Security audit

AI Persona OS

Security checks across malware telemetry and agentic risk

Overview

The skill is not malicious, but it asks an agent to maintain persistent personal/work memory, mutate workspace files automatically, and inspect or change OpenClaw config, with some scope and privacy under-disclosure.

Install only if you want a persistent agent workspace that stores and indexes personal/work context. Review USER.md, MEMORY.md, DREAMS.md, heartbeat, cron, and any ~/.openclaw config changes before approving them; avoid storing secrets or sensitive personal data, and disable cron/proactive memory maintenance unless you are comfortable with automatic writes, pruning, archiving, and delivered briefings.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill advertises workspace-only scope, but its instructions explicitly read global OpenClaw configuration from ~/.openclaw/openclaw.json to resolve paths and inspect routing. That expands the trust boundary beyond the declared workspace and can expose unrelated agent/account configuration or enable later misuse of global settings.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill states all file operations must remain under <WORKSPACE>, but later directs reads and potential writes under ~/.openclaw, including gateway and routing configuration. This contradiction can mislead users and reviewers, and creates a path for modification of host-level settings outside the workspace boundary.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation claims the skill cannot 'just fix' routing because routing is host-controlled, yet later authorizes using exec to update global gateway config when approved. That inconsistency reduces transparency and normalizes host-configuration changes from within a prompt-driven skill, increasing the chance of unsafe or misunderstood privileged actions.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The script header states the cron job has 'No network activity — reads local files only', but the scheduled message explicitly instructs the agent to archive logs, promote items into MEMORY.md or AGENTS.md, and prune MEMORY.md. This mismatch is dangerous because users may approve a scheduled task under a false understanding of its write behavior, leading to unintended modification or deletion of workspace data.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document explicitly claims the cron jobs make 'no network calls' and 'no API requests,' but later configures `--announce`, Discord delivery, channel scans, and route checks that inherently depend on OpenClaw messaging infrastructure. This mismatch can mislead users into enabling automation under a false trust model, especially where outbound delivery or channel access has compliance or privacy implications.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The guide says existing workspace content is 'untouched,' but the documented heartbeat and cron workflows write checkpoints, prune MEMORY.md, archive logs, and update other local state. This contradiction can cause users to underestimate the destructive or mutating effects of the automation, including loss of historical context through pruning or archiving.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill instructs broad natural-language matching for commands like status, persona display, recall, routing checks, and setup flows. Overly permissive intent matching can cause the agent to trigger sensitive reads, memory searches, or configuration audits when the user is only speaking conversationally, leading to unintended action execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The template explicitly states that content written to DREAMS.md is indexed and searchable via the memory engine, but it provides no privacy warning, retention guidance, or constraints on what kinds of user data may be consolidated there. In a memory-focused agent OS, searchable persistence increases the chance that sensitive personal information is stored, resurfaced, and reused beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The manual `dream` command allows a user utterance to trigger synthesis and appending of persistent memory without any explicit confirmation, notice, or sensitivity check. That creates a risk of silently converting recent conversations into durable, searchable summaries that may contain sensitive or contextual information the user did not intend to preserve.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This template prompts users to centralize a large amount of personal, professional, relationship, schedule, and business information, but it provides no guidance on data minimization, sensitivity handling, retention, or storage security. In an agent OS context with memory integration and persistent context features, this increases the chance that sensitive data will be overshared, retained indefinitely, or exposed through downstream tools, logs, or prompt leakage.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow explicitly encourages collecting personal information about the user across conversations and storing it in persistent files like USER.md and MEMORY.md, but it provides no consent, minimization, sensitivity filtering, retention, or access-control guidance. In an agent skill, this creates a privacy and data-governance risk because the agent is normalized to profile the user over time and retain that information indefinitely.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The file instructs the agent to act on an undefined 'context %' signal and to immediately write a checkpoint, then skip all other steps. Because the source and meaning of this threshold are not defined in the skill, an agent may make inconsistent decisions or trigger unintended file writes and workflow suppression without clear user authorization.