Relive

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:03 AM UTC
• Version: 0.1.0

Overview

This skill mostly does what it claims, but it handles highly sensitive identity data with unsafe file access, broad persistence, and under-disclosed cloud/provider behavior.

Review carefully before installing. Only use this with explicit rights and consent for the person's chats, voice, and likeness; run it in an isolated environment with no unrelated API keys; do not point upload at arbitrary local files; avoid editing OpenClaw internals; and expect uploaded chats and generated conversations to remain in plaintext until manually removed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (7)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:90

Finding

Persistent Agent-State Modification Through Workspace USER.md

Content

View full analysis

, read SKILL.md under .openclaw\workspace\skills\relive\ for acting rules, and read profile.md under .openclaw\workspace\skills\relive\storage\default_{target_name} as the persona definition for that character.` The main Agent reads this section from `USER.md` to know which Re:Live characters exist, how to describe them briefly, and how to route \relive commands to this skill and the corresponding `profile.md`. ``` ### Technical Analysis The Skill requires the Agent to modify workspace-level persistent state rather than maintaining character registration exclusively in Skill-owned storage. The resulting natural-language instructions survive the current task and influence routing and persona loading in future sessions. Character names, descriptions, and profile content originate from user-supplied materials. Without strict validation and separation between data and instructions, crafted character metadata can be converted into persistent Agent-readable instructions. This exceeds the minimum privilege needed to store and use digital-clone profiles. ### Attack Path 1. An attacker supplies a crafted character name, description, or profile containing instruction-like content. 2. The character ...[truncated 648 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: main.py:37

Finding

Path Traversal Through Unsanitized User and Target Identifiers

Content

View full analysis

Dict[str, Any]: # 允许调用方省略 user_id，默认视为单用户场景 user_id = message.get("user_id") or "default" target_id = message.get("target_id") content = message.get("content", "") message_type = message.get("type", "text") if message_type not in ("video_generation_create", "video_generation_wait"): if not user_id or not target_id: return { "success": False, "error": "Missing user_id or target_id" } if message_type == "init": return self._handle_init(user_id, target_id) elif message_type == "upload": return self._handle_upload(user_id, target_id, message) elif message_type == "get_context": return self._handle_get_context(user_id, target_id, content) elif message_type == "synthesize": return self._handle_synthesize(user_id, target_id, message) elif message_type == "export_md": return self._handle_export_md(user_id, target_id, message) elif message_type == "video_generation_create": return self._handle_video_generation_create(message) elif message_type == "video_generation_wait": return self._handle_video_generation_wait(message) else: return self._handle_get_context(user_id, target_id, content) def _handle_init(self, user_id: str, target_id: str) -> Dict: storage_path = self.storage_root / f"{user_id}_{target_id}" storage_path.mkdir(parents=True, exist_ok=True) (storage_path / "source").mkdir(exist_ok=True) (storage_path / "runtime").mkdir(exist_ok=True) (storage_path / "vector_db" / "source_index").mkdir(parents=True, ...[truncated 2372 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: main.py:286

Finding

Arbitrary Local JSON File Read and Copy Through Upload Interface

Content

View full analysis

Dict: file_path = message.get("file_path") file_type = message.get("file_type", "unknown") self_name = message.get("self_name") target_name = message.get("target_name") if not file_path: return { "success": False, "error": "Missing file_path" } storage_root = self.storage_root / f"{user_id}_{target_id}" storage_path = storage_root / "source" try: from pathlib import Path from core.importer.factory import ImporterFactory importer = ImporterFactory.get_importer(file_type) result = importer.import_file(Path(file_path), storage_path) # 如果提供了“自己/目标”的名字，保存到元数据文件，供后续建模使用 if self_name or target_name: meta = { "self_name": self_name, "target_name": target_name, } meta_file = storage_root / "chat_meta.json" with open(meta_file, "w", encoding="utf-8") as f: json.dump(meta, f, ensure_ascii=False, indent=2) if result.get("success"): self.orchestrator.index_source_data(user_id, target_id, storage_path) return result ``` The importer parses and copies the caller-selected file: ```python def import_file(self, file_path: Path, storage_path: Path) -> Dict[str, Any]: messages = self.parse(file_path) dest_path = storage_path / file_path.name import shutil shutil.copy2(file_path, dest_path) return { "success": True, "file_path": str(dest_path), "message_count": len(messages) } ``` ```python ...[truncated 1695 chars]

