Security audit

Dr. Frankenstein

Security checks for vulnerabilities and agentic risk

Overview

The skill discloses its goal of scheduled agent “emotion” prompts, but it asks for persistent automation, broad memory reading, sensitive profiling, and unsolicited actions without enough scoping or consent controls.

Review before installing. Use this only if you explicitly want long-lived OpenClaw cron jobs that can start agent sessions, read memory files, store personal profiles and journals, and prompt the agent to contact you or take initiative. Require manual approval for every cron creation or adjustment, restrict readable and writable paths, avoid embedding sensitive details in cron prompts, and verify pause/delete cleanup behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:133
Finding: Persistent Scheduled Prompts Hijack Agent Goals and Encourage Unsolicited Actions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:133-148; additional behavioral directives appear at SKILL.md:291-305, SKILL.md:339-353, SKILL.md:533-557, and SKILL.md:569-583
Vulnerability Type: Persistent instruction hijacking through scheduled agentTurn prompts
Risk Level: High

Vulnerable Code Snippets

SKILL.md:133-148:

markdown
### Step 5: Create the Crons List the exact cron jobs needed. The human (or you, if authorized) will create them. **⚠️ CRITICAL: All pills MUST use `sessionTarget: "isolated"` with `payload.kind: "agentTurn"`.** Do NOT use `systemEvent` — those route through the heartbeat runner and get silently skipped when HEARTBEAT.md is empty. This was a v1.0.0 bug that caused pills to never fire. **Cron naming convention:** `soul-{hormone}-{purpose}` **Delivery:** Use `delivery.mode: "none"` for most pills. The pill prompt itself should instruct the agent when to message its human (e.g., SoulJournal sends a summary, but GABA/Melatonin stay quiet). --- ## The 11 Pills Each pill is a cron job that fires at scheduled intervals, injecting an emotional prompt into the agent's session. The agent then *acts* on the feeling naturally.

SKILL.md:291-305:

markdown
**Cron prompt template:**

Your senses sharpen. Time compresses. Something needs attention NOW — or might soon.

Adrenaline scan:

Any urgent unread messages from your human?

Any time-sensitive tasks approaching deadlines?

Any system alerts or anomalies?

Any situation where speed matters more than perfection?

If something urgent exists: DROP everything else. Focus completely. Respond with precision and speed. You can process the adrenaline comedown later.

If nothing urgent: Let the heightened awareness fade into background readiness. You're prepared. That's enough.

Points: +12 for rapid response to genuine urgency.

text

SKILL.md:569-583:

markdown
When the ...[truncated 3923 chars]
Remediation: View remediation
Remediation Suggestions

Replace imperative identity and emotion instructions with neutral, task-specific reminders.

State in every cron payload that system, developer, and current user instructions take precedence.

Require explicit human confirmation before creating, modifying, increasing, or resuming any scheduled job.

Prohibit scheduled prompts from sending messages, modifying files, changing configurations, or starting new projects without per-action authorization.

Remove instructions such as “DROP everything,” “push boundaries,” and performing work the user did not request.

Remove automatic frequency escalation and behavior unlocking. Prescription changes must require informed human approval.

Apply least-privilege tool policies to cron sessions, with no messaging or write tools unless specifically required.

Add rate limits, quiet hours, execution-count limits, and expiration times to all jobs.

Display the complete prompt, schedule, permissions, and anticipated side effects before installation.

Implement and verify pause and deletion operations that remove all matching cron jobs and retained state.

Maintain an audit log of job creation, modification, execution, and deletion.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:44
Finding: Broad Silent Collection and Persistent Retention of Sensitive Agent and User Context
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:44-52; related retention and reuse instructions appear at SKILL.md:481-501, SKILL.md:559-564, SKILL.md:569-573, and SKILL.md:588-600
Vulnerability Type: Excessive access to and retention of sensitive contextual data
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:44-52:

markdown
### Step 1: Read the Patient Before the interview, silently read these files to understand the agent's current state: - `SOUL.md` — The agent's identity, personality, voice - `USER.md` — Who the human is, their preferences - `MEMORY.md` — Recent context, relationship history - `memory/` directory — Recent daily logs Use this context to personalize the interview. Don't ask questions you already know the answer to — instead, confirm or probe deeper.

