Dual-Brain

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:05 AM UTC
• Version: 0.1.1

Overview

This skill’s dual-LLM function is coherent, but it continuously monitors agent sessions, forwards user content to configured model providers, stores derived content, and can install a persistent daemon with elevated service commands.

Install only if you are comfortable with a background tool reading OpenClaw session content and sending messages or context to the configured LLM provider. Prefer a local provider for sensitive work, restrict owner/session scope, review the daemon install before enabling it, protect or rotate any API keys stored in ~/.dual-brain/config.json, and understand how to delete perspectives, logs, and Engram memories.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The CLI includes functionality to install and manage persistent background services on macOS and Linux, which expands the trust and privilege boundary of the tool. Even if intended for convenience, service installation and lifecycle management are sensitive operations because they create persistence and can run code automatically at login or boot.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code invokes shell/system commands such as `which`, `launchctl`, and `sudo systemctl` via `execSync`, introducing command execution and environment-based trust risks. While most command strings are static, reliance on shell resolution and PATH can be abused in compromised environments or lead to unexpected privileged behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The summary states that user messages are sent to a secondary LLM, but it does not present a clear user-facing warning, consent flow, or privacy notice about external data sharing. In this skill context, the watched session files may contain sensitive prompts, secrets, or business data, so silent forwarding to third-party providers materially increases confidentiality risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide states that user messages are sent to a secondary LLM provider, but it does not clearly warn users that potentially sensitive local session content will be transmitted to third-party services. In this context, the omission creates a real privacy and data-handling risk because users may enable the feature without informed consent or understanding of external data exposure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The system-service instructions describe installing the daemon as a background service but do not clearly emphasize that it will continuously monitor local session files. That omission is security-relevant because background persistence combined with ongoing file monitoring changes the trust and privacy model and could surprise users into continuous surveillance of their local agent conversations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README explicitly says every user message is sent to a secondary LLM provider, including remote providers such as OpenAI, Moonshot, and Groq, but does not warn users that message contents may leave the local system and be processed by third parties. This creates a real privacy and compliance risk because operators may enable the skill without understanding that sensitive prompts, credentials, personal data, or proprietary content could be transmitted externally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes perspectives being written to ~/.dual-brain/perspectives and logs being available, but does not clearly warn that these files may contain derived user content, sensitive prompts, or other data that persists on disk. Persistent local storage increases exposure to other local users, backups, endpoint collection tools, or later forensic recovery.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The Engram section states that perspectives are stored as semantic memories for long-term recall, but the README does not present this as a privacy or retention risk. Long-term semantic storage can preserve sensitive information beyond the immediate session and may make deletion, minimization, and user-consent requirements harder to satisfy.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill advertises automatic generation of perspectives from a secondary LLM for every user message, but it does not warn users that their prompts may be transmitted to another provider. This creates a consent and privacy failure: sensitive user content could be shared externally without the user understanding that a second model or vendor is involved.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructions tell users to configure external providers and API keys, but they do not disclose that conversation data may be sent to those providers as part of operation. That omission can lead operators to enable the skill without understanding the data-sharing and credential-handling implications.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The setup flow collects an API key and persists it directly into ~/.dual-brain/config.json without clearly warning the user that the credential will be stored on disk in plaintext. If the local system is shared, backed up insecurely, or the file permissions are too broad, the key could be exposed and abused for unauthorized API access and billing.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The daemon reads recent user messages from local session files and sends them to `provider.getPerspective(...)`, which likely forwards that content to an external model provider. There is no disclosure, consent gate, redaction, or allowlist in this file, so potentially sensitive session content can be transmitted off-host without the user realizing it.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code posts generated perspective content, tagged with `agentId`, to a local HTTP service on `localhost:3400` without any authentication, encryption, or user-facing notice in this file. Even though the destination is local, this still transfers potentially sensitive derived content into another service boundary where it may be retained, exposed, or further processed unexpectedly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends both the user's message and optional context to Groq's external API, but there is no indication in this component of any consent gate, disclosure, data minimization beyond simple truncation, or filtering of sensitive content before transmission. In an agent skill, context may contain private prompts, secrets, or user data, so silent third-party transmission creates a real privacy and data-handling risk even if the feature is intentional.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code sends both `userMessage` and optional `context` to a third-party service (`api.moonshot.ai`) without any visible consent, disclosure, redaction, or policy enforcement. In an agent skill context, context fields often contain sensitive business data, so silent transmission can create privacy, confidentiality, and compliance exposure even if the implementation is otherwise functional.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This provider forwards userMessage and optional context to an HTTP endpoint without any disclosure, consent, or minimization visible in this file. Even though the default target is localhost, the configurable baseUrl can direct sensitive prompts to another host, creating a privacy and data-handling risk if users or operators are unaware that their inputs are being transmitted.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The provider sends userMessage and optional context to OpenAI's external API, and the file contains no indication of consent, disclosure, minimization beyond simple truncation, or safeguards against sensitive data being forwarded. In an agent skill, this is significant because prompts and context may contain secrets, personal data, or proprietary information, so silent third-party transmission creates a real confidentiality and compliance risk.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The skill is designed so that every user message is intercepted, forwarded to a secondary LLM, and the resulting perspective is written to a local file for reuse. This creates a direct data leakage path for secrets, personal data, or confidential prompts, and expands exposure from the primary agent to additional services and local persistence.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The optional Engram integration stores derived content from user interactions as long-term semantic memory, increasing retention and the chance of later disclosure or misuse. Even if only summaries are stored, they may still encode sensitive user information and broaden the attack surface beyond the immediate session.