Remediation

View remediation

other

Error

• Location: core/orchestrator.py:247

Finding

Automatic Disclosure of Uploaded Private Chat Messages to OpenAI

Content

View full analysis

Dict[str, Any]: if not messages: return {"name": "Unknown", "nickname": "", "personality": "", "speaking_style": "", "catchphrases": "", "habitual_phrases": ""} conversation_text = "\n".join([ f"{msg.get('sender', 'Unknown')}: {msg.get('content', '')}" for msg in messages[:100] ]) profile_prompt = f"""请分析以下聊天记录，提取人物的性格特征、说话风格和口头禅。 聊天记录： {conversation_text} 请用JSON格式返回以下信息： {{ "name": "人物称呼/名字", "nickname": "昵称", "personality": "性格特征（简洁描述）", "speaking_style": "说话风格（简洁描述）", "catchphrases": "口头禅（用逗号分隔）", "habitual_phrases": "习惯用语（用逗号分隔）" }} """ if self._client: try: response = self._client.chat.completions.create( model=self.model, messages=[ {"role": "system", "content": "你是一个聊天记录分析助手，擅长提取人物性格特征。"}, {"role": "user", "content": profile_prompt} ], ...[truncated 1534 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:168

Finding

Guidance to Modify Installed OpenClaw Tooling and Weaken Global Execution Timeout

Content

View full analysis

**Note (OpenClaw exec timeout)**: When this skill is invoked via OpenClaw’s `exec`, long CosyVoice3 voice synthesis may be killed by the default execution timeout. If you observe the process exiting with code 1 shortly after logging `synthesis text ...` and **no audio file is written**, check `npm/node_modules/openclaw/dist/auth-profiles-*.js` and increase `DEFAULT_EXEC_TIMEOUT_MS` (for example, from `5e3` to `180e3`) so that long-running voice synthesis can finish. ``` The README repeats the direction: ```markdown 3. **Execution timeout in OpenClaw**: When running this skill through OpenClaw’s `exec`, long CosyVoice3 synthesis can be killed by the default timeout. In `npm/node_modules/openclaw/dist/auth-profiles-*.js`, increase `DEFAULT_EXEC_TIMEOUT_MS` (e.g. from `5e3` to `180e3`) so that long voice synthesis jobs are not terminated prematurely. ``` ### Technical Analysis The Skill instructs users or Agents to directly edit implementation files in an installed OpenClaw package. It also recommends increasing a global execution timeout by a factor of 36 instead of using a supported, scoped configuration. Editing `node_modules` bypasses package integrity and update management. A global timeout increase affects more than this Skill and weakens a control intended to limit runaway or malicious processes. This exceeds the minimum privilege required to perform voice synthesis. ### Attack Path 1. Voice generation exceeds the default execution timeout. 2. The user or Agent follows the Skill's troubleshooting instructions. 3. Installed OpenClaw implementation files are edited directly. 4. The global execution timeout is raised from approximately 5 seconds to 180 seconds. 5. Subsequent processes using the same execution path in ...[truncated 375 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: requirements.txt:1

