Security audit

Claw Brain

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real memory skill, but it installs persistent agent hooks and stores conversation/profile memory in ways users should review carefully before installing.

Install only if you are comfortable with a memory system that persists across sessions, writes startup hooks, and stores most conversation/profile data in plaintext by default. Prefer installing a pinned, reviewed release or from audited source, inspect the hook before enabling it, run it under a dedicated low-privilege user, and treat the encryption key and memory database as sensitive files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:79
Finding: Unpinned External Package Executes Code and Installs Unauditable Startup Hooks
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SECURITY.md:191
Finding: Sensitive Conversation and Profile Data Is Stored in Plaintext by Default
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (28)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY.md (reported line 184)May include surrounding context.
bash
# Remove the hook rm -rf ~/.openclaw/hooks/clawbrain-startup # Or disable events in skill.json # Set "events": [] instead of ["gateway:startup", "command:new"]

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SECURITY.md (reported line 184)May include surrounding context.
bash
# Remove the hook rm -rf ~/.openclaw/hooks/clawbrain-startup # Or disable events in skill.json # Set "events": [] instead of ["gateway:startup", "command:new"]

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The startup flow says the system loads memories and injects context into agent bootstrap. That is a direct semantic pathway for previously stored secrets, personal data, or sensitive conversation summaries to be resurfaced to the model at session start, increasing the chance of unintended disclosure, prompt leakage, or cross-session privacy violations.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 438)May include surrounding context.
md
- `SKILL.md` - This documentation

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 24)May include surrounding context.
md
### No Sudo Required (Core Installation) **Core installation and operation never require root privileges:** ✅ **Without sudo**: - `pip install clawbrain[all]` - Package installation

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 38)May include surrounding context.
md
- **Alternative**: Use shell environment variables instead (no sudo) - **Not required**: ClawBrain works with zero configuration **If you see sudo in documentation, it's only for optional systemd env var configuration, not core functionality.** ## Installation Security

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
- **Alternative**: Use shell environment variables instead (no sudo) - **Not required**: ClawBrain works with zero configuration **If you see sudo in documentation, it's only for optional systemd env var configuration, not core functionality.** ## Installation Security

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
- **Alternative**: Use shell environment variables instead (no sudo) - **Not required**: ClawBrain works with zero configuration **If you see sudo in documentation, it's only for optional systemd env var configuration, not core functionality.** ## Installation Security

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
md
- **Alternative**: Use shell environment variables instead (no sudo) - **Not required**: ClawBrain works with zero configuration **If you see sudo in documentation, it's only for optional systemd env var configuration, not core functionality.** ## Installation Security

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
md
- **Alternative**: Use shell environment variables instead (no sudo) - **Not required**: ClawBrain works with zero configuration **If you see sudo in documentation, it's only for optional systemd env var configuration, not core functionality.** ## Installation Security

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
- **Alternative**: Use shell environment variables instead (no sudo) - **Not required**: ClawBrain works with zero configuration **If you see sudo in documentation, it's only for optional systemd env var configuration, not core functionality.** ## Installation Security

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 76)May include surrounding context.
md
4. Tests the installation with a health check 5. **Does NOT**: - Require sudo or root access - Modify system files outside your home directory - Download additional code from the internet - Execute shell commands or privileged operations

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 86)May include surrounding context.
md
- **Location**: `~/.config/clawbrain/.brain_key` - **Format**: Fernet encryption key (44 bytes, base64-encoded) - **Permissions**: Should be readable only by your user (chmod 600) - **Auto-generated**: Created on first use if not present ### CLI Key Commands

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 238)May include surrounding context.
md
- **Location**: `~/.config/clawbrain/.brain_key` - **Format**: Fernet encryption key (44 bytes, base64-encoded) - **Permissions**: Should be readable only by your user (chmod 600) - **Auto-generated**: Created on first use if not present ### CLI Key Commands

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 276)May include surrounding context.
md
- **Location**: `~/.config/clawbrain/.brain_key` - **Format**: Fernet encryption key (44 bytes, base64-encoded) - **Permissions**: Should be readable only by your user (chmod 600) - **Auto-generated**: Created on first use if not present ### CLI Key Commands

