Back to skill

Security audit

Subconscious

Security checks for vulnerabilities and agentic risk

Overview

This skill is not plainly malicious, but it installs recurring background jobs that can automatically turn local learning notes into persistent prompt-shaping behavior without enough prior control.

Install only if you explicitly want a long-lived self-improvement system that reads workspace learning files and can shape future agent prompts. Review the cron entries before running install.sh, disable --enable-promotion unless you want automatic promotion, keep .learnings content trusted and non-secret, and back up your crontab before following any manual cron instructions.

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T06 · System Persistence

Error
Location
scripts/install.sh:72
Finding

Installer Registers Persistent Scheduled Tasks Without Prior Opt-In

Content
View full analysis
/dev/null | grep -v "subconscious_metabolism.py tick"; \ echo "*/5 * * * * $_tick_cmd >> $LOGS_DIR/subconscious_tick.log 2>&1" \ ) | crontab - # Rotate every hour (with promotion) ( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py rotate"; \ echo "0 * * * * $_rotate_cmd >> $LOGS_DIR/subconscious_rotate.log 2>&1" \ ) | crontab - # Daily review at 6am ( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py review"; \ echo "0 6 * * * $_review_cmd >> $LOGS_DIR/subconscious_review.log 2>&1" \ ) | crontab - # Weekly benchmark Monday 9am ( crontab -l 2>/dev/null | grep -v "subconscious_benchmark"; \ echo "0 9 * * 1 $_bench_cmd >> $LOGS_DIR/subconscious_benchmark.log 2>&1" \ ) | crontab - echo " Cron jobs installed." ``` ### Technical Analysis Running the general-purpose installer automatically modifies the current user's crontab and registers four persistent jobs. The installer does not ask for confirmation or require an explicit option such as `--enable-cron`. The registered tasks execute every five minutes, hourly, daily, and weekly. Most notably, the hourly task enables automatic pending-to-live promotion through `--enable-promotion`. Although scheduled metabolism is related to the declared continuous-learning functionality, it is not the least-privileged installation mode: all operations can be run manually, an ...[truncated 1347 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
subconscious/learnings_bridge.py:115
Finding

Untrusted Learning Content Can Be Automatically Promoted Into Persistent Prompt Instructions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/INSTALL.md:38
Finding

Manual Installation Instructions Destructively Replace the User's Crontab

Content
View full analysis
> ~/.openclaw/workspace-alfred/logs/subconscious_tick.log 2>&1" | crontab - echo "0 * * * * cd ~/.openclaw/skills/subconscious/scripts && python3 subconscious_metabolism.py rotate --enable-promotion >> ~/.openclaw/workspace-alfred/logs/subconscious_rotate.log 2>&1" | crontab - echo "0 6 * * * cd ~/.openclaw/skills/subconscious/scripts && python3 subconscious_metabolism.py review >> ~/.openclaw/workspace-alfred/logs/subconscious_review.log 2>&1" | crontab - ``` ### Technical Analysis `crontab -` replaces the current user's complete crontab with the content supplied on standard input. Each documented command supplies only one line. As a result, the first command deletes every pre-existing cron entry and installs only the tick task. The second then deletes the tick task and installs only the rotate task. The third deletes the rotate task and leaves only the review task. The instructions therefore both destroy unrelated schedules and fail to install the advertised set of jobs. This is a documentation-level unsafe operation, but it becomes directly destructive when a user follows the official manual installation procedure. ### Attack Path 1. A user follows `references/INSTALL.md`. 2. The first command passes one cron line to `crontab -`, replacing all existing user jobs. 3. The second command replaces the crontab again. 4. The third command replaces it a final time. 5. Unrelated backup, maintenance, synchronization, monitoring, or security jobs are silently removed. 6. Only the final subconscious review entry remains active. ### Impact Assessment The issue affects all scheduled jobs owned by the current user. It can disable unrelated op ...[truncated 310 chars]
Remediation
View remediation
/dev/null || true printf '%s\n' '*/5 * * * * ...' printf '%s\n' '0 * * * * ...' printf '%s\n' '0 6 * * * ...' } | crontab - ``` 3. Add unique comments around managed entries so installation and removal affect only this skill. 4. Back up the existing crontab before modification: ```bash crontab -l > "$HOME/crontab.backup" ``` 5. Detect duplicates before appending. 6. Prefer a dedicated helper command that previews changes and asks for confirmation. 7. Add explicit rollback instructions and validate the final crontab after installation. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/install.sh:75
Finding