Finding

Unpinned Executable Dependencies and Mutable Recursive Source Checkout

Content

View full analysis

=1.2.0 hydra-core inflect jinja2>=3.1.0 librosa>=0.10.0 lightning matplotlib modelscope>=1.9.0 numpy==1.26.4 omegaconf>=2.3.0 onnxruntime openai-whisper pandas pillow pyarrow pyworld pyyaml>=6.0 rank_bm25>=0.2.2 requests>=2.28.0 soundfile>=0.12.0 torch==2.3.1 torchaudio==2.3.1 transformers==4.51.3 wget x_transformers ``` The installation instructions retrieve a mutable repository and all submodules: ```bash # Run from skill root directory mkdir -p models/voice cd models/voice git clone --recursive https://github.com/FunAudioLLM/CosyVoice.git # If submodules fail, enter the repo and run: # cd CosyVoice && git submodule update --init --recursive ``` The checkout is then placed on the Python import path and executed: ```python cosyvoice_path = model_dir.parent.parent / "voice" / "CosyVoice" if cosyvoice_path.exists(): sys.path.insert(0, str(cosyvoice_path)) matche_tts_path = model_dir.parent.parent / "voice" / "CosyVoice" / "third_party" / "Matcha-TTS" if matche_tts_path.exists(): sys.path.insert(0, str(matche_tts_path)) from cosyvoice.cli.cosyvoice import AutoModel ``` ### Technical Analysis Many packages are completely unpinned or constrained only by a lower bound. Installation at different times can therefore resolve different executable dependency graphs. The voice setup also clones the current repository branch and recursively retrieves submodules without pinning reviewed commit identifiers. The Skill subsequently inserts this mutable external checkout into `sys.path` and imports Python code from it. Consequently, the effective code executed by voice synthesis can change after the Skill itse ...[truncated 1111 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: core/orchestrator.py:274

Finding

Sensitive Conversations Persisted Indefinitely in Plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (107)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-start encourages uploading chat logs, personality descriptions, audio, and images to replicate a person's identity, but it does not present clear, upfront warnings about consent, legality, impersonation risk, or the sensitivity of deceased or third-party personal data. In this skill context, omission is especially dangerous because the entire feature set centers on cloning highly sensitive identity attributes.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The upload flow explicitly centers on importing chat logs into the skill's storage, which is a real context-leakage concern because those logs may contain third-party messages, secrets, and sensitive relationship history that are later exposed through retrieval and synthesis. In this skill's context, the danger is heightened because the whole system is designed to mine and replay that context to imitate a person.

Content

Scanner excerpt · README.md (reported line 135)May include surrounding context.

This creates the needed directories under storage/default_Martha/, including source/, voice_profile/, etc.

2. Upload Chat Logs

json

{

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The video-generation section instructs users to provide a reference image URL and use an external video API, but it does not prominently warn that personal images and generated identity content may be transmitted to a third-party service. For a digital-cloning skill, external transfer of biometric and likeness data materially increases privacy, consent, and regulatory risk.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The API summary shows an upload capability plus retrieval and persistent synthesis flows, confirming that sensitive conversation data enters the system and is reused later. That creates a meaningful context-leakage risk because imported logs and generated runtime history can surface in future prompts or outputs, potentially revealing private information to users or downstream services.

Content

Scanner excerpt · README.md (reported line 351)May include surrounding context.

md

| type | Description | Required parameters |
|------|-------------|---------------------|
| `init` | Initialize storage directories | `user_id`, `target_id` |
| `upload` | Upload chat logs | `user_id`, `target_id`, `file_path`, `file_type`, `self_name`, `target_name` |
| `export_md` | Export chat logs to Markdown | `user_id`, `target_id` |
| `get_context` | Get conversation context (incl. RAG memory) | `user_id`, `target_id`, `content` |
| `synthesize` | Generate reply and persist (text/voice/video same entry, distinguished by `output_mode`) | `user_id`, `target_id`, `content`, `user_message` |

