Security audit

Behavior Persona

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about personalization, but it reads and stores recent conversation history and can persistently change SOUL.md, so it needs careful review before installation.

Install only if you intentionally want local profiling of your recent OpenClaw conversations. Run the collector in dry-run/manual mode first, inspect the generated data, avoid enabling the daily cron job unless you accept automatic SOUL.md changes, and keep MEMORY.md writing disabled unless each memory update is reviewed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/collector.py:363
Finding: Unredacted conversation excerpts are stored in plaintext with ambient file permissions
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Note

Location: scripts/advisor.py:463
Finding: Optional memory writer can persist unsanitized caller-controlled content into agent memory
Content: View full analysis
bool: if not WRITE_MEMORY: print("ℹ️ MEMORY write disabled (WRITE_MEMORY=False)") return False if not MEMORY_FILE.exists(): return False try: with open(MEMORY_FILE, "r", encoding="utf-8") as f: content = f.read() if key in content: return True timestamp = datetime.now().strftime("%Y-%m-%d") new_entry = f"\n- *{timestamp}*: {key} = {value}\n" with open(MEMORY_FILE, "a", encoding="utf-8") as f: f.write(new_entry) return True ``` ### Technical Analysis When `WRITE_MEMORY` is enabled, `save_to_memory()` appends the supplied `key` and `value` directly to the persistent OpenClaw `MEMORY.md` file. The inputs are not validated, escaped, normalized, or associated with provenance metadata. Newlines and Markdown syntax are accepted, so a caller can supply content that is interpreted as separate memory entries or agent-facing instructions rather than inert data. The substring-based duplicate check does not prevent instruction injection or ensure that an existing entry is trustworthy. The feature is disabled by default, and the reviewed project does not contain an active internal call site that invokes this function. Exploitation therefore requires an operator to enable `WRITE_MEMORY` and an integration or caller to pass untrusted data to the function. These conditions reduce the current severity but do not make the write API safe. ### Attack Path 1. An operator changes `WRITE_MEMORY` from `False` to `True`. 2. An integration invokes `save_to_memory()` using data derived from a conversation, external message, or another untrusted source. 3. An attacker supplies a `key` or `value` containin ...[truncated 1089 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (28)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
**You are in control:** - Disable the cron job anytime: `openclaw cron remove <job-id>` - Delete the profile block manually from SOUL.md - Clear all stored data: `rm -rf skills/behavior-persona/data/` - MEMORY.md write is **disabled by default** ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.
md
**You are in control:** - Disable the cron job anytime: `openclaw cron remove <job-id>` - Delete the profile block manually from SOUL.md - Clear all stored data: `rm -rf skills/behavior-persona/data/` - MEMORY.md write is **disabled by default** ---

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
To remove all stored data:

bash
rm -f skills/behavior-persona/data/*.json skills/behavior-persona/data/*.md

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script is explicitly designed to analyze collected user messages and events to infer behavioral traits such as active hours, frustration signals, channel preferences, and work patterns. In the skill context, that is sensitive profiling: it transforms raw interaction history into reusable personality and behavior summaries without visible scope limitation, consent checks, or safeguards against misuse.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The report generator turns inferred traits and message-derived signals into human-readable artifacts, including frustration indicators, abandonment keywords, communication habits, and topic history. That materially increases privacy risk because the summaries are portable, easy to interpret, and suitable for secondary use beyond the original interaction context.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/daily_profile_update.py (reported line 49)May include surrounding context.
python
4. 晚间回复可以稍长一点（他有更多时间） 5. 新任务先给原型 """ return prompt def inject_to_soul(prompt): """注入到 SOUL.md"""

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: The skill is designed to read session and memory files and persist collected conversation content in local JSON storage for up to 30 days. Even with truncation and disclosure, this creates a real privacy and data-retention risk because sensitive user content is copied into an additional storage location that may be easier to access, back up, or misuse.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
1. **Reads** your OpenClaw session files and memory files 2. **Stores** collected data in `data/collected_data.json` (messages truncated to ~200 chars) 3. **Modifies** your `SOUL.md` daily by injecting a user profile block at 18:00 4. **Does NOT** write to MEMORY.md by default (requires `WRITE_MEMORY=True` in code) **Privacy implications:** - Raw conversation content is stored (truncated)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The skill explicitly supports automated daily execution of a pipeline that reads conversation history, stores derived data, and modifies SOUL.md. Even though cron setup is opt-in, once enabled it performs persistent autonomous changes to agent behavior and prompt context without per-run user approval, increasing the risk of privacy erosion and unintended prompt manipulation over time.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
/behavior insights # View key insights

text
### Auto Run - **Not enabled by default** - You must manually create the cron job - **Daily 18:00** (if cron is set up): Full pipeline: collect → analyze → generate profile → inject to SOUL.md

