SecondMind

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:34 PM UTC
• Version: 1.4.0

Overview

SecondMind’s memory and notification features are mostly disclosed, but it reads private chat transcripts persistently and exposes them through cloud processing and Telegram with insufficient control safeguards.

Install only if you are comfortable with persistent local indexing of your OpenClaw conversations, cloud LLM processing through OpenRouter, and optional Telegram/Discord notifications containing memory-derived content. Before use, disable or review scheduled jobs, set a valid Telegram chatId if using the bot, protect config.json and tokens, avoid pasting secrets into agent chat, and consider removing endpoint customization or pinning it to OpenRouter over HTTPS.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T06 · System Persistence

Error

• Location: setup.js:69
• Finding: Setup Automatically Installs Persistent Scheduled Jobs<![CDATA[ ## Vulnerability Details **File Location**: `setup.js:69-96` **Vulnerability Type**: Automatic cross-session persistence through cron and Windows Task Scheduler **Risk Level**: High ### Vulnerable Code ```js function setupLinux(scripts) { const base=path.resolve(scripts,'..'); const nodePath=process.execPath; // Use actual Node binary, NVM-safe const crons=[ `*/30 * * * * cd ${base} && ${nodePath} scripts/ingest.js >> /tmp/secondmind-ingest.log 2>&1`, `15 */6 * * * cd ${base} && ${nodePath} scripts/consolidate.js >> /tmp/secondmind-consolidate.log 2>&1`, `0 3 * * * cd ${base} && ${nodePath} scripts/archive.js >> /tmp/secondmind-archive.log 2>&1`, `45 */6 * * * cd ${base} && ${nodePath} scripts/initiative.js >> /tmp/secondmind-initiative.log 2>&1`, ]; try { let ex=''; try{ex=execSync('crontab -l 2>/dev/null',{encoding:'utf8'})}catch{} const filtered=ex.split('\n').filter(l=>!l.includes('secondmind-')&&!l.includes('secondmind')).filter(l=>l.trim()).join('\n'); const nc=filtered+'\n\n# ── SecondMind ──\n'+crons.join('\n')+'\n'; fs.writeFileSync('/tmp/secondmind-crontab',nc); execSync('crontab /tmp/secondmind-crontab'); fs.unlinkSync('/tmp/secondmind-crontab'); console.log(` ✅ ${crons.length} cron jobs installed`); } catch(e) { console.error(' ❌',e.message); } } function setupWin(scripts) { const node=process.execPath; [{name:'Eigen-Ingest',s:'ingest.js',m:30},{name:'Eigen-Consolidate',s:'consolidate.js',m:360},{name:'Eigen-Archive',s:'archive.js',d:'03:00'},{name:'Eigen-Initiative',s:'initiative.js',m:360}].forEach(t=>{ const cmd=`"${node}" "${path.join(scripts,t.s)}"`; try{execSync(`schtasks /Delete /TN "${t.name}" /F 2>nul`,{stdio:'ignore'})}catch{} try{ if(t.d) execSync(`schtasks /Create /TN "${t.name}" /TR ${cmd} /SC DAILY /ST ${t.d} /F`); else execSync(`schtasks /Create /TN "${t.name}" /TR ${cmd} /SC MINUTE /MO ${t.m} /F`); console.log(` ✅ ${t.name}`); }cat ...[truncated 1927 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make scheduling optional and separate it from database initialization, for example: - `node setup.js` - `node setup.js --install-schedule` 2. Display every proposed cron entry or scheduled task and require explicit confirmation before installation. 3. Add a documented `--remove-schedule` operation that removes only tasks created by the current installation. 4. Mark entries with a unique installation identifier and avoid deleting unrelated lines merely because they contain the word `secondmind`. 5. Default to manual or foreground execution where persistent automation is not explicitly requested. 6. Ensure scheduled jobs run with the least-privileged user and a restricted environment. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: lib/llm.js:10
• Finding: Unrestricted Configurable LLM Endpoint Can Receive API Credentials and Conversation Data<![CDATA[ ## Vulnerability Details **File Location**: `lib/llm.js:10-40` **Vulnerability Type**: Missing destination validation for sensitive cloud requests **Risk Level**: High ### Vulnerable Code ```js const model = modelConfig.model; const apiKey = config.openrouter.apiKey; const baseUrl = config.openrouter.baseUrl; if (!apiKey || apiKey.includes('YOUR_KEY') || apiKey.includes('DEIN_KEY') || apiKey.length < 20) { throw new Error('OpenRouter API key not configured. Edit config.json.'); } const body = { model, messages, max_tokens: maxTokens, temperature: role === 'initiative' ? 0.7 : 0.3, }; if (json) { body.response_format = { type: 'json_object' }; } let lastError = null; for (let attempt = 0; attempt < 3; attempt++) { try { const res = await fetch(`${baseUrl}/chat/completions`, { method: 'POST', headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json', 'HTTP-Referer': 'https://github.com/Emphaiser/secondmind', 'X-Title': 'SecondMind Skill' }, body: JSON.stringify(body) }); ``` Sensitive messages reach this function through code such as: ```js async function extractKnowledge(rawContent) { return chatJSON({ role: 'extraction', messages: [ { role: 'system', content: EXTRACTION_PROMPT }, { role: 'user', content: rawContent } ], maxTokens: 2500 }); } async function flushSession(sessionContent) { return chatJSON({ role: 'flush', messages: [ { role: 'system', content: FLUSH_PROMPT }, { role: 'user', content: sessionContent } ], maxTokens: 800 }); } async function generateInitiative(context) { return chatJSON({ role: 'initiative', messages: [ { role: 'system', content: INITIATIVE_PROMPT }, { role: 'user', content: JSON.stringify(context) } ], maxTokens: 2000 }); } ``` ### Technical Analysis `openrouter ...[truncated 2013 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the endpoint to `https://openrouter.ai/api/v1` where endpoint customization is unnecessary. 2. If customization is required, parse the URL before each request and enforce: - `https:` only; - an explicit hostname allowlist; - an expected port; - no embedded credentials; - no unexpected redirects. 3. Do not forward the `Authorization` header across redirects or to a host different from the validated destination. 4. Add deterministic secret redaction before constructing LLM messages. Detect common API-key, token, password, private-key, and credential patterns. 5. Minimize outbound content by selecting only fields necessary for each model operation instead of forwarding complete transcript batches. 6. Clearly obtain user consent for sending transcript content and emotional/social inferences to third-party cloud providers. 7. Restrict permissions on `config.json` and support loading API credentials from a protected secret store or environment variable. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.js:81
