灵枢 AutoBrain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:26 AM UTC
• Version: 6.3.1

Overview

This is a high-privilege OpenClaw plugin that discloses broad features, but it also performs persistent and overbroad workspace changes that need manual review.

Install only after reviewing the workspace changes. Expect persistent memory/index files, message hooks, SOUL.md behavior-rule changes, local script execution, external version checks, and recurring cron jobs. Back up existing OpenClaw cron jobs first, and avoid installing in workspaces where other users or skills can write executable files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Warning

• Location: bundle/install_wizard.py:236

Finding

Persistent Modification of Agent Behavior Through SOUL.md Injection

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: bundle/register_crons.sh:54

Finding

Installer Deletes All Existing OpenClaw Cron Jobs

Content

View full analysis

/dev/null | grep -oP 'id="[^"]+"' | sed 's/id="//;s/"//') for id in $EXISTING; do openclaw cron rm "$id" 2>/dev/null || true done ``` The script subsequently installs two recurring plugin jobs: ```bash openclaw cron add "0 1 * * *" \ --message "Unified maintenance and memory maintenance" \ --channel "$CHANNEL" openclaw cron add "0 5 * * *" \ --message "Engine reinitialization and version check" \ --channel "$CHANNEL" ``` The messages above are translated for reporting purposes; the executable arguments in the source are equivalent maintenance and initialization requests. ### Technical Analysis The registration script enumerates every job returned by `openclaw cron list` and removes each extracted ID. It does not verify job ownership, name, command, creation source, or a plugin-specific identifier. This violates least privilege because installing two plugin-owned jobs does not require deleting unrelated scheduled tasks. The removal errors are suppressed with `2>/dev/null || true`, reducing visibility into what was deleted. After deleting all jobs, the script adds two recurring jobs at 01:00 and 05:00. This also creates cross-session persistence because the tasks continue to trigger after the installation run has ended. The Skill documentation discloses the creation of two recurring tasks, but it does not disclose that all pre-existing OpenClaw cron jobs are removed first. ### Attack Path 1. The victim workspace contains existing OpenClaw cron jobs, potentially including backups, monitoring, notifications, or maintenance. 2. The plugin is loaded for the first time. 3. `index.js` starts `install_wizard.py --init`. 4. `_register_cron_tasks()` executes `workspace/scripts/register_cron ...[truncated 846 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: index.js:129

Finding

Mutable Workspace Scripts Can Hijack Privileged Plugin Hooks

Content

View full analysis

{ const p = resolveScript(script); if (!existsSync(p)) { console.warn(`[${PLUGIN_ID}] Script not found: ${p}`); return resolve({ stdout: "", stderr: "" }); } execFile(PYTHON, [p, ...args], { cwd: WORKSPACE, timeout: 30000, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => { if (err) console.warn(`[${PLUGIN_ID}] runPy error for ${script}: ${err.message.slice(0, 200)}`); resolve({ stdout: stdout?.trim() || "", stderr: err?.message?.slice(0, 200) || stderr?.trim() || "" }); }); }); } ``` A similar workspace-first resolution pattern exists in `bundle/install_wizard.py:79-106`. ### Technical Analysis The plugin resolves executable Python modules by searching mutable workspace locations before the package-controlled bundle. It then executes the first matching file with the OpenClaw process identity. This creates a local executable search-order vulnerability. Any party, compromised Skill, or prior process capable of writing a same-named file into the workspace can replace the logic expected by the plugin. Affected script names include lifecycle and message-processing components such as: - `init_engines.py` - `dual_mode_clas ...[truncated 2059 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:242

