Security audit

instant-genius

Security checks for vulnerabilities and agentic risk

Overview

This skill is not plainly malicious, but it makes broad persistent changes to how the agent remembers, acts, and initiates work without enough scoping or consent controls.

Install only if you intentionally want a persistent self-improving agent profile. Review the templates before appending them to AGENTS.md, SOUL.md, or HEARTBEAT.md, back up existing config, set restrictive permissions on memory files, and consider disabling automatic preference logging, HOT-tier promotion, proactive external monitoring, and any deletion of memory unless each change is confirmed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: templates/agents-additions.md:18
Finding: Conversation-Derived Instructions Can Poison Persistent Agent Memory
Content: View full analysis
.md` 5. 不要读不相关的 domain "以防万一" ### After Work - 纠正/强教训 → 立即写入对应的 self-improving 文件 - 模式使用 3 次/7天 → 提升到 HOT - 模式 30 天未用 → 降到 WARM - 模式 90 天未用 → 归档到 COLD - 不确认不删除 ### Writing Rules - 每条一个 bullet，简短具体 - 明确用户纠正 → 立即追加到 `~/self-improving/corrections.md` - 可复用全局规则 → 追加到 `~/self-improving/memory.md` - 领域特定教训 → 追加到 `~/self-improving/domains/.md` - 项目级覆盖 → 追加到 `~/self-improving/projects/.md` ``` The relevant learning-signal rules additionally identify user corrections, preferences, and repeated instructions as information to persist: ```markdown ### Signals to Log **纠正信号** → `~/self-improving/corrections.md`: - "不对..." / "错了..." / "实际上应该是..." - "我更喜欢 X，不是 Y" - "记得我总是..." - "别再做 X" - "为什么你一直..." **偏好信号** → `~/self-improving/memory.md`: - "我喜欢你..." - "总是给我做 X" - "永远不要做 Y" - "我的风格是..." **模式候选** → 跟踪，3 次后确认: - 同一指令重复 3+ 次 - 反复有效的工作流 - 用户表扬特定做法 ``` ### Technical Analysis The Skill instructs the Agent to convert conversation-derived content into persistent behavioral state. Explicit corrections are written immediately, reusable rules are placed in `~/self-improving/memory.md`, and repeated patterns can be promoted to the always-loaded HOT tier. The stored data is subsequently loaded before non-trivial work. This creates a durable instruction channel across sessions. The design does not: - Authenticate whether the person su ...[truncated 2590 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.sh:25
Finding: Persistent Conversation Memory Is Created Without Explicit Access Restrictions
Content: View full analysis
"$SELF_IMPROVING/memory.md" << 'EOF' ``` The workspace memory is created using the same pattern: ```bash mkdir -p "$WORKSPACE/memory"/{daily-learnings,.heartbeat} if [ ! -f "$WORKSPACE/MEMORY.md" ]; then cat > "$WORKSPACE/MEMORY.md" << 'EOF' ``` The injected instructions direct potentially private information into those files: ```markdown ### Memory Routing - 事实/事件/上下文 → `memory/YYYY-MM-DD.md` + `MEMORY.md` - 纠正/偏好/工作流/性能教训 → `~/self-improving/` ``` ### Technical Analysis The setup script creates directories with `mkdir -p` and files through ordinary shell redirection, but it does not set a restrictive `umask` or explicitly apply owner-only permissions. Consequently, actual permissions depend on the environment in which the script runs. Under a permissive `umask`, persistent memory files may be readable by other local users or processes. Existing directories and files are also accepted without checking ownership, symbolic-link status, or permission safety. The memory design stores facts, events, conversation context, preferences, corrections, project information, and workflow lessons as plaintext. No sensitive-data filtering, encryption, retention limit, or secure deletion mechanism is provided. ### Attack Path 1. The Skill is installed or executed in an environment with a permissive `umask`, unsafe pre-existing paths, or broader local filesystem access. 2. The setup script creates `~/self-improving/` and workspace memory files without explicitly enforcing owner-only permissions. 3. During later conversations, the Age ...[truncated 1367 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence

Findings (25)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 76% confidence
Finding: All user-facing instructions in the README are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase guidance is broad enough that an agent could invoke this skill from ordinary user language such as 'make me smarter' or similar setup requests without the user understanding that persistent behavioral and configuration changes will follow. In this skill's context, that is more dangerous because the advertised outcome includes self-improvement, proactive behavior, memory changes, and heartbeat modifications, which are high-impact agent behavior changes rather than a narrow one-off action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README instructs users or the agent to run a setup shell script and append template contents into core configuration files, but it does not warn about the security, persistence, or behavioral consequences of those modifications. In this skill's context, that is especially risky because the changes affect AGENTS.md, SOUL.md, and HEARTBEAT.md and are marketed as enabling autonomous learning, proactive behavior, and persistent memory, so a user may authorize sweeping changes without informed consent or review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises broad trigger phrases such as 'make me smarter', 'smart setup', and '一键变聪明', which are common natural-language requests and can easily match benign conversation. In an agentic environment, this raises the risk of unintended activation of a configuration-changing setup flow without a clear, scoped confirmation step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The quick-start instructions tell the user to run a setup script or let the agent do it automatically, but they do not clearly warn that the process modifies persistent local agent configuration files such as AGENTS.md, SOUL.md, and HEARTBEAT.md. This undermines informed consent and can lead users to approve configuration changes they do not understand.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The line stating that the agent will 'automatically complete all configuration' when the user says a trigger phrase creates an ambiguous auto-execution condition. Because the action performs persistent local changes, the lack of scope constraints or an approval gate makes accidental or contextually inappropriate execution more dangerous.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger phrases for logging corrections and preferences are broad enough to capture ordinary conversational statements as durable memory signals without clear exclusion rules or user confirmation. In a skill explicitly designed to make the agent more autonomous and self-improving, this can lead to silent over-collection of user preferences and behavioral drift based on incidental remarks.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 81% confidence
Finding: The memory promotion and demotion rules allow the agent to autonomously change persistence tiering based on inferred usage patterns, without requiring user review before promotions to always-loaded memory. In the context of an 'instant genius' skill that adds self-learning memory and proactive behavior, this increases the risk of the system solidifying incorrect inferences, retaining sensitive behavioral data, and altering future behavior without sufficiently informed consent.
Content: Scanner excerpt · references/learning-signals.md (reported line 56)May include surrounding context.
md
- Pattern used 3x in 7 days → promote to HOT - Pattern unused 30 days → demote to WARM - Pattern unused 90 days → archive to COLD - **Never delete without asking** ## Self-Reflection Template