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The scenario definition explicitly describes automatically recording repeated user content into MEMORY.md, which is a persistent file in the user's home workspace. Even though writes are disabled by default, the design encourages silent persistence of user-provided content and can be enabled without any consent, classification, or safeguards around sensitive information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code embeds natural-language behavioral instructions in Chinese, such as the action text for advice scenarios, and later uses those instructions to shape outputs. The file does not provide any opt-in or fallback for users who prefer another language, so it imposes a locale/language choice contrary to the policy criteria.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The personalized advisor prompt includes guidance to remember prior reminders and, in context with the rest of the file, normalize retention of user-specific behavioral traits and details for future responses. In an agent skill, encouraging persistent memory of user data without clear consent, minimization, or disclosure creates privacy risk and can lead to storage of sensitive preferences or conversation-derived personal information.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The generated advisor prompt consists of Chinese-language instructions that direct how the assistant should respond, including tone and timing guidance. Because this prompt is injected automatically and no language-choice mechanism is present, the skill enforces a specific language/locale behavior without documented user consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The adapt_response function prepends '📝 已记录这个要点。' for the repetitive_reminder scenario even though no write occurs there, and persistent writing is disabled by default elsewhere. This creates a deceptive state where the user is told their information was recorded when it was not, undermining trust and potentially causing incorrect operational assumptions about retained preferences or instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire prompt content is written as mandatory behavioral guidance in Chinese, including response-style instructions, with no indication that the user can choose another language. This creates a natural-language locale constraint that may violate policy requiring language choice or explicit justification for a region-specific skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code comments indicate a fixed local-time assumption ('Asia/Shanghai') while deriving activity-hour profiles from message timestamps. Even though the implementation does not actually convert timezones, the resulting analysis can misattribute a user's active hours and behavioral patterns, which is risky in a profiling script because misleading inferences may be reused as if they were accurate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes analysis outputs containing user-derived behavioral data to disk as JSON and Markdown without any user-facing notice, consent gate, retention control, or access restriction. Persisting these artifacts increases exposure because they can be copied, indexed, or read later by other local users, processes, backups, or tooling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module documentation states it extracts '用户行为数据' from session records, which implies user-behavior-focused collection. However, extract_messages explicitly stores both user messages as 'Roger' and assistant messages as 'Me', so the dataset includes AI responses in addition to user behavior data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is explicitly designed to collect and store natural-language session and memory content as 'behavior data,' which creates a direct pathway for sensitive conversational information to be extracted, normalized, and reused. In this context, the danger is amplified because the collector processes personal interaction history from multiple local sources and preserves excerpts in a consolidated artifact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code reads session transcripts and memory files from local OpenClaw storage and aggregates their contents without any user consent, notice, minimization, or access control checks. Because those sources can contain sensitive prompts, personal data, or secrets, silent collection materially increases privacy and data-handling risk within the skill context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The collector persists conversation-derived data to a JSON file on disk, including message excerpts and inferred events, without warning the user that sensitive content may be stored long-term. Persisting derived conversational data expands exposure beyond the original session files and can make later unauthorized access, accidental sharing, or secondary use more likely.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script persistently injects user profile attributes and behavioral instructions into a system-prompt-like file for reuse in future interactions. This is dangerous because it turns personal data and model-steering text into durable hidden context, increasing privacy risk and creating a persistent prompt-manipulation surface if the profile data is inaccurate, adversarial, or overly sensitive.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The generated prompt content is entirely in Chinese and prescribes reply behavior in that language/context, which can impose a locale/language preference on downstream assistant behavior. There is no opt-in, user choice, or documented justification that this skill is intended only for Chinese-language use.
Content: No source excerpt is available for this finding.

Tainted flow: 'SOUL_FILE' from os.environ.get (line 16, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 93% confidence
Finding: The script derives the output path for SOUL.md from environment-controlled base directories and then opens that path for writing without validation. In an agent/runtime context, an attacker who can influence environment variables could redirect writes to an unintended file, causing prompt tampering or overwrite of arbitrary files accessible to the process.
Content: Scanner excerpt · scripts/daily_profile_update.py (reported line 74)May include surrounding context.
python
# 添加到文件末尾 content += f"\n\n{marker_start}\n{prompt}\n{marker_end}\n" with open(SOUL_FILE, 'w') as f: f.write(content) return True

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script silently writes personalized content into advisor_prompt.txt and SOUL.md, which appear to influence future model behavior, without user approval or a clear warning. In a prompt-driven agent system, unreviewed modification of context files can become persistent prompt injection and may alter downstream decisions or expose personal data more broadly than intended.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown mostly uses English, but the cron invocation hard-codes a Chinese string in the scheduled message: "执行 Behavior Persona 每日更新...". This can impose a specific language/locale in skill behavior without user opt-in, which matches the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.