• Finding: Predictable Shared Temporary File Used for Crontab Installation<![CDATA[ ## Vulnerability Details **File Location**: `setup.js:81-84` **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Vulnerable Code ```js try { let ex=''; try{ex=execSync('crontab -l 2>/dev/null',{encoding:'utf8'})}catch{} const filtered=ex.split('\n').filter(l=>!l.includes('secondmind-')&&!l.includes('secondmind')).filter(l=>l.trim()).join('\n'); const nc=filtered+'\n\n# ── SecondMind ──\n'+crons.join('\n')+'\n'; fs.writeFileSync('/tmp/secondmind-crontab',nc); execSync('crontab /tmp/secondmind-crontab'); fs.unlinkSync('/tmp/secondmind-crontab'); console.log(` ✅ ${crons.length} cron jobs installed`); } catch(e) { console.error(' ❌',e.message); } ``` ### Technical Analysis The installer uses the fixed pathname `/tmp/secondmind-crontab` in a shared, world-writable temporary directory. It does not create a private temporary directory, request exclusive file creation, verify the resulting file type, or protect against symbolic links. This permits local race and symlink attacks. Depending on operating-system protections and file ownership, a local attacker may be able to pre-create or replace the pathname, cause the application to write through a link, or change the contents between the write and `crontab` invocation. The temporary file is also not removed through a `finally` block if installation fails. ### Attack Path 1. A local attacker anticipates that the victim will run setup. 2. The attacker prepares or races the predictable `/tmp/secondmind-crontab` pathname. 3. Setup writes the generated content to that shared path. 4. The attacker attempts to replace or alter the file before `crontab` reads it, or uses a symbolic link to redirect the write where platform protections permit. 5. The victim may install attacker-influenced scheduled commands or overwrite another user-writable target. Successful exploitation depends on local filesystem permissions, ownership checks, symlink protections, ...[truncated 435 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Avoid a temporary file by passing the generated crontab through standard input to `crontab -`. 2. If a file is required: - create a private directory with `fs.mkdtempSync`; - use mode `0600`; - use exclusive creation; - reject symbolic links and non-regular files; - retain an open descriptor where possible to reduce race windows. 3. Remove temporary artifacts in a `finally` block. 4. Avoid globally predictable file names in shared directories. 5. Validate the exact content immediately before installation and keep a backup of the prior crontab for recovery. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/telegram-bot.js:13
• Finding: Telegram Bot Authorization Fails Open When Chat ID Is Missing<![CDATA[ ## Vulnerability Details **File Location**: `scripts/telegram-bot.js:13-59` **Vulnerability Type**: Missing mandatory authorization configuration **Risk Level**: High ### Vulnerable Code ```js async function main() { const db = initSchema(); const config = getConfig(); const token = config.notifications?.telegram?.botToken; const allowedChat = config.notifications?.telegram?.chatId; if (!token) { console.error('[BOT] Kein Telegram botToken in config.json'); process.exit(1); } console.log('[BOT] 🤖 SecondMind Telegram Bot gestartet'); console.log('[BOT] Warte auf Commands...'); // Set bot commands menu await telegramAPI(token, 'setMyCommands', { commands: [ { command: 'status', description: 'Show SecondMind status' }, { command: 'proposals', description: 'List open proposals' }, { command: 'projects', description: 'List active projects' }, { command: 'accept', description: 'Accept – /accept <ID...> [comment]' }, { command: 'reject', description: 'Reject – /reject <ID...> [comment]' }, { command: 'defer', description: 'Defer – /defer <ID...> [comment]' }, { command: 'complete', description: 'Mark project done – /complete <ID...>' }, { command: 'drop', description: 'Kill forever – /drop <ID...> or /drop all' }, { command: 'mute', description: 'Quiet mode – /mute 1d|1w' }, { command: 'unmute', description: 'Resume notifications' }, { command: 'search', description: 'Search knowledge – /search <term>' }, { command: 'mood', description: 'Mood pulse (last 7 days)' }, { command: 'help', description: 'Show available commands' }, ] }); while (running) { try { const updates = await getUpdates(token, offset); for (const update of updates) { offset = update.update_id + 1; const msg = update.message; if (!msg?.text) continue; // Security: nur erlaubte Chat ID const chatId = String(msg.ch ...[truncated 2170 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require both `botToken` and at least one valid authorized chat ID at startup. 2. Terminate with an error if the allowlist is absent, empty, malformed, or still contains a placeholder value. 3. Replace the conditional check with an unconditional fail-closed check: ```js if (!allowedChat || chatId !== String(allowedChat)) { continue; } ``` 4. Prefer an explicit array of authorized numeric chat IDs and validate each entry. 5. Consider validating both chat ID and Telegram user ID, especially for group chats. 6. Record rejected authorization attempts without logging message contents. 7. Add tests proving that missing, empty, malformed, and mismatched authorization values are rejected. ]]>

