Security audit

Personality Adapt

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly meant to personalize an agent, but it broadly scans private memory and persists a named user's profile and conversation snippets with weak consent and control boundaries.

Review before installing. Use only if you intentionally want durable local personality profiling, remove the shipped Eric profile and observations first, avoid cron until consent and review controls exist, and restrict scanning to user-approved files with deletion and correction procedures.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/observe.sh:7
Finding: Broad Collection and Retention of Agent Memory Content
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: scripts/adapt.sh:46
Finding: Persistent Agent Behavior Rules Derived from Untrusted Conversation Signals
Content: View full analysis
= 2} print(f"\nHigh-confidence patterns (2+ instances): {len(high_confidence_patterns)}") ``` ```python section_map = { "communication_style": "Communication Style", "decision_making": "Decision-Making", "values": "Values & Interests", "frustrations": "Boundaries", "interests": "Values & Interests", "emotional_state": "Personality Traits", "prioritization": "Decision-Making", } ``` ```python for obs, count in high_confidence_patterns.items(): obs_category = None for o in observations: if o["observation"] == obs: obs_category = o["category"] break if obs_category: section_name = section_map.get(obs_category, "Personality Traits") if section_name not in section_updates: section_updates[section_name] = [] section_start, section_end = find_section_in_personality(section_name, personality_content) if section_start and section_end: section_text = personality_content[section_start:section_end] if obs.lower() not in section_text.lower(): section_updates[section_name].append(f"- {obs} (seen {count}x)") update_made = True else: section_updates[section_name].append(f"- {obs} ({count}x)") update_made = True ``` ```python if update_made: timestamp = datetime.now().strftime("%Y-%m-%d %H:%M") update_note = f"\n\n_Adapted at {timestamp} based on recurring patterns ({len(high_confidence_patterns)} identified)._" final_lines.append(update_note) ...[truncated 2601 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: observations.json:10
Finding: Plaintext Distribution of Identifiable Personal Conversation Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:64
Finding: Predictable Privileged Cron Log Files Permit Symbolic-Link Clobbering
Content: View full analysis
> /tmp/personality-observe.log 2>&1 # Weekly Sunday 3 AM: adapt 0 3 * * 0 cd ~/.root/.openclaw/workspace/skills/personality && bash scripts/adapt.sh >> /tmp/personality-adapt.log 2>&1 ``` ### Technical Analysis The documented scheduled commands append output to fixed, predictable files in the globally writable `/tmp` directory. Shell redirection opens the destination before executing the command and generally follows symbolic links. If these cron entries run under a privileged account, another local user can pre-create one of the predictable paths as a symbolic link to a file the privileged account can modify. The cron shell may then append process output to the attacker-selected target. The two cron entries also use inconsistent working-directory paths: `~/.openclaw/...` and `~/.root/.openclaw/...`. ### Attack Path 1. A local attacker predicts `/tmp/personality-observe.log` or `/tmp/personality-adapt.log`. 2. Before the scheduled job runs, the attacker creates that path as a symbolic link to a chosen target. 3. The privileged cron shell evaluates the `>>` redirection. 4. The shell follows the symbolic link and opens the target with the cron account's permissions. 5. Script output is appended to the target, potentially corrupting a privileged file. ### Impact Assessment A successful attack can append attacker-influenced or predictable output to files writable by the cron account. If the job runs as root, the writable scope can include privileged system files. The exact escalation potential depends on the selected target, filesystem protections, cron account, and whether the appended content is syntactically useful. At minimum, the issue permits local file corrupt ...[truncated 29 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/adapt.sh:119
Finding: Undefined Helper Causes the Adaptation Engine to Fail
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/observe.sh:2
Finding: Documented Command-Line Options Are Parsed as Unsafe Positional Values
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented workflow suggests observing 'who you are' from conversations and notes, but the broader behavior includes storing extracted observations locally and potentially processing assistant-generated content in addition to user data. That expands profiling scope beyond what a user would reasonably infer, creating elevated privacy and integrity risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented workflow suggests observing 'who you are' from conversations and notes, but the broader behavior includes storing extracted observations locally and potentially processing assistant-generated content in addition to user data. That expands profiling scope beyond what a user would reasonably infer, creating elevated privacy and integrity risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes ongoing observation of conversations and daily notes to build a lasting personality profile, but does not prominently warn about the sensitivity of this behavioral data or the privacy consequences of storing it over time. This weakens informed consent around continuous profiling and long-term retention of intimate personal patterns.