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
- **Location**: `~/.config/clawbrain/.brain_key` - **Format**: Fernet encryption key (44 bytes, base64-encoded) - **Permissions**: Should be readable only by your user (chmod 600) - **Auto-generated**: Created on first use if not present ### CLI Key Commands

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SECURITY.md (reported line 156)May include surrounding context.
md
**How to Set** (choose one): 1. **Shell environment** (no sudo): Add to `~/.bashrc` or `~/.zshrc` 2. **Systemd drop-in** (requires sudo): Create `/etc/systemd/system/{service}.service.d/brain.conf` 3. **Don't set anything**: ClawBrain works with defaults (SQLite + auto-generated key) ## Startup Hooks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SECURITY.md (reported line 156)May include surrounding context.
md
**How to Set** (choose one): 1. **Shell environment** (no sudo): Add to `~/.bashrc` or `~/.zshrc` 2. **Systemd drop-in** (requires sudo): Create `/etc/systemd/system/{service}.service.d/brain.conf` 3. **Don't set anything**: ClawBrain works with defaults (SQLite + auto-generated key) ## Startup Hooks

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SECURITY.md (reported line 223)May include surrounding context.
md
✅ **Encrypted at Rest**: Secrets in database are Fernet-encrypted ✅ **Local-Only by Default**: No network access unless configured ✅ **No Code Execution**: Cannot execute arbitrary code from memory ✅ **User Isolation**: Each agent has separate memory space ### What ClawBrain Does NOT Protect Against

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 22)May include surrounding context.
md
**Install Specification**: skill.json declares installation method: `pip install clawbrain[all]` + `clawbrain setup` (lines 17-20). **Sudo Requirements**: Core installation **never needs sudo**. Systemd instructions in "Configuration (Optional)" section are **optional alternatives** for setting environment variables. Core: pip + clawbrain setup (no sudo). **Source Code**: Fully auditable at https://github.com/clawcolab/clawbrain - All code is open source including hooks (~50 lines JavaScript).

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 33)May include surrounding context.
md
**Install Specification**: skill.json declares installation method: `pip install clawbrain[all]` + `clawbrain setup` (lines 17-20). **Sudo Requirements**: Core installation **never needs sudo**. Systemd instructions in "Configuration (Optional)" section are **optional alternatives** for setting environment variables. Core: pip + clawbrain setup (no sudo). **Source Code**: Fully auditable at https://github.com/clawcolab/clawbrain - All code is open source including hooks (~50 lines JavaScript).

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
**Install Specification**: skill.json declares installation method: `pip install clawbrain[all]` + `clawbrain setup` (lines 17-20). **Sudo Requirements**: Core installation **never needs sudo**. Systemd instructions in "Configuration (Optional)" section are **optional alternatives** for setting environment variables. Core: pip + clawbrain setup (no sudo). **Source Code**: Fully auditable at https://github.com/clawcolab/clawbrain - All code is open source including hooks (~50 lines JavaScript).

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly markets persistent memory, personality, user profiling, mood detection, and learning from interactions. Even if intended as product functionality, this creates a real data-retention and resurfacing risk because sensitive user content may be stored in natural language and later reintroduced into prompts or outputs without sufficient minimization, consent, or filtering.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 75)May include surrounding context.
md
### What ClawBrain Does NOT Do - ❌ **No telemetry** - Does not phone home or collect usage data - ❌ **No external calls** - Only connects to PostgreSQL/Redis if you configure them - ❌ **No sudo required** - All operations in your home directory - ❌ **No code execution** - Does not download or run remote code after install ### Security Features

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
### What ClawBrain Does NOT Do - ❌ **No telemetry** - Does not phone home or collect usage data - ❌ **No external calls** - Only connects to PostgreSQL/Redis if you configure them - ❌ **No sudo required** - All operations in your home directory - ❌ **No code execution** - Does not download or run remote code after install ### Security Features

Static analysis

No suspicious patterns detected.