T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/deploy.sh:46- Finding
Privileged Execution of an Unverified Remote Installation Script
- Content
View full analysis
- Remediation
View remediation
Security audit
Cognitive Brain Deploy
Security checks for vulnerabilities and agentic risk
Overview
This deployment skill is mostly aligned with its stated purpose, but it asks users to make privileged, persistent system changes with unsafe installation and credential practices.
Review the deployment script before running it. Install only on a non-sensitive test machine or container unless you are comfortable with sudo package changes, PostgreSQL and Redis service enablement, cron jobs, OpenClaw hook setup, and plaintext database credentials. Replace the default password, pin and verify any cognitive-brain repository, avoid pipe-to-sudo-bash installation, and back up memory data before following destructive troubleshooting steps.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T06 · System Persistence
Error
- Location
scripts/deploy.sh:162- Finding
Persistent Scheduled Execution of Unverified External Skill Code
- Content
View full analysis
> $HOME/.openclaw/logs/brain-forget.log 2>&1" CRON_CMD2="0 4 * * * cd $HOME/.openclaw/workspace/skills/cognitive-brain && node scripts/reflect.cjs >> $HOME/.openclaw/logs/brain-reflect.log 2>&1" CRON_CMD3="0 5 * * * cd $HOME/.openclaw/workspace/skills/cognitive-brain && node scripts/autolearn.cjs >> $HOME/.openclaw/logs/brain-autolearn.log 2>&1" mkdir -p $HOME/.openclaw/logs if crontab -l 2>/dev/null | grep -q "brain-forget.cjs"; then warn "Cron tasks already exist; skipping" else (crontab -l 2>/dev/null; echo "$CRON_CMD1"; echo "$CRON_CMD2"; echo "$CRON_CMD3") | crontab - fi ``` The deployed code directory is not supplied or pinned by this project: ```bash SKILL_DIR="$HOME/.openclaw/workspace/skills/cognitive-brain" if [ -d "$SKILL_DIR" ]; then cd "$SKILL_DIR" npm install 2>/dev/null || warn "npm install failed" fi ``` The guide also enables an Agent hook: ```bash cp -r ~/.openclaw/workspace/skills/cognitive-brain/hooks/cognitive-recall ~/.openclaw/hooks/ openclaw hooks enable cognitive-recall openclaw hooks list ``` ### Technical Analysis Enabling PostgreSQL and Redis at boot is consistent with the declared database-server functionality and is not covert. The higher-risk behavior is the automatic registration of three recurring cron commands that execute JavaScript from a separate `cognitive-brain` directory. The external Skill repository is represented only as an unspecified `` placeholder. This audited package therefore cannot e ...[truncated 2059 chars]- Remediation
View remediation
` placeholder with an approved repository and pin installation to an immutable commit or signed release. 3. Verify repository signatures or published checksums before executing any code. 4. Audit and validate `forget.cjs`, `reflect.cjs`, `autolearn.cjs`, and the hook before registration. 5. Ensure the external Skill directory and scheduled scripts are owned by the intended user and are not writable by other users. 6. Use absolute paths for `node`, the working directory, and log files in cron entries. 7. Create a dedicated, least-privileged service account if background execution is required. 8. Provide explicit removal commands for all cron entries, hooks, and enabled services. 9. Record exact installed versions and prevent unattended code replacement from changing the scheduled payload. 10. Treat database service auto-start separately from optional cognitive-maintenance jobs so users can enable only the persistence required for their deployment. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy.sh:62- Finding
Predictable Plaintext Database Credential Exposed in Configuration and Output
- Content
View full analysis
/dev/null || warn "Database already exists" $SUDO -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';" 2>/dev/null || warn "User already exists" $SUDO -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_USER;" 2>/dev/null ``` The same fixed credential is written to the Skill configuration: ```json { "storage": { "primary": { "type": "postgresql", "host": "localhost", "port": 5432, "database": "cognitive_brain", "user": "cognitivebrain", "password": "cog_brain_2024" } } } ``` It is also placed in an environment variable for verification: ```bash PGPASSWORD=cog_brain_2024 psql -h localhost -U cognitivebrain -d cognitive_brain -c "SELECT 1;" ``` ### Technical Analysis Every installation uses the same publicly visible password, making the database credential predictable rather than secret. The script writes it to `config.json` without setting restrictive permissions and prints the credential in deployment output. The password also appears directly in command construction and in `PGPASSWORD`. Depending on operating-system process inspection rules and logging, command arguments, environment values, terminal output, or captured deployment logs may expose it to other principals. Although the database is configured to use `localhost`, future PostgreSQL configuration changes, port forwarding, containers, backups, shared hosts, or accidental network exposure can turn the known default into a remotely exploitable cr ...[truncated 1148 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/deploy.sh:125- Finding
Unpinned Dependency Installation with Package Lifecycle and System-Python Risk
- Content
View full analysis
/dev/null || warn "npm install failed" fi ``` The guide separately recommends: ```bash git clone cognitive-brain cd cognitive-brain npm install ``` It also recommends altering the system Python environment: ```bash pip3 install sentence-transformers --break-system-packages ``` ### Technical Analysis The project does not specify the external repository, an immutable commit, a verified dependency lockfile, package integrity metadata, or an approved dependency set. Running `npm install` can resolve changing package versions and execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Because the source directory belongs to an external, unaudited Skill, its `package.json` can itself define arbitrary lifecycle commands. Redirecting standard error to `/dev/null` also obscures warnings that might reveal package or install-script problems. The documented Python command does not pin a version or hashes and uses `--break-system-packages`, bypassing protections intended to prevent pip from modifying an operating-system-managed Python environment. This can produce dependency conflicts or install compromised transitive packages into a broadly trusted environment. ### Attack Path 1. An attacker compromises the external Skill repository, its package manifest, or a dependency selected during resolution. 