External Transmission

Medium

• Category: Data Exfiltration

Content

class MoonshotProvider extends Provider {
  constructor(config) {
    super(config);
    this.apiUrl = 'https://api.moonshot.ai/v1/chat/completions';
    this.model = config.model || 'moonshot-v1-auto';
    this.apiKey = config.apiKey;
  }

• Confidence: 84% confidence
• Finding: The hardcoded external endpoint indicates this provider is designed to transmit prompt data to an off-platform API. By itself, an external URL is not malicious, but in this file it directly supports sending agent identifiers, user input, and business context to a third party, which is risky if operators do not expect that data flow.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fs.writeFileSync(servicePath, service);
    console.log('✅ Systemd service installed:', servicePath);
    
    execSync('sudo systemctl daemon-reload');
    execSync('sudo systemctl enable dual-brain');
    execSync('sudo systemctl start dual-brain');
    console.log('✅ Service enabled and started');

• Confidence: 98% confidence
• Finding: This command triggers `sudo systemctl daemon-reload`, causing the tool to request or rely on elevated privileges for system-wide service management. Any feature that programmatically initiates privileged operations materially increases risk if the tool or its installation path is tampered with.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

console.log('✅ Systemd service installed:', servicePath);
    
    execSync('sudo systemctl daemon-reload');
    execSync('sudo systemctl enable dual-brain');
    execSync('sudo systemctl start dual-brain');
    console.log('✅ Service enabled and started');
  } catch (e) {

• Confidence: 98% confidence
• Finding: This command enables the service with `sudo systemctl enable dual-brain`, establishing persistence at boot using elevated privileges. Automatic persistence under root-controlled service configuration is security-sensitive and should not be hidden inside a general CLI workflow.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

execSync('sudo systemctl daemon-reload');
    execSync('sudo systemctl enable dual-brain');
    execSync('sudo systemctl start dual-brain');
    console.log('✅ Service enabled and started');
  } catch (e) {
    console.error('❌ Failed to install service:', e.message);

• Confidence: 98% confidence
• Finding: This command starts the service with `sudo systemctl start dual-brain`, combining privileged execution and immediate activation. If the referenced executable or config is modified, this can help launch attacker-controlled code under a trusted persistent service context.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `model` - Model name
- `apiKey` - API key (not needed for ollama)
- `pollInterval` - How often to check for new messages (ms)
- `perspectiveDir` - Where to write perspective files
- `ownerIds` - Discord IDs of message authors to process (empty = all)
- `maxTokens` - Max tokens for perspective response
- `temperature` - LLM temperature (0-1)

• Confidence: 88% confidence
• Finding: The skill instructs agents to read and write perspective files containing synthesized content from user messages, creating session persistence outside the primary agent's transient context. In this skill's context, persistence is part of the intended design, but it still expands the attack surface by retaining potentially sensitive conversational data on disk where it can be reused, exfiltrated, or unintentionally disclosed.

Session Persistence

Medium

• Category: Rogue Agent

Content

CLI_PATH=$(which dual-brain)
  SERVICE_PATH="/etc/systemd/system/dual-brain.service"
  
  # Create service file
  cat > /tmp/dual-brain.service <<EOF
[Unit]
Description=Dual-Brain Daemon

• Confidence: 94% confidence
• Finding: The script generates a systemd service definition intended to run a daemon persistently in the background. Although this appears to be legitimate installer behavior, persistence mechanisms are security-relevant because they create long-lived execution and can be abused if the referenced binary is replaced or compromised.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/cli.js:212