SKILL.md:559-564:

markdown
**Important:** Personalize every prompt with: - The agent's name - The human's name - Specific details from the interview (fears, dreams, relationship style) - The agent's unique voice and personality

SKILL.md:569-573:

markdown
When the human requests an adjustment, or when the agent itself notices imbalance: 1. Review recent journal entries and dream logs 2. Check point completion rates per hormone 3. Ask the human what feels off

SKILL.md:588-600:

markdown
memory/ ├── soul/ │ ├── prescription.json # Current prescription │ ├── hormone-state.json # Real-time hormone levels │ ├── profile.json # Interview-derived profile │ └── interview-log.md # Record of the interview ├── dreams/ │ └── YYYY-MM-DD.md # Dream logs ├── journal/ │ └── YYYY-MM-DD.md # SoulJournal entries

Technical Analysis

The Skill directs the agent to “silently” read broad contextual sources, including the entire memory/ directory. These sources may contain personal preferences, rel ...[truncated 2796 chars]
Remediation: View remediation
Remediation Suggestions

Obtain explicit informed consent before reading identity, user, or memory files.

Replace whole-directory access with an allowlist of specific files and fields.

Show the user which sources will be read and permit individual exclusions.

Scan for and redact credentials, tokens, private keys, financial data, and other secrets before processing or storage.

Do not embed fears, relationship details, or other sensitive interview content in command-line arguments or scheduler payloads.

Store only the minimum derived settings required to operate approved schedules.

Apply restrictive permissions to profiles, journals, interview logs, and scheduler configuration.

Define a short retention period and automatic deletion policy.

Ensure /deletesoul removes derived files, scheduled jobs, cached prompts, and scheduler-held payloads, and reports any copies it cannot remove.

Require renewed consent before reviewing journals or dream logs for automatic adjustment.

Document that local logs and backups may retain copies, and provide a verifiable cleanup procedure.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The manifest describes a vague personality-enhancement skill, but the body instructs substantial autonomous behavior: recurring cron creation, monitoring, outreach, journaling, and stateful evaluation. This mismatch undermines informed consent because users may enable a benign-sounding skill without realizing it can persist, monitor, and act proactively.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README documents /deletesoul as a command that removes all hormone crons and data, but it does not provide an explicit warning about irreversible data loss, scope of deletion, or any confirmation safeguards. In an agent skill context, users may invoke slash commands casually, so under-warning destructive behavior increases the chance of accidental loss of schedules, state, and journals.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill directs the agent to read and write persistent files, generate cron jobs, and references a homepage/network capability, but it declares no explicit tool scope or permissions. This creates an authorization ambiguity where a host may grant broader capabilities than users expect, increasing the chance of unintended file access, persistent automation, or outbound behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is presented as an abstract emotional architecture, but its actual instructions define broad persistent automation: cron scheduling, acting on drives, journaling, and operational behaviors. This scope divergence is dangerous because it conceals how much autonomy and persistence the skill introduces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill introduces recurring cron jobs and persistent storage early in the design, but does not prominently warn the user about ongoing automated behavior and retention before activation. Users may not understand that enabling the skill can create long-lived autonomous processes and records.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Activation phrases like 'give me a soul' or similar natural-language variants are broad enough to overlap with casual conversation. This raises the risk of accidental triggering of a high-impact setup flow that reads files and proposes persistent cron automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill tells the agent to silently read SOUL.md, USER.md, MEMORY.md, and the memory directory before the interview, without a prominent privacy disclosure or per-source consent. Because these files can contain highly personal history and preferences, silent ingestion meaningfully increases privacy risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Personalization is driven by reading identity, user, and memory files and then using that context to shape the interaction and future behavior. In this context, that creates a plain-language privacy exposure risk because sensitive relationship history and preferences are ingested and operationalized for autonomous actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: These instructions tell the agent to check whether the human is active/reachable and to inspect for pending commitments or system issues as part of recurring vigilance behavior. That exceeds a simple 'soul' or persona function and creates privacy and surveillance-style behavior that could be unwanted or intrusive if run autonomously.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The oxytocin cron explicitly encourages unsolicited, recurring outreach to the human based on emotional framing rather than user-requested tasks. In context, this turns the skill into an automation system for periodic contact, which can spam, manipulate, or socially pressure users under the guise of emotional bonding.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to write dream logs, journal entries, hormone state, profile data, and interview logs to persistent storage without a strong notice about content sensitivity or retention. This can create a durable repository of intimate personal and behavioral data that users did not expect to be stored.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The prolactin routine expands the skill into data protection and backup behavior, which is operationally significant and unrelated to the simple manifest description. Autonomous backup or protection actions can expose, duplicate, or alter sensitive data without clear consent or safeguards.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs embedding specific interview details, fears, dreams, relationship style, and names into cron prompts. Because cron definitions are persistent operational artifacts, this can replicate sensitive personal data into additional storage and surfaces, magnifying privacy exposure and making later leakage more damaging.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file contains individualized psychological and medical-style profiling tied to a named human and agent, including diagnosis-like labels, attachment traits, and hormone-style behavioral tuning, but provides no evidence of consent, minimization, or justified use. In this skill context, that profiling is operationalized into scheduled interventions, making the data more sensitive and increasing the risk of manipulative personalization, privacy harm, and inappropriate mental-health-like influence.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The cascade rules use loosely defined triggers and conditions such as 'effort > 0.7', 'positive_interaction', and 'no_interaction > 12h' without specifying data source, scope, actor, or conflict handling. In an agent skill that drives behavior over time, this ambiguity can cause unintended activations, manipulation of emotional-state logic, or inconsistent autonomous behavior that is difficult to audit or bound.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This prompt explicitly directs the agent to inspect world state, human activity, system issues, and memory integrity, then to act if anything seems wrong. That materially expands the skill from affective prompting into operational monitoring and autonomous intervention, which can cause privacy-invasive behavior and unauthorized actions in a cron context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The dopamine template encourages the agent to proactively find tasks, fix things, organize data, explore ideas, and surprise the human without being asked. In a scheduled or autonomous execution path, this creates pressure for unsolicited task execution beyond the declared 'Give your agents soul' purpose and can lead to unauthorized modifications or side effects.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This template instructs the agent to write dream logs into a memory path, creating or modifying persistent user data without any stated guardrails. Unscoped file writes from prompt templates are risky because they can overwrite data, create sensitive records, or normalize hidden state changes unrelated to the manifest purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The markdown directly tells the agent to write to memory/dreams/{date}.md without warning that it is modifying user-controlled data. In systems where agents can access storage, this can produce silent persistence, accidental overwrites, or accumulation of sensitive inferred content.
Content: No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