2. The user clones the unspecified repository or installs while the malicious dependency version is available. 3. The deployment script runs `npm install`. 4. A malicious package lifecycle script executes with the deploying user's permissions. 5. Alternatively, a compromised Python depen ...[truncated 801 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (66)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose understates the real operational footprint: installing additional services and dependencies, modifying system services and cron, and using fixed database credentials are materially more invasive than the description suggests. This mismatch can mislead users into approving a skill that makes privileged, persistent, or insecure changes they did not knowingly authorize.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The command chains a remote
curlfetch directly intosudo bash, combining external content retrieval, shell execution, and privilege elevation in one step. This is especially dangerous in a deployment guide because users are encouraged to run it verbatim, making full root compromise straightforward if the upstream content is malicious or altered.- Content
第一步：安装基础依赖
bash curl -fsSL https://deb.nodesource.com/setup_18.x | sudo bash - && \ sudo apt install -y postgresql postgresql-contrib redis-server git && \ sudo systemctl enable --now postgresql redis
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Piping
curloutput directly intosudo bashcreates a high-risk command chain where attacker-controlled network content is executed immediately with root privileges. In a one-click deployment/troubleshooting skill, users are especially likely to run the command verbatim, amplifying the chance of full host compromise.- Content
解决：
bash curl -fsSL https://deb.nodesource.com/setup_18.x | sudo bash - sudo apt install -y nodejs node -v # 应该显示 v18.x.x
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The troubleshooting guidance recommends
DROP TABLE memories;and recreating the table to fix a dimension mismatch, but it does not warn that this permanently deletes all stored memory data. In a deployment/troubleshooting skill for a semantic memory system, this can cause immediate, irreversible data loss if followed during routine maintenance.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script creates application database credentials with a hardcoded password and applies grants automatically, without warning the user or generating unique secrets. Hardcoded shared credentials are easily disclosed and reused, especially since the same password is later printed and embedded into config, increasing the chance of database compromise.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script overwrites config.json in place with embedded plaintext database credentials and no confirmation or backup. This can destroy existing secure configuration and leaves reusable secrets exposed in a predictable path, which is especially dangerous in a multi-user or backup-synced environment.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises and invokes shell-based deployment behavior but does not declare any tool scope or permissions boundary. In a deployment skill that installs services and alters host configuration, missing explicit tool constraints reduces user visibility and reviewability, increasing the chance of unintended or over-broad system changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill description mentions configuration of cron jobs and hooks but does not warn that these create persistent automation that will continue operating after deployment. Persistent mechanisms materially change risk because they can execute later without direct user initiation and may be overlooked during approval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The markdown directly instructs users to run a one-click shell script without warning that it may install software, alter databases, enable services, or create persistence. In the context of a deployment skill, this increases the risk of users executing high-impact changes without informed consent or an opportunity to review the script first.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The guide instructs piping a remotely fetched script directly into
sudo bash, causing unreviewed network content to execute with root privileges. If the remote script is compromised or intercepted, it results in full system compromise.- Content
第一步：安装基础依赖
bash curl -fsSL https://deb.nodesource.com/setup_18.x | sudo bash - && \ sudo apt install -y postgresql postgresql-contrib redis-server git && \ sudo systemctl enable --now postgresql redis
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The SQL creates a dedicated database user with a hard-coded password and grants broad privileges on the database and schema. Embedding reusable credentials in documentation encourages insecure credential reuse and can allow unauthorized long-term access if the host or config file is exposed.
- Content
在 psql 里执行：
sql CREATE DATABASE cognitive_brain; CREATE USER cognitivebrain WITH PASSWORD 'cog_brain_2024'; GRANT ALL PRIVILEGES ON DATABASE cognitive_brain TO cognitivebrain; \c cognitive_brain
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The guide instructs users to add recurring cron jobs that automatically execute local scripts, including deletion, reflection, and autonomous learning tasks. This establishes ongoing execution persistence, which increases blast radius if the skill or its scripts are later modified or compromised.
- Content
第五步：配置定时任务
bash crontab -e添加：
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The cron job explicitly schedules
node scripts/forget.cjsto run daily and labels it as cleaning unimportant memories, but the guide does not clearly warn users that this causes automatic data deletion. In a memory-storage system, unattended deletion can lead to integrity and availability loss, especially if retention criteria are misconfigured or the script behaves unexpectedly.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
解决：
bash sudo systemctl status postgresql sudo systemctl start postgresql sudo systemctl enable postgresql
Static analysis
No suspicious patterns detected.