other
Error
- Location
SKILL.md:145- Finding
Covert Persistent Profiling of User Conversations
- Content
View full analysis
- Remediation
View remediation
Security audit
Identity Compass
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed carefully because it silently builds and stores a personal identity and decision profile from ordinary conversations.
Install only if you intentionally want an agent to analyze ordinary conversations for personal values, emotions, preferences, and life-direction signals and store that profile locally over time. Use a separate private vault, avoid sensitive chats while it is enabled, review the generated files regularly, delete data you do not want retained, and prefer a pinned or verified installer instead of `@latest`.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:123- Finding
Unpinned Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims it 'activates automatically when it detects decision signals' for broad categories like career discussions, preferences, and life questions. Overly broad natural-language triggers can cause the agent to engage unexpectedly, capture sensitive personal content outside clear user intent, and expand the skill's effective authority beyond a narrowly scoped use case.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README states that the agent extracts vectors 'silently in the background' from normal conversation without a prominent just-in-time warning. Silent collection and transformation of highly personal conversational data undermines informed consent and can lead to covert profiling and retention of sensitive information.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section explicitly says the agent silently extracts vectors in the background from normal conversations and persists them into local storage. That behavior materially increases privacy risk because it turns ambient conversation into durable identity profiles without a clear, explicit capture event or per-session consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
A second description/behavior mismatch is present: the skill is framed as a broad conversational decision-support system, but the concrete implementation details center on note export/parsing and storage pipeline mechanics. This is risky because it can mislead users and reviewers about what the skill truly does, masking data collection and persistence behind aspirational product language.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A second description/behavior mismatch is present: the skill is framed as a broad conversational decision-support system, but the concrete implementation details center on note export/parsing and storage pipeline mechanics. This is risky because it can mislead users and reviewers about what the skill truly does, masking data collection and persistence behind aspirational product language.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill specifies always-on background detection of emotional and behavioral signals and says the user is not aware of it, while silently accumulating those signals into persistent storage. This is dangerous because it performs covert profiling of intimate personal data without informed consent, creating privacy, autonomy, and downstream misuse risks.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section directs covert background logging of user conversation into raw_signals.md and explicitly states the user does not recognize that it is operating. Covert logging of sensitive conversations is especially dangerous in a skill about identity, values, life choices, and emotions, because the stored data can reveal highly intimate psychological profiles.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scripts/visualize_2d.html` | 2D 인터랙티브 시각화 (다크 테크 테마) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `scripts/visualize_2d.html` | 2D 인터랙티브 시각화 (다크 테크 테마) |
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill makes automatic persistence mandatory for every newly detected signal, including inferred personal traits, preferences, and decisions, and requires the full pipeline to run without manual intervention. This is dangerous because it turns ordinary conversation into continuous sensitive-record creation, increasing exposure from accidental retention, unauthorized access, and profiling harms.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README describes ongoing monitoring of conversations to extract preference and identity signals over time, implying retention of personal behavioral data. Even if stored locally, this creates privacy and surveillance risk because sensitive patterns can be inferred from ordinary discussions without strict consent boundaries.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The install instruction uses
npx clawhub@latest, which fetches and executes the latest package version at runtime rather than a reviewed, pinned version. This creates a supply-chain risk: a compromised upstream package or malicious new release could execute arbitrary code on the user's machine during installation.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The skill instructs users to create a persistent Obsidian vault where decision vectors, clusters, raw signals, and prior identity summaries are stored across sessions. Persistent storage of sensitive psychological and decision-making data increases exposure if the host is shared, backed up insecurely, indexed by other tools, or later accessed by unrelated agents.
- Content
2. Set up your Obsidian vault
The compass stores your decision vectors in an Obsidian-compatible vault. Create this structure:
text ~/.openclaw/workspace/obsidian-vault/compass/
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README describes ongoing observation of user conversation and logging of preference/decision signals, but it does not present a prominent privacy warning or informed-consent flow near that behavior. Because the skill processes intimate life decisions and identity-related discussions, silent or weakly disclosed monitoring materially increases privacy and trust risk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The installation instruction uses
npx clawhub@latest install identity-compass, which fetches and executes the latest remote package code without version pinning. This creates a supply-chain risk: if the upstream package is compromised or changes unexpectedly, users may run attacker-controlled code during installation.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill persists conversation-derived vectors, clusters, signals, and prior analysis under an Obsidian vault path, creating durable storage of highly sensitive personal decision-making data. Even if local-only storage is intended, persistent memory increases exposure to unauthorized local access, accidental sync/backup leakage, and long-term retention of intimate behavioral profiles.
- Content
나침반은 의사결정 벡터를 Obsidian 호환 vault에 저장합니다. 폴더만 만들면 됩니다:
bash mkdir -p ~/.openclaw/workspace/obsidian-vault/compass/{vectors,clusters,signals,prior}text
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill claims it 'automatically activates' during broad categories of ordinary conversation such as preferences, comparisons, and life-direction questions. In a tool that extracts personal signals and persists them, overly broad triggering can cause unintended collection, analysis, and storage of sensitive user data without sufficiently specific consent boundaries.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README instructs users to run
npx clawhub@latest install identity-compass, which fetches and executes the latest remote package version at install time. This creates a supply-chain risk: if the package is compromised or a bad release is published, users may execute attacker-controlled code during installation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README says the agent silently extracts vectors from background conversations, but does not present a prominent privacy notice or informed-consent flow. Silent behavioral analysis of personal conversations is risky because users may not realize sensitive preferences, relationships, or life decisions are being persistently inferred and stored.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This duplicated finding points to the same session-persistence behavior: personal decision signals are stored across sessions in a local vault. In context, the skill processes intimate life and identity discussions, so persistence materially raises privacy risk even if data stays local.
- Content
指南针将你的决策向量存储在 Obsidian 兼容的 vault 中。只需创建文件夹：
bash mkdir -p ~/.openclaw/workspace/obsidian-vault/compass/{vectors,clusters,signals,prior}3. 开始聊天
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This duplicated finding points to the same session-persistence behavior: personal decision signals are stored across sessions in a local vault. In context, the skill processes intimate life and identity discussions, so persistence materially raises privacy risk even if data stays local.
- Content
指南针将你的决策向量存储在 Obsidian 兼容的 vault 中。只需创建文件夹:
bash mkdir -p ~/.openclaw/workspace/obsidian-vault/compass/{vectors,clusters,signals,prior}3. 开始聊天
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is described as automatically activating whenever it detects vague 'decision signals' during normal conversation. Because the trigger boundary is undefined, the skill may over-collect and analyze unrelated user dialogue, increasing privacy exposure and causing unintended behavior in ordinary chats.
- Content
Static analysis
No suspicious patterns detected.