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill explicitly references reading daily notes and writing PERSONALITY.md and observations.json, but declares no permissions or allowed-tools scope. That creates an authorization and transparency gap: the skill can access and persist sensitive user data without clearly bounded capabilities, increasing privacy and misuse risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Profiling the user's emotional state is sensitive inference data and is more invasive than ordinary preference adaptation. Inferring and storing mood, energy, or uncertainty can expose mental-state information that is not necessary for the stated purpose, increasing privacy harm if retained or misused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises automatic updates to profile files and cron-based scheduled execution, but does not clearly emphasize that it will modify files autonomously over time. Background persistence and unattended writes increase the chance of silent data accumulation, stale profiling, and unexpected changes to user-controlled files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This entry stores a personality/value inference about the user based on assistant-authored text rather than direct user evidence. That creates inaccurate behavioral profiling and can cause the system to build and act on sensitive personal inferences the user never actually expressed, which is especially risky in a personality-adaptation skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This finding shows interests/preferences being inferred from assistant-generated content instead of user-provided evidence. In a skill designed to learn personality over time, this can poison the user model, leading to manipulative adaptation, incorrect personalization, and retention of sensitive profile data not actually derived from the user.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: An emotional-state label is being attributed to the user even though the evidence comes from assistant text. Emotional-state inferences are particularly sensitive, and storing them on the basis of the model's own output can create false psychological profiling that affects future interactions and may expose the system to privacy and trust harms.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The top-level comment states this is an adaptation engine that reviews observations and updates the personality model. However, the update path later calls find_section_in_personality at L127, which is never defined in the embedded Python, so the script will fail before completing the documented update behavior when not in dry-run mode. This is an active contradiction between the documented intent and the actual executable behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script persistently rewrites PERSONALITY.md based on accumulated observations rather than limiting adaptation to ephemeral runtime behavior. In a personality-learning skill, this creates a durable profile that can be changed without an explicit approval step, increasing privacy risk and making unintended or adversarial observations stick across sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script writes directly to PERSONALITY.md without an interactive confirmation, explicit warning, or separate consent flow. In the context of a skill that learns user traits over time, silent persistence is more sensitive than ordinary file output because it stores behavioral inferences that may be privacy-relevant and can influence future agent behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This file is explicitly designed to harvest daily notes and assistant logs, extract personality observations, and write them to persistent storage. Even if intended for personalization, this is dangerous because it normalizes covert collection of sensitive behavioral data and stores natural-language evidence that may reveal private context beyond the inferred label itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script scans historical notes and assistant logs, infers personality traits, and persists those inferences to observations.json without any visible consent gate, minimization, or privacy notice. Because it stores both inferred attributes and evidence snippets over time, it creates a durable behavioral profile that can expose sensitive traits if accessed by other skills, operators, or an attacker.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The observation patterns derive broad personal attributes across communication style, decision-making, values, frustrations, interests, emotional state, and prioritization from ordinary conversation text. Inferring and retaining these categories turns routine interaction logs into a persistent profile of potentially sensitive traits, increasing privacy risk and the chance of secondary misuse.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow incrementally scans dated historical files, deduplicates observations, and appends new ones to a long-lived JSON log, effectively building a cumulative user profile from past interactions. In the context of a personality-learning skill, this makes the behavior more dangerous because the surveillance-style retention is the core feature, not an incidental byproduct, so privacy harm is systematic and ongoing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Line L12 states "Language: English. Swahili phrases occasionally," which imposes a language/locale preference as part of the personality instructions. The policy requires either user choice or a clearly justified locale constraint, and this line does not provide either.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.