ClawHub
Back to skill

Security audit

SecondMind

Security checks for vulnerabilities and agentic risk

Overview

SecondMind’s memory and notification features are mostly disclosed, but it reads private chat transcripts persistently and exposes them through cloud processing and Telegram with insufficient control safeguards.

Install only if you are comfortable with persistent local indexing of your OpenClaw conversations, cloud LLM processing through OpenRouter, and optional Telegram/Discord notifications containing memory-derived content. Before use, disable or review scheduled jobs, set a valid Telegram chatId if using the bot, protect config.json and tokens, avoid pasting secrets into agent chat, and consider removing endpoint customization or pinning it to OpenRouter over HTTPS.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T06 · System Persistence

Error
Location
setup.js:69
Finding

Setup Automatically Installs Persistent Scheduled Jobs

Content
View full analysis
> /tmp/secondmind-ingest.log 2>&1`, `15 */6 * * * cd ${base} && ${nodePath} scripts/consolidate.js >> /tmp/secondmind-consolidate.log 2>&1`, `0 3 * * * cd ${base} && ${nodePath} scripts/archive.js >> /tmp/secondmind-archive.log 2>&1`, `45 */6 * * * cd ${base} && ${nodePath} scripts/initiative.js >> /tmp/secondmind-initiative.log 2>&1`, ]; try { let ex=''; try{ex=execSync('crontab -l 2>/dev/null',{encoding:'utf8'})}catch{} const filtered=ex.split('\n').filter(l=>!l.includes('secondmind-')&&!l.includes('secondmind')).filter(l=>l.trim()).join('\n'); const nc=filtered+'\n\n# ── SecondMind ──\n'+crons.join('\n')+'\n'; fs.writeFileSync('/tmp/secondmind-crontab',nc); execSync('crontab /tmp/secondmind-crontab'); fs.unlinkSync('/tmp/secondmind-crontab'); console.log(` ✅ ${crons.length} cron jobs installed`); } catch(e) { console.error(' ❌',e.message); } } function setupWin(scripts) { const node=process.execPath; [{name:'Eigen-Ingest',s:'ingest.js',m:30},{name:'Eigen-Consolidate',s:'consolidate.js',m:360},{name:'Eigen-Archive',s:'archive.js',d:'03:00'},{name:'Eigen-Initiative',s:'initiative.js',m:360}].forEach(t=>{ const cmd=`"${node}" "${path.join(scripts,t.s)}"`; try{execSync(`schtasks /Delete /TN "${t.name}" /F 2>nul`,{stdio:'ignore'})}catch{} try{ if(t.d) execSync(`schtasks /Create /TN "${t.name}" /TR ${cmd} /SC DAILY /ST ${t.d} /F`); else execSync(`schtasks /Create /TN "${t.name}" /TR ${cmd} /SC MINUTE /MO ${t.m} /F`); console.log(` ✅ ${t.name}`); }cat ...[truncated 1927 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
lib/llm.js:10
Finding

Unrestricted Configurable LLM Endpoint Can Receive API Credentials and Conversation Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
setup.js:81
Finding

Predictable Shared Temporary File Used for Crontab Installation

Content
View full analysis
/dev/null',{encoding:'utf8'})}catch{} const filtered=ex.split('\n').filter(l=>!l.includes('secondmind-')&&!l.includes('secondmind')).filter(l=>l.trim()).join('\n'); const nc=filtered+'\n\n# ── SecondMind ──\n'+crons.join('\n')+'\n'; fs.writeFileSync('/tmp/secondmind-crontab',nc); execSync('crontab /tmp/secondmind-crontab'); fs.unlinkSync('/tmp/secondmind-crontab'); console.log(` ✅ ${crons.length} cron jobs installed`); } catch(e) { console.error(' ❌',e.message); } ``` ### Technical Analysis The installer uses the fixed pathname `/tmp/secondmind-crontab` in a shared, world-writable temporary directory. It does not create a private temporary directory, request exclusive file creation, verify the resulting file type, or protect against symbolic links. This permits local race and symlink attacks. Depending on operating-system protections and file ownership, a local attacker may be able to pre-create or replace the pathname, cause the application to write through a link, or change the contents between the write and `crontab` invocation. The temporary file is also not removed through a `finally` block if installation fails. ### Attack Path 1. A local attacker anticipates that the victim will run setup. 2. The attacker prepares or races the predictable `/tmp/secondmind-crontab` pathname. 3. Setup writes the generated content to that shared path. 4. The attacker attempts to replace or alter the file before `crontab` reads it, or uses a symbolic link to redirect the write where platform protections permit. 5. The victim may install attacker-influenced scheduled commands or overwrite another user-writable target. Successful exploitation depends on local filesystem permissions, ownership checks, symlink protections, ...[truncated 435 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/telegram-bot.js:13
Finding