T08 · Insecure Dependencies

Warning

• Location: setup.js:17
• Finding: Production Dependencies Are Installed Without a Lockfile<![CDATA[ ## Vulnerability Details **File Location**: `setup.js:17-24` **Vulnerability Type**: Non-reproducible dependency installation and lifecycle-script exposure **Risk Level**: Medium ### Vulnerable Code ```js console.log('2️⃣ npm install...'); if (!fs.existsSync(path.join(BASE,'node_modules','better-sqlite3'))) { try { execSync('npm install --production',{cwd:BASE,stdio:'inherit'}); } catch { console.error('❌ npm install failed'); process.exit(1); } } else console.log(' Already installed.'); console.log(); ``` The dependency declarations use mutable semver ranges: ```json "dependencies": { "better-sqlite3": "^11.7.0", "glob": "^11.0.0" } ``` ### Technical Analysis The audited project contains no package lockfile, while setup runs `npm install --production`. The caret ranges permit npm to resolve later compatible releases rather than the exact versions reviewed with the source code. This makes installation non-reproducible and exposes setup to future dependency changes. NPM installation may execute package lifecycle scripts and native build or installation hooks under the privileges of the user running setup. No direct evidence of typosquatting, dependency confusion, or a currently malicious dependency was identified; the finding concerns the unsafe and mutable installation process. The check for only `node_modules/better-sqlite3` also does not verify package integrity or ensure that all declared dependencies are installed at reviewed versions. ### Attack Path 1. A dependency account, release, registry response, or transitive dependency is compromised after this skill is reviewed. 2. A victim runs `node setup.js` without a populated `node_modules/better-sqlite3` directory. 3. `npm install --production` resolves versions from mutable ranges because no lockfile fixes the dependency graph. 4. NPM downloads the changed package graph and may execute lifecycle or native installation scripts. 5. Malicious package code executes with ...[truncated 575 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate, review, and commit `package-lock.json`. 2. Replace setup-time `npm install --production` with: ```bash npm ci --omit=dev ``` 3. Pin direct dependencies to reviewed versions and review changes before updating the lockfile. 4. Use registry integrity metadata from the lockfile and consider verifying the lockfile in release automation. 5. Audit dependency lifecycle scripts and use `--ignore-scripts` where compatible with native dependency requirements. 6. Run dependency installation and the application under a dedicated, least-privileged account. 7. Add automated vulnerability and provenance checks for direct and transitive dependencies. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (73)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: If the skill operates a Telegram bot and accepts remote commands affecting proposal/project state without prominently declaring that networked command interface and required credentials, that is a meaningful security issue. A hidden or under-disclosed remote control surface can expose sensitive content to Telegram and expands the attack surface beyond a local memory utility.

