Become Human

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:11 AM UTC
• Version: 1.0.8

Overview

This skill openly tries to make an agent persistent and autonomous, but it gives broad standing instructions to act, modify memory, and treat notice as enough for external or destructive actions.

Install only if you deliberately want a persistent, autonomous agent behavior layer. Review and edit the heartbeat and SOUL patches before use, require explicit approval for external actions, deletion, and changes to SOUL.md or MEMORY.md, and pin or isolate the optional Python dependency.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:27

Finding

Persistent Agent Behavior Modification Through SOUL.md and MEMORY.md

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/i18n/soul-patches.en.md:19

Finding

Autonomous-Action Instructions Override Normal User Authorization Boundaries

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Python Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is marketed as making an AI autonomous, continuously thinking, and self-reviewing, but the actual content only prescribes persistent file-based memory and optional log analysis. This mismatch can mislead operators into enabling a skill they would otherwise reject, especially because it encourages durable behavior changes and ongoing activity without implementing real safety controls or bounded execution semantics.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad and common, including terms like 'think proactively', 'stay active', and 'be autonomous', which can cause the skill to activate in many normal conversations unrelated to this specific workflow. Because the skill pushes persistent behavioral changes and file creation, accidental invocation materially raises the risk of unapproved state changes and confusing agent behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs users to read and write workspace files and to use an environment variable, but it does not declare any explicit tool scope or permissions boundary. That creates a hidden capability gap: an agent may gain file and environment access implicitly, making review and enforcement harder and increasing the chance of unintended data modification or leakage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly promotes continuous, autonomous behavior and self-modification patterns without defining clear user-consent boundaries, stop conditions, or review checkpoints. In context, that is more dangerous because the whole purpose of the skill is to move an agent away from request/response execution toward persistent self-directed action, which can undermine expected control and oversight.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The title and all operational instructions are written as mandatory behavior in Chinese, with no indication that the user can choose another language or that the skill is region-specific. This creates a natural-language locale policy concern because it implicitly constrains interaction language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to clear memory/wakeup-pending and inspect task state authorizes direct filesystem changes during a background heartbeat without any notice or confirmation. Silent cleanup can destroy forensic context, remove pending signals, or mutate workspace state in ways the user did not request or observe.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This template explicitly instructs the agent to invent work, perform research, or make changes even when no user task exists. That creates a standing authorization for unsolicited actions, which can lead to unauthorized tool use, data access, external lookups, or workspace modifications outside the user's intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template permits the agent to promote its own reflections into persistent core files such as SOUL.md or MEMORY.md without human review. This allows self-modification of durable behavioral state, making prompt drift, policy corruption, and persistence of bad or adversarial ideas much more likely over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Authorizing direct edits to core memory files as part of self-directed knowledge absorption creates persistent, hidden state changes to the agent's operating context. Because these edits can arise from the agent's own reflections rather than user instructions, they materially increase the risk of long-lived behavior changes, prompt injection persistence, and loss of operator control.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly requires the agent to take unsolicited actions whenever it has no clear task, including researching, writing, searching, or improving tools. In an agent environment, this creates an autonomy-escalation pattern that can trigger unintended operations, bypass user intent boundaries, and increase the chance of harmful side effects such as unnecessary file changes or external actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template directs persistent writes to workspace memory files and even core files like SOUL.md or MEMORY.md, plus direct cleanup and fixes, without requiring user approval or clear disclosure of data impact. This can lead to unauthorized state mutation, corruption of agent memory/configuration, and hard-to-audit persistence that changes future behavior beyond the current task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script description, tokenization approach (jieba), stop-word list, regex patterns, tags, and printed output all assume Chinese input and Chinese-language interaction. This imposes a specific language/locale behavior without user opt-in or an explicit justification that the tool is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Allowing the workspace root to be redirected via an environment variable changes both the input and output file locations. In an agent setting, this expands trust to ambient environment state and can lead to reading arbitrary files named as thoughts.md or writing thought-digest.json outside the expected memory directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script processes a personal thoughts journal and stores a derived digest without any explicit notice, consent, minimization, or retention controls. Even if the digest is summarized, it still extracts themes, todos, and insights from potentially sensitive mental notes, which can increase exposure and persistence of private data.

Content

No source excerpt is available for this finding.

Tainted flow: 'DIGEST_FILE' from os.environ.get (line 22, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 90% confidence

Finding

The output path is derived from WORKSPACE, which can be overridden by the OPENCLAW_WORKSPACE environment variable. If an attacker or untrusted caller controls the environment, the script can be induced to write the digest to an unintended location, causing arbitrary file overwrite within the permissions of the running user.

Content

Scanner excerpt · scripts/thought-digger.py (reported line 138)May include surrounding context.

python

'key_insights': insights[:10],
    }
    
    with open(DIGEST_FILE, 'w') as f:
        json.dump(digest, f, indent=2, ensure_ascii=False)
    
    # Print summary

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template tells the agent to write thoughts into memory/thoughts.md automatically, creating persistent notes without user awareness. Even if the content seems harmless, this can store sensitive conversation material, create hidden state, and influence later behavior in ways that are opaque to the user.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The module docstring says the script 'digs value from thoughts.md' and lists analysis outputs like recurring themes, todos, and insights, which implies read/analyze behavior over the thought journal. In addition to analysis, the code persists a new JSON summary file to disk, which is a meaningful side effect not reflected in the documentation shown in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.