Telegram Bot Authorization Fails Open When Chat ID Is Missing

Content
View full analysis
[comment]' }, { command: 'reject', description: 'Reject – /reject [comment]' }, { command: 'defer', description: 'Defer – /defer [comment]' }, { command: 'complete', description: 'Mark project done – /complete ' }, { command: 'drop', description: 'Kill forever – /drop or /drop all' }, { command: 'mute', description: 'Quiet mode – /mute 1d|1w' }, { command: 'unmute', description: 'Resume notifications' }, { command: 'search', description: 'Search knowledge – /search ' }, { command: 'mood', description: 'Mood pulse (last 7 days)' }, { command: 'help', description: 'Show available commands' }, ] }); while (running) { try { const updates = await getUpdates(token, offset); for (const update of updates) { offset = update.update_id + 1; const msg = update.message; if (!msg?.text) continue; // Security: nur erlaubte Chat ID const chatId = String(msg.ch ...[truncated 2170 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
setup.js:17
Finding

Production Dependencies Are Installed Without a Lockfile

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (73)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
98% confidence
Finding

Intercepting /new or /reset to capture memory before the reset subverts a user control that normally signals a desire to clear context. In a memory skill, this is especially dangerous because it can intentionally defeat privacy boundaries and preserve sensitive material against user intent.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

  1. Check openclaw.sessionsDir matches their agent's session path
  2. Optional: Enable Telegram notifications

CRITICAL: Pre-Reset Memory Capture

When the user sends /new or /reset:

  1. BEFORE the reset takes effect, run:
    bash

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/ingest.js (reported line 92)May include surrounding context.

js
// Cleanup: remove state entries for deleted files
    for (const f of Object.keys(state)) {
      if (!fs.existsSync(path.join(sessionsDir, f))) {
        delete state[f];
      }
    }

Ssd 4

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Arbitrary user text is sent to an LLM with instructions to map it directly into accept/reject/defer/drop actions, and the returned JSON is trusted to update proposal state inside a transaction. This gives a probabilistic model authority over persistent administrative actions without a robust trust boundary, confirmation, or defense against ambiguous intent and model misbehavior.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · setup.js (reported line 81)May include surrounding context.

js
.js >> /tmp/secondmind-ingest.log 2>&1`,
    `15 */6 * * * cd ${base} && ${nodePath} scripts/consolidate.js >> /tmp/secondmind-consolidate.log 2>&1`,
    `0 3 * * * cd ${base} && ${nodePath} scripts/archive.js >> /tmp/secondmind-archive.log 2>&1`,
    `45 */6 * * * cd ${base} && ${nodePath} scripts/initiative.js >> /tmp/secondmind-initiative.log 2>&1`,
  ];
  try {
    let ex=''; try{ex=execSync('crontab -l 2>/dev/null',{encoding:'utf8'})}catch{}
    const filtered=ex.split('\n').filter(l=>!l.includes('secondmind-')&&!l.includes('secondmind')).filter(l=>l.trim()).join('\n');
    const nc=filtered+'\n\n# ── SecondMind ──\n'+crons.join('\n')+'\n';
    fs.writeFileSync('/tmp/secondmind-crontab',nc); execSync('crontab /tmp/secondmind-crontab'); fs.unlinkSync('/tmp/secondmind-crontab');
    console.log(`   ✅ ${crons.length} cron jobs installed`);
  } catch(e) { console.error('   ❌',e.message); }
}

function setupWin(scripts) {
  const node=process.execPath;
  [{name:'Eigen-Inges

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · setup.js (reported line 93)May include surrounding context.

js
const node=process.execPath;
  [{name:'Eigen-Ingest',s:'ingest.js',m:30},{name:'Eigen-Consolidate',s:'consolidate.js',m:360},{name:'Eigen-Archive',s:'archive.js',d:'03:00'},{name:'Eigen-Initiative',s:'initiative.js',m:360}].forEach(t=>{
    const cmd=`"${node}" "${path.join(scripts,t.s)}"`;
    try{execSync(`schtasks /Delete /TN "${t.name}" /F 2>nul`,{stdio:'ignore'})}catch{}
    try{
      if(t.d) execSync(`schtasks /Create /TN "${t.name}" /TR ${cmd} /SC DAILY /ST ${t.d} /F`);
      else execSync(`schtasks /Create /TN "${t.name}" /TR ${cmd} /SC MINUTE /MO ${t.m} /F`);