Unquoted Paths Permit Cron Command Injection

Content
View full analysis
/dev/null | grep -v "subconscious_metabolism.py tick"; \ echo "*/5 * * * * $_tick_cmd >> $LOGS_DIR/subconscious_tick.log 2>&1" \ ) | crontab - # Rotate every hour (with promotion) ( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py rotate"; \ echo "0 * * * * $_rotate_cmd >> $LOGS_DIR/subconscious_rotate.log 2>&1" \ ) | crontab - # Daily review at 6am ( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py review"; \ echo "0 6 * * * $_review_cmd >> $LOGS_DIR/subconscious_review.log 2>&1" \ ) | crontab - # Weekly benchmark Monday 9am ( crontab -l 2>/dev/null | grep -v "subconscious_benchmark"; \ echo "0 9 * * 1 $_bench_cmd >> $LOGS_DIR/subconscious_benchmark.log 2>&1" \ ) | crontab - ``` ### Technical Analysis `SKILL_DIR` is derived from the installation path, while `LOGS_DIR` is derived from `SUBCONSCIOUS_WORKSPACE` or an automatically selected workspace. These values are interpolated into cron command strings without shell quoting or escaping. Cron executes each command through a shell. Spaces can break arguments, and shell metacharacters such as semicolons, command substitutions, redirections, or ampersands can change the generated command's meaning. Quoting variables while building the Bash string is insufficient unless the resulting value is also safely quoted for the later cron-shell evaluation. The installer currently performs no path validation against ...[truncated 1280 chars]
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (55)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/INSTALL.md (reported line 69)May include surrounding context.

Memory store is preserved at memory/subconscious/

Delete separately if desired:

rm -rf ~/.openclaw/workspace-alfred/memory/subconscious/

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/INSTALL.md (reported line 69)May include surrounding context.

Memory store is preserved at memory/subconscious/

Delete separately if desired:

rm -rf ~/.openclaw/workspace-alfred/memory/subconscious/

text

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/install.sh (reported line 96)May include surrounding context.

sh
with promotion)
( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py rotate"; \
  echo "0 * * * * $_rotate_cmd >> $LOGS_DIR/subconscious_rotate.log 2>&1" \
) | crontab -

# Daily review at 6am
( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py review"; \
  echo "0 6 * * * $_review_cmd >> $LOGS_DIR/subconscious_review.log 2>&1" \
) | crontab -

# Weekly benchmark Monday 9am
( crontab -l 2>/dev/null | grep -v "subconscious_benchmark"; \
  echo "0 9 * * 1 $_bench_cmd >> $LOGS_DIR/subconscious_benchmark.log 2>&1" \
) | crontab -

echo "  Cron jobs installed."
echo "  NOTE: --enable-promotion means items auto-promote to live. Remove this flag if you want manual-only promotion."

# Step 4: Create logs directory
echo "[4/5] Creating logs directory..."
mkdir -p "$LOGS_DIR"
touch "$LOGS_DIR/subconscious_tick.log"
touch "$LOGS_DIR/subconscious_rotate.log"
touch "$LOGS_DIR/subconscious_review.log"
touch "$LOGS_DIR/subconscious_benchmark.log"
echo "  Logs ready."

