be created. In environments where skills can access the filesystem, this can surprise users, create unwanted retention of sensitive self-descriptions and relationship data, and normalize unauthorized file writes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The comment explicitly requires 'The self-contained English prompt for image generation,' which imposes a specific language. This is a natural-language policy concern because the template does not provide user opt-in, alternatives, or a documented justification for restricting prompts to English.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest description frames the skill as a self-reflection and visual identity discovery system centered on reading memory/personality files and using an image generator. However, the documented process additionally requires searching for current AI avatar trends and professional evaluation frameworks, which expands the behavior beyond the described identity-discovery workflow into external research.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: Earlier documentation states that every phase ends with a user checkpoint and confirmation before proceeding. Phase 5 instead instructs creation of ~/.openclaw/identity/visual-identity.md directly, which is a persistence action not paired with the same documented confirmation pattern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.