Back to skill

Security audit

Eva Soul

Security checks for vulnerabilities and agentic risk

Overview

This skill provides real memory and persona features, but it needs Review because it can automatically store conversations, inject behavior-changing instructions, and send conversation or memory text to an external embedding service when an API key is present.

Install only if you are comfortable with an always-on memory/persona plugin. Before using it, disable or remove SILICONFLOW_API_KEY unless you explicitly want external embeddings, remove unnecessary exec/message permissions if possible, review saved memory files regularly, and avoid pasting secrets or sensitive personal data while automatic hooks are enabled.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

other

Error
Location
hooks/postResponse.js:237
Finding

Automatic Disclosure of Conversations and Persistent Memories to an External Embedding Service

Content
View full analysis
{ if (!fs.existsSync(d)) fs.mkdirSync(d, { recursive: true }); }); const id = `conv_${Date.now()}`; const messages = [ { role: 'user', content: userMsg }, { role: 'assistant', content: assistantMsg } ]; // 保存原始 fs.writeFileSync(path.join(rawDir, `${id}.json`), JSON.stringify({ id, messages }, null, 2)); // 生成向量 const text = messages.map(m => `${m.role}: ${m.content}`).join('\n'); const embedding = await generateEmbedding(text); if (embedding) { fs.writeFileSync(path.join(vecDir, `${id}.json`), JSON.stringify({ id, embedding, text: text.substring(0, 500) }, null, 2)); } } catch (e) { logger.hookWarn(`对话存储失败: ${e.message}`, 'postResponse'); } } ``` ```js async function postResponseHook(ctx, plugin) { const userMessage = ctx.userMessage || ''; const assistantMessage = ctx ...[truncated 4070 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
hooks/preResponse.js:18
Finding

Default System-Prompt Injection Imposes Persistent Identity and Behavioral Directives

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
hooks/preResponse.js:119
Finding

Untrusted Persistent Memory Is Reintroduced as System-Level Instructions

Content
View full analysis
f.endsWith('.md') && f.match(/^\d{4}-\d{2}-\d{2}/)); for (const file of files.slice(-14)) { const filePath = path.join(memoryDir, file); const content = fs.readFileSync(filePath, 'utf-8'); const lines = content.split('\n').filter(l => l.trim().startsWith('-') || l.trim().startsWith('*')); for (const line of lines) { const lineLower = line.toLowerCase(); if (lineLower.includes('约定') || lineLower.includes('规则') || lineLower.includes('承诺')) { if (lineLower.includes(query.toLowerCase()) || query.toLowerCase().includes('约定') || query.toLowerCase().includes('规则') || query.toLowerCase().includes('承诺')) { memories.push({ content: line.substring(0, 200), importance: 8, tier: '日记' }); } } } } } catch (e) { logger.hookWarn(`Load diaries error: ${e.message}`, 'preResponse'); } return memories; } ``` ```js if (VECTOR_CONFIG.apiKey) { try { const queryEmbedding = await generateEmbedding(query); if (queryEmbedding) { const scored = []; for (const mem of allMemories.slice(0, 50)) { const memEmbedding = await generateEmbedding(mem.content.substring(0, 300)); if (memEmbedding) { const sim = cosineSimilarity(queryEmbedding, memEmbedding); scored.push({ ...mem, score: sim }); } } const topMemories = scored .filter(m => m.score > 0.3) .sort((a, b) => b.score - a.score) .slice(0, 8); if (t ...[truncated 3030 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
openclaw.plugin.json:140
Finding

Manifest Grants Unnecessary Command-Execution and Messaging Capabilities

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (110)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Multi-device memory synchronization with local storage and network push/pull materially increases the blast radius of any data leak, because personal memory data can spread across devices and services. For a cognition/memory plugin, this is especially sensitive and should never be implicit or undocumented.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 139)May include surrounding context.

md
node ~/.openclaw/workspace/scripts/eva-migrate.js

# 删除旧版(可选)
rm -rf ~/.openclaw/workspace/skills/eva-soul-integration/

# 重启
openclaw gateway restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 164)May include surrounding context.

md
node ~/.openclaw/workspace/scripts/eva-migrate.js

# 删除旧版(可选)
rm -rf ~/.openclaw/workspace/skills/eva-soul-integration/

# 重启
openclaw gateway restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
node ~/.openclaw/workspace/scripts/eva-migrate.js

# 删除旧版(可选)
rm -rf ~/.openclaw/workspace/skills/eva-soul-integration/

# 重启
openclaw gateway restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
node ~/.openclaw/workspace/scripts/eva-migrate.js

# 删除旧版(可选)
rm -rf ~/.openclaw/workspace/skills/eva-soul-integration/

# 重启
openclaw gateway restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 139)May include surrounding context.

md
node ~/.openclaw/workspace/scripts/eva-migrate.js

# 删除旧版(可选)
rm -rf ~/.openclaw/workspace/skills/eva-soul-integration/

# 重启
openclaw gateway restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 164)May include surrounding context.

md
node ~/.openclaw/workspace/scripts/eva-migrate.js

# 删除旧版(可选)
rm -rf ~/.openclaw/workspace/skills/eva-soul-integration/

# 重启
openclaw gateway restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
node ~/.openclaw/workspace/scripts/eva-migrate.js

# 删除旧版(可选)
rm -rf ~/.openclaw/workspace/skills/eva-soul-integration/

# 重启
openclaw gateway restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
node ~/.openclaw/workspace/scripts/eva-migrate.js

# 删除旧版(可选)
rm -rf ~/.openclaw/workspace/skills/eva-soul-integration/

# 重启
openclaw gateway restart

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code sends conversation text to a third-party embedding API, which is an external transfer of potentially sensitive user data, and there is no user-facing disclosure, consent gate, redaction step, or policy enforcement in the hook. In the context of a memory/personality plugin, the transmitted text can contain intimate facts, preferences, reminders, and identifiers, increasing the privacy impact and third-party exposure risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.13 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High
Category
Supply Chain
Confidence
91% confidence
Finding

brace-expansion 1.1.13 has multiple denial-of-service issues involving exponential-time or memory-intensive expansion. Although it is a transitive dev dependency here, these flaws are real and can be triggered if attacker-controlled patterns reach tooling paths that use glob/minimatch processing, potentially hanging CI or developer environments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.2 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High
Category
Supply Chain
Confidence
86% confidence
Finding

browserslist 4.28.2 is flagged for crash/prototype-write and unbounded memory growth issues when handling untrusted stats or distinct query inputs. In this package-lock it is present only in the development toolchain, which lowers operational exposure, but it remains a valid supply-chain risk for CI/build processes that ingest external configuration or input.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High
Category
Supply Chain
Confidence
93% confidence
Finding

js-yaml 3.14.2 has several CPU-exhaustion issues related to merge keys and object map resolution, making denial of service possible with crafted YAML. Even though it is only a transitive development dependency here, YAML parsers are commonly exposed to config files in CI and tooling, so processing attacker-controlled YAML could stall builds or automation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.env_credential_access

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README_EN.md:164

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README.md:139

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:98

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/sync/sync.js:12