second-brain-visualizer

• Outcome: Review
• Latest audit: Aug 25, 2026 · 3:49 AM UTC
• Version: 1.6.3

Overview

The skill is coherent, but it handles very private notes and messages in ways that need Review before installation.

Review before installing. Use this only with a dedicated second-brain inbox or ledger, keep the OpenClaw gateway host on localhost unless you intentionally trust the remote endpoint, avoid importing work or third-party messages without consent, and check where your configured LLM provider logs or retains prompts. Disable scheduled ingestion until you have clear source limits and a deletion process.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill declares environment/config-driven behavior and use of credentials, but does not declare corresponding permissions. That creates a transparency and governance gap: users may not realize the skill reads local paths, loads local credential files, and can influence network destinations via configuration. In a skill that processes sensitive personal notes, missing permission declarations materially increase the risk of unintended overreach.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill’s high-level description understates its actual behavior: it not only visualizes ideas, but reads a specific local note corpus, loads authentication material, and sends the full corpus to a configured LLM gateway that may be remote. This mismatch is dangerous because users may consent to a lightweight note tool without understanding that deeply personal content can be profiled and transmitted off-device for psychological/thematic inference.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script reads a corpus of raw personal notes and transmits it over HTTP to a configurable gateway host, including non-local hosts. For a tool presented as a personal 'second brain visualizer,' this creates a significant confidentiality risk because highly sensitive thought data can be exfiltrated to remote infrastructure, and plain HTTP provides no transport security if the host is not strictly local.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The comment states that all LLM calls go to a 'configured local gateway' and implies there are no external API calls, but the implementation accepts arbitrary host values and only emits a warning for remote hosts. This mismatch is dangerous because users and reviewers may rely on the comment and underestimate the privacy and data-flow risk, leading to unintended remote disclosure of sensitive notes.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The guide expands a 'visualizer' into an automated data collection workflow that pulls content from external messaging systems into a persistent local ledger. That is a real security and privacy concern because it encourages broad ingestion of private communications without clear scope limitation, consent checks, or minimization controls.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file provides step-by-step instructions for accessing Slack, Telegram, WhatsApp exports, and Gmail content, which materially increases the skill's access to sensitive external data beyond what a visualizer minimally needs. In context, this broadens the attack surface and creates a path for over-collection, credential misuse, or accidental ingestion of sensitive personal or organizational communications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When a user selects a cluster, the component collects the raw text of all atoms in that cluster and sends them to the insight API. In a 'second brain' context, those atoms are likely to contain personal notes, ideas, plans, or other sensitive content, and the UI provides no clear disclosure, consent step, or data minimization before transmitting them to backend processing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide promotes automated ingestion of private communications into a local memory file but does not warn about privacy, retention, consent, or sensitive-data handling. This omission is dangerous because users may unknowingly centralize confidential content in a plaintext ledger or downstream JSON pipeline without adequate protections.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly states that clustering sends the full atom corpus to an LLM, but it does not warn users that their notes may contain sensitive personal, business, or credential-like data that will be transmitted to a model endpoint. In the context of a 'second brain' or idea-capture system, the corpus is especially likely to include private or proprietary content, so omitting disclosure and guardrails creates a real confidentiality risk.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The sample content explicitly suggests building a tool from Slack DM history to infer what a user was worried about, which involves processing potentially sensitive personal communications and emotional-state data. Even though this is only example markdown, it normalizes a privacy-sensitive use case without any warning, consent guidance, retention limits, or data-minimization considerations, increasing the chance that downstream implementations handle personal data unsafely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup guide explicitly says the clustering engine sends the full atom corpus to a configured LLM, but it provides no warning that these atoms may contain sensitive personal ideas, private notes, or third-party data from Slack, Gmail, Discord, or other channels. In this skill's context, the risk is elevated because the system encourages raw, uncurated capture and broad ingestion sources, making accidental disclosure to external model providers more likely.

Session Persistence

Medium

• Category: Rogue Agent

Content

There are two approaches:

**Manual** — You write atoms directly into the markdown file. Good for getting started. Fine long-term if you prefer to stay close to the material.

**Automated** — An OpenClaw agent reads your drop channel on a schedule and appends new atoms to the ledger. Drop an idea into Slack at 2am, wake up to find it already parsed and waiting.

• Confidence: 80% confidence
• Finding: The design intentionally persists user messages and ideas in a long-lived markdown ledger, creating durable session memory that may include sensitive content from external platforms. Persistence itself is part of the feature, but without controls it increases exposure from local compromise, unintended reuse, and accumulation of private data over time.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.