# Step 5: V

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
79% confidence
Finding

The CLI epilog states 'Core is protected - no automatic mutations' and 'Promotion to core is prohibited in v1.5,' but the same tool exposes an 'evolve' command that runs self-evolution and can perform automatic promotion when --enable-promotion is set. Even if promotion is only pending->live, the documentation presents a stronger prohibition on automatic mutation than the code behavior supports.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Guidance to modify ~/.claude/settings.json changes a user-global agent configuration directory, which is a sensitive persistence and trust location. In the context of command hooks, directing users to install behavior there creates durable execution across sessions and can be abused if users copy configuration without carefully auditing the referenced scripts.

Content

Scanner excerpt · self-improving-agent/references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The user-level configuration places an empty-matcher command hook in ~/.claude/settings.json, making it active across all sessions and repositories. This substantially widens the trust boundary from one project to the entire user environment, so any mistake, malicious script replacement, or unexpected prompt handling affects all future work under the same account.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
92% confidence
Finding

This document explicitly describes cross-session messaging and transcript access in an environment that uses workspace prompt injection and persistent memory, which creates a realistic path for sensitive context to be propagated beyond the current session boundary. Although the text includes some cautionary language, exposing mechanisms like sessions_send and sessions_history in a self-improvement workflow increases the chance that secrets, prompts, or raw outputs are shared to other sessions and retained.

Content

Scanner excerpt · self-improving-agent/references/openclaw-integration.md (reported line 181)May include surrounding context.

sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

run_evolution_pass documents dry_run as preventing modification, but it still invokes update_freshness and archive_stale_items, both of which can save changes to disk. This violates caller expectations and can cause unintended persistent state changes in contexts that rely on dry-run for safe preview, auditing, or policy validation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code defines contradiction handling as requiring user confirmation, but _check_gated_requirements only checks evidence_confidence and never enforces confirmation. That allows automated contradiction mutations to proceed against protected knowledge without the human approval promised by governance, creating a direct bypass of a safety control in a self-modifying system. In this skill context, that is especially dangerous because contradiction workflows can alter what the system treats as valid memory or truth.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README describes the bridge as 'one-way read-only' from the source learnings directory, but the skill’s stated purpose is to consume those learnings and transform them into persistent behavioral bias in the agent. That mismatch can mislead operators into underestimating the security effect: while the file access may be read-only, the semantic effect is still state-changing and persistence-affecting, so untrusted learnings can indirectly modify future agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

README 明确宣称该技能会“跨会话保持、重启不丢失”并“安静地塑造Agent行为”,但缺少突出的安全告知、用户同意机制和对持久化行为修改后果的明确警示。对于会自动消费学习记录并演化为 live/bias 的技能,这会降低用户对长期状态污染、行为漂移和工作区数据被持续修改的感知。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

安装与运行说明直接引导用户执行 install.sh、chmod 和多个 Python 脚本,但没有在相邻位置明确提示这些脚本会检测 workspace、可能写入用户环境或修改工作区状态。对具备持久化、自我演化和定时扫描能力的技能而言,缺少这种执行前披露会增加用户在不充分知情下运行本地代码的风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill declares multiple activation conditions including vague phrases like 'health checks,' 'metabolism management,' and 'reviewing what biases are active,' which broadens when the agent may invoke a self-modifying persistence layer. Because this skill manages persistent behavioral bias and scheduled automation, ambiguous triggering increases the chance of unintended execution, potentially altering agent behavior outside explicit user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/INSTALL.md (reported line 18)May include surrounding context.

text

The installer will:
1. Create memory store directories (`memory/subconscious/`)
2. Initialize `core.json`, `live.json`, `pending.jsonl`
3. Install cron jobs (tick/5min, rotate/hourly, review/6am)
4. Create logs directory

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manual install instructions use three separate ... | crontab - commands, each of which replaces the user's entire crontab with just the provided entry. Following these steps sequentially can silently delete unrelated scheduled tasks and leave only the last cron job installed, causing availability and persistence side effects on the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/INSTALL.md (reported line 65)May include surrounding context.