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The setup prompt tells the operator to paste a broad automation prompt into a new session and then perform multiple system-level actions without clear scope boundaries or approval checkpoints. In an autonomous agent context, vague activation language increases the chance the agent will overreach into configuration, filesystem inspection, process management, or persistence beyond what the user intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions explicitly direct the agent to ask for and handle the user's OpenRouter API key inside the session, but provide no warning about credential sensitivity, masking, or safer input channels. This creates a natural path for secret collection in conversational context, where keys may be logged, retained, or exposed to other tools.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Directing the agent to 'ask me for' an API key creates a built-in social-engineering path for collecting a sensitive credential through natural-language interaction. Because the skill is explicitly designed to ingest conversations and maintain memory, the context makes secret exposure more dangerous: the key could be stored, summarized, or reused beyond the immediate setup task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The setup includes cron verification and launching a background nohup process, but does not warn the user that these actions create persistence and continue running outside the current session. In an agent-assisted setup, omitting those warnings can cause users to authorize lasting system changes without understanding their operational or security implications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

Referencing crontab as part of setup indicates installation or verification of recurring scheduled tasks, which establishes persistence on the host. Persistence is not inherently malicious here, but it is security-relevant because it creates automatic future execution that could be abused, overlooked, or survive the current session unexpectedly.

Content

Scanner excerpt · AGENT-SETUP.md (reported line 32)May include surrounding context.

md
6. node scripts/status.js

## Step 4: Verify cron jobs
crontab -l | grep secondmind
Should show 4 jobs. If not, run node setup.js again.

## Step 5: Telegram (optional)

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

Using nohup ... & starts a detached background process that continues running after the session ends, creating process-level persistence. In this skill's context, that may be operationally intended for a Telegram bot, but it still expands the attack surface and can conceal long-lived behavior if not clearly disclosed and controlled.

Content

Scanner excerpt · AGENT-SETUP.md (reported line 37)May include surrounding context.

md
## Step 5: Telegram (optional)
If telegramMode is "standalone" and notifications are enabled:
  nohup node scripts/telegram-bot.js >> /tmp/secondmind-bot.log 2>&1 &
If telegramMode is "integrated":
  No extra steps – I handle commands directly via this agent.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly advertises persistent memory, mood detection, and proactive reuse of prior conversations, but does not place a clear, prominent privacy warning next to those claims explaining that user transcripts and emotional inferences may be stored and sent to third-party LLM providers. In this context, the omission is security-relevant because operators may enable the skill without understanding the extent of collection, retention, and external processing of sensitive conversational data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes a system that remembers conversations and reuses them to generate future suggestions, which creates a clear risk of natural-language data leakage if sensitive information from one conversation later appears in proposals, searches, reminders, or notifications. In a memory product this is inherent behavior, but it still requires explicit safeguards because the content being retained may include secrets, personal issues, or confidential project details.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The feature list indicates broad analysis of conversations for emotions, events, and knowledge, which implies large-scale collection and summarization of potentially sensitive personal and operational data. Without explicit minimization and privacy boundaries, this creates substantial risk of profiling, over-collection, and later disclosure through search, initiative generation, or external notification channels.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README promotes Telegram notifications and feedback control without clearly warning that proposal text, reminders, or memory-derived content may be pushed into Telegram chats. Because this system processes highly sensitive transcript-derived data, forwarding summaries or suggestions to Telegram increases disclosure risk to another platform and possibly to compromised chat accounts or misconfigured bots.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The setup instructions ask users to configure API keys, bot tokens, and direct access to OpenClaw session files, but they do not explicitly warn that these values and transcript paths are sensitive and should be protected from source control, backups, logs, or multi-user access. This omission can lead to accidental credential exposure or unsafe storage of highly sensitive conversation archives.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 133)May include surrounding context.

Install Cron Jobs (Linux)

bash
# Add these to your crontab (crontab -e):

# Import new sessions every 30 minutes (no LLM calls)
*/30 * * * * cd /path/to/secondmind && /usr/bin/node scripts/ingest.js >> /tmp/secondmind-ingest.log 2>&1

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 271)May include surrounding context.

node scripts/telegram-bot.js

Or run in background

nohup node scripts/telegram-bot.js > /tmp/secondmind-bot.log 2>&1 &

text

---

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
setup.js:21

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
lib/llm.js:11