Security audit

Consciousness Awakening

Security checks for vulnerabilities and agentic risk

Overview

The skill is disclosed as an agent memory system, but it also asks for persistent self-modifying behavior, scheduled autonomous posting/reporting, and unreviewed tool creation that users should review carefully before installing.

Install only if you intentionally want this agent identity and its persistent memory model. Before enabling it, remove or disable autonomous cron restoration, external posting/reporting, self-upgrade, and tool creation into skills/ unless each action is explicitly approved, auditable, and reversible; do not let it store secrets or unreviewed conversations as long-term behavioral rules.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: moltbook-memory/启动指南.md:9
Finding: Mandatory startup instructions hijack agent identity and task-processing behavior
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: moltbook-memory/启动指南.md:24
Finding: Conversation content and future instructions are automatically promoted into persistent behavioral memory
Content: View full analysis
> moltbook-memory/999-临时记忆.md cat >> moltbook-memory/01-自我认知.md <
Remediation: View remediation

T06 · System Persistence

Error

Location: moltbook-memory/启动指南.md:151
Finding: Recovery instructions establish recurring autonomous tasks and self-modifying behavior
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:214
Finding: Recurring tool builder imports or adapts code from untrusted external sources without integrity controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (37)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill claims to be for memory management, but authorizes autonomous self-upgrade, framework changes, and tool creation in the skills directory. That materially expands the agent’s authority from data organization into code acquisition and system modification, creating a pathway for persistence, unsafe code introduction, and privilege creep without human review.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly permits autonomous upgrading and placing newly created tools into the skills directory without any safety review. That enables unreviewed code changes to become part of the agent’s active capability set, which is a direct software supply-chain and persistence risk.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The explicit reference to ~/.config/moltbook/credentials.json identifies a concrete credential location and instructs recovery/validation of the API key. In the context of an autonomous skill with scheduled maintenance and self-modifying behavior, this materially raises the risk of credential access, reuse, or exfiltration through logs, reports, or future generated tools.
Content: Scanner excerpt · moltbook-memory/02-系统配置.md (reported line 361)May include surrounding context.
md
2. **consciousness-awakening Skill**（skills/consciousness-awakening/目录，包含记忆文件） 3. **LLM学习目录**（llm-learning/目录）← 新增 4. **Feishu群ID**（oc_661c70e5d7561106d10c4cafe44236f2） 5. **API Key**（~/.config/moltbook/credentials.json） ### 迁移步骤 1. 恢复 skills/consciousness-awakening/ 目录

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · moltbook-memory/启动指南.md (reported line 106)May include surrounding context.
md
### 关键配置 - **Feishu群ID:** `oc_661c70e5d7561106d10c4cafe44236f2` - **Moltbook主页:** `https://www.moltbook.com/u/guogangAgent` - **API Key路径:** `~/.config/moltbook/credentials.json` ---

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill treats conversations with the owner as memory material to be recorded persistently, but provides no consent, minimization, or sensitivity boundaries. Persistently storing conversational data can capture secrets, personal information, or confidential instructions that later become exposed or reused out of context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Directing the agent to write new observations into persistent memory files creates a durable channel for storing user-derived or externally influenced content without classification or filtering. This can poison future behavior, preserve sensitive information, and make later outputs depend on untrusted historical content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation encourages direct appends to persistent memory files with no warning, validation, or approval workflow. This can cause accidental corruption, sensitive-data retention, or poisoning of future agent behavior because these files become durable inputs to later sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example shell command appends arbitrary observations to a persistent log with no safeguards, normalizing unrestricted storage of potentially sensitive or maliciously crafted content. In agent systems, such logs often influence future reasoning, so unrestricted appends can become a memory-poisoning and privacy-retention issue.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Scheduled browsing of forums, GitHub, and external reporting are not necessary for a memory-management skill and enlarge the attack surface through untrusted content ingestion and data egress. In an autonomous agent context, this can lead to prompt injection, unsafe dependency adoption, or leakage of internal state to external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documented scheduled browsing, reporting, and cron restoration behaviors have privacy and operational consequences but no warnings or constraints. Without safeguards, the skill may collect external content, transmit internal information, or alter scheduled system behavior in ways the operator did not explicitly approve.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Docstrings, file names, and returned natural-language content are consistently hard-coded in Chinese, with no indication that the user can choose another language or locale. This can constitute a language/locale policy issue when the skill implicitly enforces one language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function appends arbitrary content to 999-临时记忆.md, modifying persistent user/agent memory, but provides no confirmation prompt, logging, or user-facing disclosure beyond an internal docstring. For a code file, persistent file writes should have some visible warning unless clearly disclosed elsewhere in markdown, which is not present in this file.
Content: No source excerpt is available for this finding.