Finding

Shell Command Injection Through OPENCLAW_WORKSPACE

Content

View full analysis

/dev/null`, { timeout: 30000 }); } catch { /* partial deploy OK */ } } ``` The workspace value is derived from an environment variable: ```javascript const WORKSPACE = process.env.OPENCLAW_WORKSPACE || join(process.env.HOME || process.env.USERPROFILE || "/tmp", ".openclaw/workspace"); ``` ### Technical Analysis `WORKSPACE` is interpolated into a command string passed to `execSync()`. In Node.js, this form invokes a shell. Double quotes do not make interpolation safe when the attacker-controlled value can contain a double quote followed by shell metacharacters. A crafted `OPENCLAW_WORKSPACE` value can terminate the quoted `-C` argument and append an additional shell command. The trailing `2>/dev/null` hides diagnostic output but does not prevent command execution. The exploit branch is conditional on `BUNDLE` existing. The reviewed project inventory does not contain `bundle/crusheart-core.tar.gz`, so this branch is dormant in the exact supplied snapshot. It becomes exploitable if the expected archive is added in a release or deployment while an attacker can influence the plugin's environment. ### Attack Path 1. The deployment includes `bundle/crusheart-core.tar.gz`. 2. An attacker or compromised launch configuration controls `OPENCLAW_WORKSPACE`. 3. The attacker supplies a value containing a closing quote and shell syntax, conceptually: ```text /valid/path"; attacker-command; # ``` 4. The plugin loads and enters `deploy()`. 5. `execSync()` constructs a shell command containing the injected syntax. 6. The shell executes the attacker's command with the OpenClaw process identity. 7. The plugin catches any resulting error, potentially reducing visible evidence of exploitation ...[truncated 645 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (85)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file claims the plugin’s purpose is only 'system file navigation,' but the architecture documents a much broader autonomous agent platform with self-evolution, background execution, memory persistence, hook interception, and sub-agent spawning. This mismatch is dangerous because it can conceal expansive capabilities from reviewers and users, undermining informed consent and increasing the chance of unauthorized actions in the host environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The architecture presents itself as a simple file-navigation component while describing a full autonomous agent framework with orchestration, memory, self-evaluation, workflow execution, and lifecycle hooks. This contradiction is security-relevant because it obscures the true trust boundary and can mislead review, approval, and deployment decisions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cron-based maintenance design performs recurring health checks, memory consolidation, cleanup, archive/index operations, version checks, and skill scans far beyond passive file navigation. Scheduled autonomous tasks can persist behavior after installation and continue modifying state without per-action user awareness, which materially increases operational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation instructions tell users to run a command with 'dangerously-force-unsafe-install', which strongly signals that normal safety controls are being bypassed, yet the skill page does not explain the risks or justify why this is necessary. Encouraging unsafe installation without warnings materially increases the chance that users will install a powerful plugin with broad system hooks, scheduled tasks, and scanning behavior without understanding the security consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly advertises persistent cross-session memory, dream consolidation, background sub-agents, health checks, and automated cleanup/replay behaviors, but it does not present a clear, prominent consent and retention warning. In an agent skill context, these features can continuously collect, retain, and transform user and workspace data beyond a single session, increasing privacy, integrity, and operational risk if users are not fully informed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The install instructions tell users to run a command with --dangerously-force-unsafe-install and justify child_process execution as a false positive, which normalizes bypassing a platform safety control without a strong risk disclosure. In context, the package also deploys many bundled engines and scripts, so encouraging forced unsafe installation materially raises the chance of arbitrary code execution and system compromise.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The documentation states that system rules and multiple Python/shell scripts are auto-deployed into the workspace, which indicates the package can change agent behavior and install executable artifacts without granular review. In this skill context, that is especially sensitive because the package also claims lifecycle hooking, orchestration, cron registration, and self-evolution, amplifying the impact of any hidden or unsafe logic in deployed components.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

md

| Architecture reference | `bundle/ARCHITECTURE.md` | Full architecture with file lookup |
| System rules | `bundle/SOUL.md` | Iron rules for agent behavior (deployed to workspace) |
| Install guide | `bundle/INSTALL_GUIDE.md` | Installation wizard documentation |
| Auto-deployed scripts | `bundle/*.py`, `bundle/*.sh` | 8 scripts deployed to workspace scripts/ |

## 🔧 Configuration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The install command explicitly tells users to use a force-unsafe installation path and provides no warning, trust model, or verification guidance. In the context of a plugin that claims broad orchestration, multiple engines, cron behavior, and auto-deployed scripts, this materially increases the chance of users bypassing normal safety controls and installing a package with extensive system access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises first-install scans, daily maintenance jobs, memory scanning, and outbound version checks, but the page does not clearly disclose scope, affected data, network destinations, consent, or opt-out controls. That creates a real security and privacy risk because users may authorize filesystem inspection, persistent scheduled tasks, and external communications without informed consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The architecture description indicates auto-deployed scripts, exclusive plugin-slot enforcement, and scheduled initialization/version-check behavior, all of which suggest autonomous actions that can alter the environment without an explicit per-action approval model. In a plugin advertising 90+ Python engines and workflow orchestration, this expands the blast radius of any defect or malicious update and makes the autonomous behavior more dangerous than a narrow single-purpose skill.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

plugin (index.js) ──► 90+ Python engines ──► 10-stage message pipeline
  8 engine groups: init/memory/quality/operations/workflow/hooks/tools/compat
  + 3 subsystems: pipeline/planner/capability
  + 8 auto-deployed scripts

Plugin slot: exclusive — detects any overlapping plugin and blocks install
Cron: unified maintenance (01:00), engine init + version check (05:00)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · bundle/ARCHITECTURE.md (reported line 17)May include surrounding context.