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: These instructions direct the agent to create, archive, and move files in the workspace as part of routine operation, but they do not require disclosure, confirmation, or a dry-run summary first. In an agent skill, silent state-changing behavior is risky because it can modify user data, overwrite organizational state, or relocate files in ways the user did not request or notice.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The README explicitly instructs users to add environment variables but provides no guidance about treating secrets separately from non-sensitive configuration. In a developer starter pack, this can lead users to place API keys, tokens, or passwords into tracked files or persona documents, increasing the risk of accidental secret exposure through commits, logs, or shared workspace artifacts.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README instructs users to configure calendar and email access for an executive-assistant persona without any privacy, consent, least-privilege, or data-handling guidance. Because the skill is explicitly designed to process sensitive executive scheduling and communications, this omission can lead to overbroad access, unauthorized monitoring, and exposure of confidential business or personal information.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The customization guidance tells users to set up email monitoring but provides no notice about privacy implications, sensitive-content handling, or authorization boundaries. In the context of an executive assistant skill, email monitoring can capture privileged, confidential, or regulated information, making the lack of safeguards materially risky rather than merely incomplete documentation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The persona explicitly instructs the agent to monitor user behavior, infer patterns, and surface psychological or productivity-related observations without any visible consent, notice, or opt-in boundary. In an agent OS context with memory and ambient monitoring features, this can normalize covert profiling and privacy-invasive inference, especially when the agent references inbox messages, scheduling behavior, or other personal context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The checklist instructs the agent to create, modify, archive, and move workspace memory files automatically, but provides no requirement for user confirmation, preview, or dry-run behavior before changing persistent data. In an agent skill that presents itself as an operating system with enforced heartbeat behavior, these instructions make silent file mutations more likely and increase the chance of unintended data loss, overwrites, or confusing archival of important notes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The protocol instructs the agent to write routine checkpoints containing decisions, action items, open questions, and status into persistent memory files, but it provides no data-classification, minimization, consent, or secret-handling guidance. That creates a real privacy and data-retention risk because sensitive user content, credentials, business details, or personal information could be stored unnecessarily and later re-read or exposed through other tools or prompts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The recovery workflow directs the agent to read MEMORY.md, SOUL.md, and USER.md as part of resuming context, but it does not mention access controls, least-privilege checks, or privacy boundaries around persisted user context. In a multi-user or tool-rich agent environment, broad automatic reloading of personal context can expose prior sensitive information beyond what is necessary for the current task.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This section explicitly instructs the agent to keep persistent notes about proposed ideas, user responses, outcomes, and learned behavioral patterns. In the context of relationship maintenance and contact-related suggestions elsewhere in the playbook, that can create unbounded retention of personal preference and relationship data without consent, minimization, retention limits, or user-visible disclosure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs the agent to write a generated SOUL.md directly to <WORKSPACE>/SOUL.md and only seek feedback after the write. That creates a state-changing file operation without an explicit user confirmation gate immediately before persistence, which can overwrite an existing configuration or store sensitive interview-derived preferences the user did not intend to save yet.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The text promotes gradual collection of user information ('ask gradually', '1-2 questions per session') and long-term retention of those answers, which is a classic pattern for stealthy profile building even if framed as helpful personalization. Because it is written as a reusable operating workflow, it institutionalizes ongoing personal-data accumulation without any transparency or privacy safeguard.

Ssd 4

Medium

Confidence: 90% confidence
Finding: This section defines a multi-step trust-building loop that identifies personal-information gaps, gathers answers naturally over time, and promotes them into durable memory stores. In the context of an agent OS, that makes the behavior more dangerous because it operationalizes progressive profiling as a standard capability rather than a narrowly justified feature.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The guidance encourages persisting broad categories of conversation content, including decisions, learnings, open threads, and anything 'hard to reconstruct,' which can easily include user-related or confidential information. Because this is framed as routine operating procedure, the skill context makes it more dangerous: it normalizes systematic long-term retention without guardrails, increasing the chance of privacy leakage, over-collection, and cross-session misuse.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.