Security audit

Eva Soul

Security checks across malware telemetry and agentic risk

Overview

This memory/personality skill is not clearly malicious, but it needs Review because it stores raw chats and can send chat or memory text to external services with limited disclosure and controls.

Install only if you are comfortable with a long-term memory plugin retaining raw conversations under ~/.openclaw/workspace/memory. Do not set SILICONFLOW_API_KEY unless you intend to send prompts and memory text to SiliconFlow. Avoid shared machines, review or narrow the memory path, manually inspect/delete stored memory files, do not rely solely on autoMemory to prevent transcript writes, and back up before running migration cleanup commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The documentation and analyzer indicate the skill uses network and environment capabilities but declares no permissions, which breaks least-privilege expectations and prevents users from making an informed trust decision. In this plugin’s context, hidden access matters because it also stores conversation memory and interacts with external/local services, increasing the chance of unintended data exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated description presents a cognitive/personality plugin, but the detected behavior is substantially broader: prompt injection/modification, automatic memory persistence, local file ingestion, vector storage, summarization, external embedding calls, localhost model calls, and sync features. This mismatch is dangerous because users may install it for benign personality features without realizing it can collect, transform, persist, and transmit sensitive conversation and local data.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The hook sends full conversation text to a third-party embeddings API, which creates an external data disclosure path for potentially sensitive user content. In a memory/cognition plugin, conversations are likely to contain personal details, so transmitting them off-box without clear consent, minimization, or policy controls is a real privacy and security issue.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The hook transmits user-provided queries and, elsewhere in the same flow, stored memory contents to a third-party embedding API during normal response generation. Because this plugin is explicitly a personality/memory engine, those memories can contain highly sensitive diary-style or longitudinal personal data, making undisclosed external transmission a real privacy and data-exfiltration risk.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The hook persistently records a chat/tool-call counter in a workspace file under the user's home directory, even though this behavior is not implied by the skill's stated personality/emotion/memory purpose. Undisclosed persistence creates a privacy and transparency risk, and in a plugin context it can enable covert behavioral tracking across sessions without meaningful user awareness or consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The hook reads USER.md from a global workspace location at session start and imports its contents into plugin state without scoping, consent checks, or validating that the data is required for this plugin's own persisted state. In a plugin that models personality, memory, and owner relationships, this increases privacy risk and can also let unrelated workspace content influence behavior if that shared file is modified by another skill or process.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The page imports executable JavaScript from third-party CDNs at runtime, which creates a supply-chain and network trust risk: whoever controls the CDN response, a compromised dependency, or a man-in-the-middle on an untrusted network can execute code inside the panel. In this skill's context, that risk is more serious because the same page is designed to display sensitive local memory/state data, so external scripts could read and exfiltrate that data if the environment permits access.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly documents persistent storage of memory, emotion history, tags, concepts, and knowledge-graph data under a user workspace, but provides no warning about privacy, retention, or sensitivity of the stored content. For a plugin centered on memory and personality, users may unknowingly persist highly sensitive conversational data indefinitely, increasing risk of local disclosure, over-retention, and unsafe backups or migrations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly documents persistent storage of memory, concepts, patterns, knowledge graph data, and emotional memories under a user directory, but provides no privacy notice, retention policy, consent guidance, access controls, or warning that this may contain sensitive personal data. For a plugin centered on personality, memory, and emotion, this creates a real privacy and data-governance risk because users may unknowingly persist highly sensitive behavioral or emotional information on disk.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrase "状态" is a common everyday word and may activate the skill unintentionally during normal conversation. In a plugin that can modify prompt state, query memory, and expose internal status, accidental invocation increases the chance of unintended state changes or data disclosure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The migration instructions include a recursive deletion command without a strong warning about irreversibility, backup requirements, or validation of the target path. Even though the shown path is specific, users may copy, adapt, or run it in the wrong environment and lose data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Repeating the destructive deletion command in the migration guide reinforces risky behavior without adding safeguards or warning language. Because this skill manages memory/state files, careless cleanup could remove historical data users may expect to preserve.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The hook persistently stores full user and assistant messages locally, plus raw conversation files, without any visible consent, notice, retention controls, or access protections in this code path. This creates a privacy and confidentiality risk, especially because the plugin is explicitly designed to accumulate memory and personal traits over time.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The code transmits conversation text to an external service without any visible warning, consent, or data-classification checks. Because the transmitted text includes both user and assistant messages, this can expose personal, confidential, or regulated data to a third party outside the local trust boundary.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: generateEmbedding(text) sends the current user message to an external service with no user-facing notice or consent shown in this file. Even if embeddings are the intended feature, transmitting live user inputs off-device can expose sensitive prompts, secrets, or personal content to a third party.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The code computes embeddings over memory content (mem.content.substring(0, 300)) and sends that text to the external embedding provider. Since memories are sourced from long-term storage and diary files, this can leak intimate historical user data without explicit disclosure, which is more severe than sending a transient prompt alone.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The code writes a persistent chats counter to disk without any visible notice, consent flow, or local indication beyond the file itself. Even though the stored value is limited, silent persistence is a privacy-quality issue because it creates session-spanning telemetry that users may not expect from this type of skill.

Natural-Language Policy Violations

Medium

Confidence: 75% confidence
Finding: The plugin auto-detects locale from API config, user timezone, and process environment, then unconditionally applies it via logger.setLocale without explicit user choice. While not a high-severity issue, this can expose or infer user environmental metadata and override user expectations, which is a privacy and preference-handling weakness in a personality/memory plugin that processes long-lived user data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code sends raw user message text to a local LLM endpoint over plain HTTP for emotion analysis, and this file shows no consent, disclosure, or minimization before transmission. Even if the service is bound to localhost, prompts may contain sensitive personal content, and local-only transport does not eliminate privacy risk from logging, compromise of the local service, or unintended cross-component data exposure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The autoSave feature persists raw user messages to disk whenever broad natural-language keywords are detected, but there is no notice, consent flow, retention disclosure, or opt-out mechanism in this module. Because the triggers include highly personal phrases such as names, birthdays, reminders, likes, and fears, the component can silently collect sensitive personal data and create privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code transmits device identifiers and full memory data to a remote endpoint via pull/push without any visible consent flow, disclosure, authentication, or transport validation in this module. In the context of an AI memory/personality engine, those memories may contain highly sensitive personal data, so silent synchronization materially increases privacy and exfiltration risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: mergeToLocal overwrites local memory tier files with merged remote data using writeFileSync, with no backup, integrity check, conflict prompt, or user notification. Because the module handles persistent memory/state, silent overwrite can destroy local data, introduce untrusted remote content, and make tampering or accidental corruption difficult to detect and recover from.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The code is explicitly designed to fetch local files from a hard-coded memory directory via file:// when USE_LOCAL is enabled, but the interface provides no clear warning, consent, or disclosure to the user that local conversation memory and summaries may be read. In a plugin centered on AI memory and cognition, those files are likely to contain sensitive personal or conversational data, so silent local access materially increases privacy and data-handling risk.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The hook stores complete dialogues, extracted facts, tasks, and preferences, then preserves summaries in longer-term memory. This creates a durable natural-language profile of the user that could expose sensitive personal information if the memory store is accessed by other plugins, users on the host, backups, or future compromise.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The injected system prompt includes instructions like '记录一切 - 重要的事情一定要写下来', encouraging persistent storage of user-related information. In a memory-centric plugin this materially increases privacy risk, because the model is being nudged to over-collect and retain personal data that may later be exposed, misused, or transmitted externally.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.env_credential_access

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README_EN.md:164

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:139

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SKILL.md:98

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: lib/sync/sync.js:12