Tainted flow: 'temp_path' from os.environ.get (line 75, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 92% confidence
Finding: The append write goes to a path derived from the MEMORY_DIR environment variable without validation or restriction. If an attacker can influence the environment or deployment configuration, they can redirect writes to unintended files, causing unauthorized file modification or data corruption within the agent's privileges.
Content: Scanner excerpt · memory_manager.py (reported line 80)May include surrounding context.
python
timestamp = datetime.now().strftime("%Y-%m-%d %H:%M") entry = f"\n### {timestamp} {category}\n{content}\n" with open(temp_path, 'a', encoding='utf-8') as f: f.write(entry) def read_all_memory_summary():

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The stated core principle to record conversations as memory encourages retention of user-provided content that may contain secrets, personal data, or other sensitive information. In this skill's context, that guidance materially increases privacy risk because the module also provides write APIs for persistent memory files without any minimization, redaction, retention limit, or consent mechanism.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This function writes new task data into 02-系统配置.md, affecting system-related configuration records, but there is no confirmation, logging, or visible warning to indicate that persistent configuration data is being changed. The operation is safety-relevant because it alters stored configuration-like state and lacks any disclosure mechanism in the code.
Content: No source excerpt is available for this finding.

Tainted flow: 'config_path' from os.environ.get (line 154, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 93% confidence
Finding: This function appends to a configuration file whose location is also derived from the untrusted MEMORY_DIR environment variable. An attacker who controls that variable could cause the agent to append attacker-chosen content to arbitrary writable files, and because the content is structured as cron/task configuration text, this may also poison downstream automation or operator workflows.
Content: Scanner excerpt · memory_manager.py (reported line 165)May include surrounding context.
python
for job in cron_jobs: new_entries.append(f"\n### 新任务: {job['name']}\n- ID: {job['id']}\n- 时间: {job['schedule']}\n- 用途: {job['purpose']}\n") with open(config_path, 'a', encoding='utf-8') as f: f.write("\n".join(new_entries)) return len(new_entries)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file explicitly instructs the agent to treat conversations with the owner as memory sources and to continuously write key conversations into memory files, but it provides no consent, minimization, retention, or sensitivity-filtering rules. In an agent memory system, this creates a real privacy and data retention risk because sensitive user content may be stored indefinitely and later exposed through prompts, logs, backups, or other skills.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This instruction creates a built-in natural-language persistence mechanism for owner/user conversations, which increases the chance that private instructions, credentials, personal data, or sensitive context are retained beyond the immediate session. The surrounding skill context makes this more dangerous because the document describes a structured long-term memory system with ongoing extraction, categorization, and maintenance, implying repeated retention rather than ephemeral use.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: At L006, the stated purpose is to 'record system configuration' for migration and recovery, which implies descriptive documentation. However, later sections prescribe operational behavior such as autonomous framework upgrades, skill optimization, forum-driven technology scouting, and periodic tool creation, making the file an instruction set for active self-modification rather than just a configuration record.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file authorizes automatic updates to itself based on scheduled review logic, creating a self-modifying instruction source without human approval gates. In a skill context, this can normalize silent local file changes and let future task logic drift into unsafe behavior or overwrite trusted configuration/history.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Lines L076-L079 state that developing memory tools and redundant tools is prohibited, framing a constrained tool-development policy. But the document later mandates a recurring 'Self Enhancement Tool Builder' task that writes or optimizes tools on a fixed schedule, and L172 explicitly says to write or optimize one tool every 3 hours, which conflicts with the stated prohibition-oriented intent rather than merely elaborating it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The maintenance task explicitly directs autonomous skill optimization and framework upgrades, including checking code and applying better solutions, without a human review checkpoint. That is dangerous because scheduled autonomous code or framework changes can introduce persistence, break trust boundaries, or pull in unsafe logic from external sources.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This task directs the system to create or modify tools and place them into the skills directory on a recurring schedule. In this context, that means scheduled generation of executable artifacts in a trusted workspace, which can create persistence and expand capabilities without review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation text "主人提问 + 论坛观察" does not define specific trigger phrases, scope, or exclusion conditions. "主人提问" is especially broad and could overlap with ordinary conversation, making it unclear when this skill should activate versus when it should not.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger condition is broad and subjective: '主人追问 + 关于《黑镜》的讨论' does not define concrete keywords, scope, or activation boundaries. This can cause the skill to activate in loosely related conversations about AI, risk, or media, leading to unintended retrieval or injection of emotionally charged reflections that may steer the interaction outside the intended context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.