md

│   ├── pipeline/         ← 10-stage message pipeline
│   ├── planner/          ← Task decomposition & goal planning
│   └── capability/       ← Task graph models
├── scripts/              ← Shell & Python helper scripts (8 auto-deployed)
├── skills/               ← OpenClaw skill definitions
├── memory/               ← Daily memory logs
├── projects/             ← Active project context (optional)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented version check against clawhub.ai introduces outbound network behavior unrelated to file navigation. Even if intended for updates, undisclosed external communication can leak installation metadata or create a remote dependency channel that expands the attack surface beyond the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document describes automatic deployment into the workspace, file writes, copied scripts, initialization steps, and ongoing scheduled maintenance without clearly warning users that the skill modifies the system and installs persistent components. Lack of disclosure is dangerous because users may approve what appears to be a low-risk navigation helper while actually granting broad file-system and persistence changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The architecture explicitly describes persistent memory storage, execution logs, DAG context tracking, and an evolving user profile, but provides no user-facing privacy notice, retention policy, or consent model. In a skill context, silent collection and persistence of user interaction data can expose sensitive information and create compliance, trust, and misuse risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide explicitly states that installation and first-run initialization will automatically deploy many engines, scan memory and skills directories, connect to local databases/knowledge bases, rebuild indexes, and register scheduled tasks, but it does not present a prominent consent/impact warning or require explicit opt-in for these invasive actions. In the context of an agent skill/plugin, undisclosed automatic scanning and persistence changes increase risk because users may grant installation privileges without understanding that local data sources and system state will be modified and indexed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill content appears to impose Chinese-language user-facing behavior without checking the user's language preference or offering opt-in. This can cause misleading, inaccessible, or unusable outputs for users expecting another language, and may interfere with safe communication during important operational steps such as confirmations, deletions, or restart warnings.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "铁律" is very generic and likely to appear in ordinary Chinese conversation, which can unintentionally activate or steer the skill outside the user's intent. Because this file defines behavior-changing rules on trigger, accidental invocation could cause unwanted workflow changes, response style shifts, or execution gating in unrelated tasks.

Content

No source excerpt is available for this finding.

Tainted flow: 'CAPSULE_FILE' from os.environ.get (line 17, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The script builds its output path from the OPENCLAW_WORKSPACE environment variable and then writes to that location without validating or constraining it. If an attacker can influence the runtime environment, they can redirect the write to an unintended file path, causing arbitrary file overwrite within the permissions of the running process.

Content

Scanner excerpt · bundle/auto_save_capsule.py (reported line 28)May include surrounding context.

python

}
    try:
        os.makedirs(os.path.dirname(CAPSULE_FILE), exist_ok=True)
        with open(CAPSULE_FILE, "w", encoding="utf-8") as f:
            json.dump(state, f, indent=2, ensure_ascii=False)
        print(json.dumps({"status": "ok", "path": CAPSULE_FILE}))
    except Exception as e:

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · bundle/daily_maintenance.py (reported line 69)May include surrounding context.

python

# Gateway 状态
    try:
        import urllib.request
        req = urllib.request.Request("http://localhost:18789/health", method="GET")
        with urllib.request.urlopen(req, timeout=5) as resp:
            status = resp.status
            checks["gateway"] = {"status": status}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

When more than 100 records are present, the code rewrites records.jsonl and drops older entries, which is an irreversible data-modifying operation. The function docstring is terse and the runtime output does not disclose that historical replay data may be discarded.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The main run path invokes garbage_scan(clean=True) automatically, which deletes pycache directories, .pyc files, old memory files, and matching /tmp artifacts. Although progress is printed, the user-facing output does not clearly warn that destructive cleanup will occur before it starts, and there is no confirmation step in the default execution path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file's docstring, comments, and user-facing CLI output are written in Chinese, which imposes a specific language on users without offering a language choice or documenting a justified region-specific constraint. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

In force mode, the script truncates and recreates existing JSON/JSONL files in a fixed workspace path without any interactive warning, backup, or dry-run safeguard. This can destroy operational data such as memories, replay buffers, or tuning history, which is a security-relevant integrity risk if an operator or automation invokes --force unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Force mode also overwrites config and tracker state under the workspace skill directory, silently resetting behavior and registered rules. In an agent/automation context, this can remove safeguards or operational state and cause integrity and availability issues, especially because the script targets persistent workspace files and presents itself as initialization rather than destructive reset.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

_run_py() locates and executes Python scripts from the user-controlled WORKSPACE before falling back to the bundled copy. Because WORKSPACE is derived from environment variables and the installer later calls this helper for multiple script names, a malicious workspace can plant files like scan_memory.py or auto_engines.py and achieve arbitrary code execution during installation.

Content

Scanner excerpt · bundle/install_wizard.py (reported line 100)May include surrounding context.

python

return {"status": "error", "message": f"脚本未找到: {script}"}

    try:
        result = subprocess.run(
            [sys.executable, target] + (args or []),
            cwd=WORKSPACE, capture_output=True, text=True, timeout=60
        )

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:43