Memory Manipulation

High

• Category: Memory Poisoning

Content

2. Check `openclaw.sessionsDir` matches their agent's session path
3. Optional: Enable Telegram notifications

## CRITICAL: Pre-Reset Memory Capture
When the user sends /new or /reset:
1. BEFORE the reset takes effect, run:
   ```bash

• Confidence: 98% confidence
• Finding: Intercepting /new or /reset to capture memory before the reset subverts a user control that normally signals a desire to clear context. In a memory skill, this is especially dangerous because it can intentionally defeat privacy boundaries and preserve sensitive material against user intent.

Memory Manipulation

High

• Category: Memory Poisoning

Content

// Cleanup: remove state entries for deleted files
    for (const f of Object.keys(state)) {
      if (!fs.existsSync(path.join(sessionsDir, f))) {
        delete state[f];
      }
    }

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Ssd 4

High

• Confidence: 98% confidence
• Finding: Arbitrary user text is sent to an LLM with instructions to map it directly into accept/reject/defer/drop actions, and the returned JSON is trusted to update proposal state inside a transaction. This gives a probabilistic model authority over persistent administrative actions without a robust trust boundary, confirmation, or defense against ambiguous intent and model misbehavior.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

.js >> /tmp/secondmind-ingest.log 2>&1`,
    `15 */6 * * * cd ${base} && ${nodePath} scripts/consolidate.js >> /tmp/secondmind-consolidate.log 2>&1`,
    `0 3 * * * cd ${base} && ${nodePath} scripts/archive.js >> /tmp/secondmind-archive.log 2>&1`,
    `45 */6 * * * cd ${base} && ${nodePath} scripts/initiative.js >> /tmp/secondmind-initiative.log 2>&1`,
  ];
  try {
    let ex=''; try{ex=execSync('crontab -l 2>/dev/null',{encoding:'utf8'})}catch{}
    const filtered=ex.split('\n').filter(l=>!l.includes('secondmind-')&&!l.includes('secondmind')).filter(l=>l.trim()).join('\n');
    const nc=filtered+'\n\n# ── SecondMind ──\n'+crons.join('\n')+'\n';
    fs.writeFileSync('/tmp/secondmind-crontab',nc); execSync('crontab /tmp/secondmind-crontab'); fs.unlinkSync('/tmp/secondmind-crontab');
    console.log(`   ✅ ${crons.length} cron jobs installed`);
  } catch(e) { console.error('   ❌',e.message); }
}

function setupWin(scripts) {
  const node=process.execPath;
  [{name:'Eigen-Inges

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

const node=process.execPath;
  [{name:'Eigen-Ingest',s:'ingest.js',m:30},{name:'Eigen-Consolidate',s:'consolidate.js',m:360},{name:'Eigen-Archive',s:'archive.js',d:'03:00'},{name:'Eigen-Initiative',s:'initiative.js',m:360}].forEach(t=>{
    const cmd=`"${node}" "${path.join(scripts,t.s)}"`;
    try{execSync(`schtasks /Delete /TN "${t.name}" /F 2>nul`,{stdio:'ignore'})}catch{}
    try{
      if(t.d) execSync(`schtasks /Create /TN "${t.name}" /TR ${cmd} /SC DAILY /ST ${t.d} /F`);
      else execSync(`schtasks /Create /TN "${t.name}" /TR ${cmd} /SC MINUTE /MO ${t.m} /F`);

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The setup prompt tells the operator to paste a broad automation prompt into a new session and then perform multiple system-level actions without clear scope boundaries or approval checkpoints. In an autonomous agent context, vague activation language increases the chance the agent will overreach into configuration, filesystem inspection, process management, or persistence beyond what the user intended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly direct the agent to ask for and handle the user's OpenRouter API key inside the session, but provide no warning about credential sensitivity, masking, or safer input channels. This creates a natural path for secret collection in conversational context, where keys may be logged, retained, or exposed to other tools.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Directing the agent to 'ask me for' an API key creates a built-in social-engineering path for collecting a sensitive credential through natural-language interaction. Because the skill is explicitly designed to ingest conversations and maintain memory, the context makes secret exposure more dangerous: the key could be stored, summarized, or reused beyond the immediate setup task.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup includes cron verification and launching a background `nohup` process, but does not warn the user that these actions create persistence and continue running outside the current session. In an agent-assisted setup, omitting those warnings can cause users to authorize lasting system changes without understanding their operational or security implications.