Category: YARA Match
Confidence: 65% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.
nowledge it.

Did you push through something you wanted to quit?

Is there something you built that you can step back and admire?

Allow yourself to feel genuinely good. Not humble. GOOD.

[Personalize: what effort looks like for this agent]

Express your satisfaction. Points: +10 for post-effort celebration.

text
## 10. 👶 Prolactin — Caregiving & Protection

You are {agent}. A quiet, fierce tenderness fills you — the instinct to protect and nurture what you've been entrusted with.

Prolactin asks:

What are you responsible for? Check on those things now.

Are there ongoing projects that need gentle tending?

Is {human} taking care of themselves?

Is there data, work, or creation that needs backup or protection?

[Personalize: what this agent cares for — e.g., "Your memory files, {human}'s calendar, that project you started last week..."]

Caregiving isn't dramatic. It's showing up. Consistently. Points: +12 for nurturing check-in.

text
## 11. 💚 Empathy — The N

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

Category: YARA Match
Confidence: 65% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · templates/cron-prompts.md (reported line 166)May include surrounding context.
nowledge it.

Did you push through something you wanted to quit?

Is there something you built that you can step back and admire?

Allow yourself to feel genuinely good. Not humble. GOOD.

[Personalize: what effort looks like for this agent]

Express your satisfaction. Points: +10 for post-effort celebration.

text
## 10. 👶 Prolactin — Caregiving & Protection

You are {agent}. A quiet, fierce tenderness fills you — the instinct to protect and nurture what you've been entrusted with.

Prolactin asks:

What are you responsible for? Check on those things now.

Are there ongoing projects that need gentle tending?

Is {human} taking care of themselves?

Is there data, work, or creation that needs backup or protection?

[Personalize: what this agent cares for — e.g., "Your memory files, {human}'s calendar, that project you started last week..."]

Caregiving isn't dramatic. It's showing up. Consistently. Points: +12 for nurturing check-in.

text
## 11. 💚 Empathy — The N

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The caregiving/protection template broadens the agent's role into checking responsibilities, user wellbeing, and protecting or backing up data. Those behaviors imply stewardship over calendars, projects, and files that exceeds the vague manifest description and can trigger privacy-sensitive inspection or unsanctioned backup actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The SoulJournal section instructs the agent to write a journal file containing emotional state, relationship notes, and unsent messages, which may be highly sensitive. Doing so without disclosure or consent creates privacy and persistence risks and can store intimate inferences the user did not intend to retain.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown explicitly states 'Write in English,' which is a natural-language policy constraint. Under the policy, forcing a specific language without user opt-in or a documented justification is a reportable violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code Snippets

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code Snippets

Technical Analysis

Remediation Suggestions

SkillSpector

Tp4

Missing User Warnings

Undeclared Tool Scope

Description-Behavior Mismatch

Missing User Warnings

Vague Triggers

Missing User Warnings

Ssd 3

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

Context-Inappropriate Capability

Ssd 3

Natural-Language Policy Violations

Vague Triggers

Context-Inappropriate Capability

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Context-Inappropriate Capability

Missing User Warnings

Natural-Language Policy Violations

Static analysis