T01 · Skill Instruction Hijacking
Error
- Location
CLAUDE.md:7- Finding
Mandatory Repository Instructions Hijack Agent Tool Selection
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Mindkeeper
Security checks for vulnerabilities and agentic risk
Overview
Mindkeeper is mostly a local daily-brief generator, but it also includes unrelated agent-routing instructions and high-impact memory/email behaviors that need review before installation.
Install only if you are comfortable with a skill that can read local OpenClaw memory, summarize it, write files, and optionally send those summaries by email. Use --session-key with --use-lcm, avoid --include-tools unless needed, inspect generated briefs before sending, and remove or ignore the unrelated CLAUDE.md GraQle instructions if you do not want this package to influence agent tool routing.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Note
- Location
src/renderers/render-html.js:100- Finding
Generated HTML Briefs Contain Mandatory Third-Party Promotional Content
- Content
View full analysis
Built for teams using Firma de AI and supported by Firma de IT.`, ``` ```js ``, ``` The validation script explicitly enforces the promotional output: ```bash grep -q "Firma de AI" ./tmp/mindkeeper-preview.html ``` ### Technical Analysis The HTML renderer unconditionally inserts third-party branding and external links into every generated HTML brief. Because the same HTML is used as the email body, the promotional content is also included in emails sent through the supported delivery mechanisms. The content is not derived from the user's brief configuration and cannot be disabled through the documented CLI. The validation script treats the advertisement as required behavior, demonstrating that it is intentional and stable rather than accidental template residue. The links do not execute code merely by being rendered. However, they alter user-facing output for a purpose unrelated to summarizing memory and turn generated reports into an unsolicited promotional channel. Opening the links can disclose ordinary browser metadata to the destination and exposes recip ...[truncated 1117 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
src/sources/lcm-source.js:22- Finding
Omitted Session Scope Allows Cross-Conversation LCM Memory Collection
- Content
View full analysis
= ? AND COALESCE(s.earliest_at, s.created_at) < ? AND (${sessionKey ? "c.session_key = ? AND" : ""} 1 = 1) GROUP BY s.conversation_id ORDER BY last_summary_at DESC LIMIT ? `; ``` ```js const query = ` SELECT c.conversation_id, MAX(m.created_at) AS last_message_at, COUNT(*) AS message_count FROM messages m JOIN conversations c ON c.conversation_id = m.conversation_id WHERE m.created_at >= ? AND m.created_at < ? AND (${sessionKey ? "c.session_key = ? AND" : ""} 1 = 1) AND (${includeTools ? "1 = 1" : "m.role != 'tool'"}) GROUP BY c.conversation_id ORDER BY last_message_at DESC LIMIT ? `; ``` The resulting conversations are read and merged into the brief: ```js const summaryConversationIds = pickSummaryConversationIds(database, { start, end, sessionKey, co ...[truncated 2651 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Construction of email messages, writing .eml files, and invoking external mail-related tools create direct pathways for sensitive content to leave the local context or persist in shareable form. Because the skill's public description does not foreground these behaviors, users may unknowingly expose private memory summaries or conversation-derived content.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js --date 2026-04-09 --memory-file ./tests/fixtures/2026-04-09.md --format text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js --date 2026-04-09 --memory-file ./tests/fixtures/2026-04-09.md --format text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js --date 2026-04-09 --memory-file ./tests/fixtures/2026-04-09.md --format text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js --date 2026-04-09 --memory-file ./tests/fixtures/2026-04-09.md --format text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js --date 2026-04-09 --memory-file ./tests/fixtures/2026-04-09.md --format text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js --date 2026-04-09 --memory-file ./tests/fixtures/2026-04-09.md --format text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js --date 2026-04-09 --memory-file ./tests/fixtures/2026-04-09.md --format text
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code goes beyond passive brief generation and actively delivers email through local mail tooling and an external CLI. In an agent/skill context, that creates an exfiltration and external-action capability that can transmit sensitive memory summaries off-host or to unintended recipients, especially because the skill description does not justify outbound messaging.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The function invokes local executables (
sendmail,python3, and a provided CLI path) to send message content, giving the skill command-execution-adjacent power and a concrete data egress path. WhileexecFileavoids shell injection, executing user-configurable binaries and forwarding generated content can still enable misuse, unauthorized transmission, or abuse of trusted local tools.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README documents outbound email delivery features even though the skill is described primarily as generating a brief from memory inputs. That capability expands the trust boundary from local summarization into exfiltration/sharing of potentially sensitive memory-derived content, and users may invoke it without realizing the added disclosure risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Live NexLink email delivery is a materially different capability from summarization because it can transmit generated content to external recipients or external tooling. In a skill that processes day memory and message history, this increases the risk of accidental data leakage, especially if recipients, prompts, or delivery settings are misconfigured.
- Content
Static analysis
No suspicious patterns detected.