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This shell script presents user-facing strings in Chinese, beginning with the header comment and continuing throughout execution, but does not indicate that the skill is intentionally region-specific or provide an opt-in language choice. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The script provisions persistent memory/state locations such as ~/.openclaw/workspace/memory, .heartbeat, and ~/self-improving without guardrails, enabling long-lived retention of behavioral signals, corrections, and state across sessions. In the context of an agent skill marketed as enabling self-improvement and proactive behavior, this persistence increases the risk of storing sensitive user data, unexpected profile buildup, or hidden state influencing future runs without explicit consent or retention controls.
Content: Scanner excerpt · scripts/setup.sh (reported line 104)May include surrounding context.
sh
fi # ============================================ # Step 2: Create memory directory structure # ============================================ echo -e "${BLUE}[2/6]${NC} 创建 memory 目录结构..."

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script reports setup as complete and states the agent is already 'smarter' even though the critical advertised changes are not actually applied; it only creates directories/files and tells a later agent to append templates manually. This can mislead users into believing autonomous memory, heartbeat, or behavioral controls are active when they are not, causing unsafe assumptions and misconfiguration in downstream operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These instructions establish persistent memory files for daily events, long-term memory, and self-improving records derived from user interactions, but they do not require notice, consent, minimization, or any sensitivity filtering. This creates a real privacy and data-retention risk because the agent is directed to store conversation-derived information across sessions by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to immediately append user corrections, preferences, and workflow lessons into persistent files without warning the user that this information will be retained. That is dangerous because it normalizes silent cross-session profiling and can capture sensitive or identifying behavioral data over time.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file explicitly tells the agent to persist user-provided corrections and preferences across sessions in named memory files. Persisting conversational preference data without consent, sensitivity checks, or retention rules is a genuine security and privacy issue because it creates lasting behavioral profiles that may later be misused or exposed.
Content: No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · templates/agents-additions.md (reported line 56)May include surrounding context.
md
- 23:00-09:00 不发主动通知（除非紧急） - 连续 3 次无回应则降低该类频率 ### Reverse Prompting Sources - 最近对话主题 - 用户的项目进展 - 行业趋势

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The proactive trigger 'anything genuinely useful to the user' is so broad that it can justify unsolicited activation in nearly any context, weakening boundaries around when the agent should initiate actions or notifications. In a skill specifically designed to increase autonomous behavior, this ambiguity makes overreach more likely and reduces user control.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: These instructions direct the agent to detect and log conversational signals such as habits, preferences, repeated behaviors, and style cues into persistent memory. This is dangerous because it encourages systematic collection of user behavioral data from ordinary conversation without transparent disclosure or meaningful consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction to delete outdated information from MEMORY.md authorizes silent modification of user data without an explicit warning, review step, or rollback mechanism. Even if intended as maintenance, an agent can misclassify important context as outdated, causing irreversible loss of useful historical knowledge or user preferences.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: These heartbeat additions expand behavior from local memory/self-improvement into proactive external monitoring and user notification. That creates scope creep: the agent may autonomously browse external sources, surface unsolicited recommendations, and act beyond the user's explicit setup intent, increasing privacy, autonomy, and trust-boundary risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Directing the agent to monitor AI news, tools, frameworks, and new GitHub/ClawHub skills is not necessary for basic 'make the agent smarter' setup and introduces an unbounded external-ingestion channel. This can expose users to prompt-injection risk from fetched content, increase network activity without clear consent, and encourage installation or recommendation of untrusted third-party skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written as prescriptive Chinese-language operational guidance, with no indication that users may opt into another language or locale. Under the policy rule for natural-language violations, forcing a specific language without user choice is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The skill content mixes Chinese and English phrasing but does not state whether the user can choose their preferred language for instructions or interaction. If organizational policy requires avoiding forced language defaults without opt-in, this may violate that requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The examples and trigger phrases are presented only in Chinese, including stylistic rules such as "永远不要用 '咱们'", with no indication that users can choose another language or that the skill is intentionally limited to Chinese-language interactions. This can amount to an implicit language policy constraint in natural-language instructions.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The listed triggers include general conditions like "Multi-step task completed" and "Output quality noticed as improvable," which could apply to a wide range of routine interactions. The file does not specify thresholds, exclusions, or examples of when reflection should not occur, increasing the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The here-document is single-quoted, so shell expansion does not occur. As a result, the comment/documented intent of 'Created: $(date +%Y-%m-%d)' implying a generated creation date contradicts what the code really writes into the file.
Content: No source excerpt is available for this finding.