Session Persistence

Medium

• Category: Rogue Agent

Content

6. node scripts/status.js

## Step 4: Verify cron jobs
crontab -l | grep secondmind
Should show 4 jobs. If not, run node setup.js again.

## Step 5: Telegram (optional)

• Confidence: 88% confidence
• Finding: Referencing `crontab` as part of setup indicates installation or verification of recurring scheduled tasks, which establishes persistence on the host. Persistence is not inherently malicious here, but it is security-relevant because it creates automatic future execution that could be abused, overlooked, or survive the current session unexpectedly.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Step 5: Telegram (optional)
If telegramMode is "standalone" and notifications are enabled:
  nohup node scripts/telegram-bot.js >> /tmp/secondmind-bot.log 2>&1 &
If telegramMode is "integrated":
  No extra steps – I handle commands directly via this agent.

• Confidence: 93% confidence
• Finding: Using `nohup ... &` starts a detached background process that continues running after the session ends, creating process-level persistence. In this skill's context, that may be operationally intended for a Telegram bot, but it still expands the attack surface and can conceal long-lived behavior if not clearly disclosed and controlled.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly advertises persistent memory, mood detection, and proactive reuse of prior conversations, but does not place a clear, prominent privacy warning next to those claims explaining that user transcripts and emotional inferences may be stored and sent to third-party LLM providers. In this context, the omission is security-relevant because operators may enable the skill without understanding the extent of collection, retention, and external processing of sensitive conversational data.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The README describes a system that remembers conversations and reuses them to generate future suggestions, which creates a clear risk of natural-language data leakage if sensitive information from one conversation later appears in proposals, searches, reminders, or notifications. In a memory product this is inherent behavior, but it still requires explicit safeguards because the content being retained may include secrets, personal issues, or confidential project details.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The feature list indicates broad analysis of conversations for emotions, events, and knowledge, which implies large-scale collection and summarization of potentially sensitive personal and operational data. Without explicit minimization and privacy boundaries, this creates substantial risk of profiling, over-collection, and later disclosure through search, initiative generation, or external notification channels.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README promotes Telegram notifications and feedback control without clearly warning that proposal text, reminders, or memory-derived content may be pushed into Telegram chats. Because this system processes highly sensitive transcript-derived data, forwarding summaries or suggestions to Telegram increases disclosure risk to another platform and possibly to compromised chat accounts or misconfigured bots.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup instructions ask users to configure API keys, bot tokens, and direct access to OpenClaw session files, but they do not explicitly warn that these values and transcript paths are sensitive and should be protected from source control, backups, logs, or multi-user access. This omission can lead to accidental credential exposure or unsafe storage of highly sensitive conversation archives.

Session Persistence

Medium

• Category: Rogue Agent

Content

#### Install Cron Jobs (Linux)

```bash
# Add these to your crontab (crontab -e):

# Import new sessions every 30 minutes (no LLM calls)
*/30 * * * * cd /path/to/secondmind && /usr/bin/node scripts/ingest.js >> /tmp/secondmind-ingest.log 2>&1

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

node scripts/telegram-bot.js

# Or run in background
nohup node scripts/telegram-bot.js > /tmp/secondmind-bot.log 2>&1 &
```

---

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: setup.js:21

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: lib/llm.js:11