bash
# Remove cron entries
crontab -l | grep -v "subconscious_metabolism" | crontab -

# Memory store is preserved at memory/subconscious/
# Delete separately if desired:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installer persistently modifies the user's crontab to run multiple background tasks, including an hourly job with automatic promotion enabled. Even if presented as functionality, unattended persistence and recurring execution expand the attack surface and can cause ongoing processing or state changes without per-run user consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

This line reads and rewrites the user's crontab to add a recurring task every 5 minutes, creating persistence. Persistent scheduled execution is security-relevant because any later compromise or unsafe behavior in the referenced Python script will be re-triggered automatically.

Content

Scanner excerpt · scripts/install.sh (reported line 81)May include surrounding context.

sh
_bench_cmd="cd $SKILL_DIR/scripts && python3 subconscious_benchmark.py"

# Tick every 5 minutes
( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py tick"; \
  echo "*/5 * * * * $_tick_cmd >> $LOGS_DIR/subconscious_tick.log 2>&1" \
) | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
97% confidence
Finding

This cron installation creates an hourly persistent task that runs with --enable-promotion, meaning it not only persists but also performs automated state-changing behavior. That combination raises risk because it can continuously alter data without interactive review.

Content

Scanner excerpt · scripts/install.sh (reported line 86)May include surrounding context.

sh
) | crontab -

# Rotate every hour (with promotion)
( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py rotate"; \
  echo "0 * * * * $_rotate_cmd >> $LOGS_DIR/subconscious_rotate.log 2>&1" \
) | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This line persists a daily review task via crontab, ensuring the skill continues executing after installation. Persistent background jobs are dangerous in agent skills because they survive the original session and may process user data or invoke changed code later.

Content

Scanner excerpt · scripts/install.sh (reported line 91)May include surrounding context.

sh
) | crontab -

# Daily review at 6am
( crontab -l 2>/dev/null | grep -v "subconscious_metabolism.py review"; \
  echo "0 6 * * * $_review_cmd >> $LOGS_DIR/subconscious_review.log 2>&1" \
) | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
95% confidence
Finding

This line adds a weekly benchmark task to the user's crontab, another form of session persistence. While not obviously malicious, it establishes long-lived autonomous execution that could be abused if the benchmark script or its dependencies are modified later.

Content

Scanner excerpt · scripts/install.sh (reported line 96)May include surrounding context.

sh
) | crontab -

# Weekly benchmark Monday 9am
( crontab -l 2>/dev/null | grep -v "subconscious_benchmark"; \
  echo "0 9 * * 1 $_bench_cmd >> $LOGS_DIR/subconscious_benchmark.log 2>&1" \
) | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 125)May include surrounding context.

sh
echo "IMPORTANT:"
echo "  - Cron jobs are ACTIVE (tick/rotate/review/benchmark)"
echo "  - --enable-promotion is set on rotate — items auto-promote to live"
echo "  - To disable auto-promotion: crontab -e and remove --enable-promotion from hourly cron"
echo "  - Hooks in self-improving-agent/ are DISABLED by default"
echo
echo "Run these to check:"

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring says the rendered bias block is capped at 500 characters, but the actual enforced constant is MAX_BIAS_CHARS = 1200. This is an active contradiction in safety documentation, which can mislead users about the true boundedness of output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The evolve command can perform state-changing maintenance and promotion operations in live mode without an interactive confirmation or a prominent warning that stored state will be modified. In a tool handling persistent memory/state, this increases the risk of accidental or unintended mutations, especially when invoked by automation or users relying on the surrounding 'safe' framing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The pending queue is destructively trimmed by deleting older records without explicit operator acknowledgement, backup, or audit trail. In this scheduler-driven context, repeated automated runs can silently discard potentially important queued data, which could be abused indirectly by flooding the queue to force eviction of older entries or could cause integrity and forensic loss during normal operation.

Content

No source excerpt is available for this finding.