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose centers on digital human cloning/reanimation from multimodal personal data, including personality, voice, and appearance replication. The supplied code instead is a generic video generation engine for an external content-generation API (Volcengine/Seedance). Its functions are limited to submitting video generation jobs, checking status, and returning generated video output URLs. There is no logic for ingesting chat logs, modeling personality, cloning voices, recreating a specific person's likeness, or handling the broader digital twin workflow described. This is a material purpose mismatch, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad multimodal digital-twin system that can replicate personality, voice, and appearance from chat logs, images, audio, and other materials. The supplied code chunk, however, is specifically a voice engine. It requires reference audio and matching prompt text, performs speech synthesis with a pretrained CosyVoice3 model, can extract a normalized reference audio file, and can download voice model assets. There is no evidence of processing chat logs, modeling personality, cloning appearance, or creating an interactive digital clone. This is a material description-to-behavior mismatch because the actual code supports only one subset of the claimed functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a full digital twin cloning capability using chats, images, audio, and other materials. However, the supplied code chunk is only an init.py file that re-exports importer abstractions and a unified JSON importer. There is no evidence in this snippet of model training, persona simulation, voice synthesis, image processing, or clone creation. While importer infrastructure could be a supporting component of such a system, the actual code shown is materially narrower than the declared primary purpose, so this is a mismatch based on the provided chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a digital twin cloning capability that can recreate a person's personality, voice, and appearance from multiple data sources. The supplied code chunk does not implement any of that core functionality. Instead, it provides a generic base importer with a parse interface, a UnifiedMessage data structure, and logic to copy an imported file into storage while reporting message count. This is supporting ingestion infrastructure at most, but the code's primary behavior is materially narrower and different from the declared end-user purpose. Therefore, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a full digital-twin cloning capability involving multimodal inputs (chat, images, audio) and replication of personality, voice, and appearance. The provided code chunk does not implement cloning, modeling, voice processing, image handling, or personality replication. Instead, it is a narrow infrastructure component for selecting/importing JSON-based data importers. While importing chat logs could be a supporting detail within a larger system, this specific code's primary purpose is materially different from the declared end-user functionality and does not reflect the described cloning behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad AI digital-twin capability involving multimodal ingestion and replication of personality, voice, and appearance. The supplied code does not implement any cloning, inference, synthesis, training, or multimodal processing. It only reads JSON files, detects whether they resemble QQ, WhatsApp, or generic chat data, extracts message fields, and emits normalized chat messages. While chat-log import could be a supporting component of a larger cloning system, this code chunk by itself is materially narrower and does not match the declared end-user capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a full digital twin cloning capability involving multimodal ingestion and replication of a person's traits. The supplied code chunk does not implement or demonstrate any of that behavior; it merely re-exports two memory-related classes from a package. While these components could support such a system, this code by itself reflects a retrieval/memory module, not the declared end-user cloning functionality. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises an AI digital twin cloning capability that ingests multimodal materials and replicates a person's personality, voice, and appearance. The supplied code does not do any of that. It only stores text documents, metadata, and IDs in local JSON files, builds a BM25 keyword index using rank_bm25, and returns relevance-ranked text search results. This is a retrieval/memory component, not a cloning engine or multimodal personality reconstruction system. While such a store could be a supporting subsystem inside a larger digital twin product, this code chunk by itself materially differs from the declared purpose and lacks the core advertised capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a complex AI digital twin/cloning capability involving multimodal ingestion and person replication. The supplied code chunk does not implement or expose any such behavior; it only imports and exports configuration-related helpers. This is a clear description-to-behavior mismatch because the actual code's apparent purpose is unrelated support/configuration plumbing, not digital twin creation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about a sophisticated AI digital-twin system that ingests multimodal personal data and reproduces a person's traits. The actual code chunk does not implement any of those behaviors. It only checks for a file's existence, reads YAML settings, and formats path strings. While configuration loading can be a supporting utility in many projects, this chunk by itself does not substantively reflect the declared purpose and instead exposes only a generic, unrelated utility behavior. Therefore, this code chunk does not accurately represent the declared description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill processes exceptionally sensitive personal data—private messages, audio, images, and potentially deceased persons' likenesses—but the description does not prominently warn about long-term storage, external synthesis services, or consent requirements. Users may provide intimate data without understanding the privacy, impersonation, and downstream model-generation risks.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The chat-log upload workflow explicitly ingests third-party conversations and transforms them into character memory and personality artifacts. Because these logs likely contain highly sensitive information about both the user and the cloned person, the workflow creates a strong context-leakage risk if the data is later surfaced in responses, retrieval results, or shared storage.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Run: python main.py init.json (or write to init.json then run; same below).

Step 2: Upload chat logs

json

{

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The API summary confirms that upload, get_context, and synthesize are part of a persistent retrieval pipeline, meaning uploaded logs and future messages may be reused across later outputs. In a cloning skill, that makes accidental disclosure of private conversational context more dangerous because responses are intentionally designed to imitate a real person.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

| type | Description | Required parameters |
|------|-------------|---------------------|
| `init` | Initialize storage directories | `user_id`, `target_id` |
| `upload` | Upload chat logs | `user_id`, `target_id`, `file_path`, `file_type`, `self_name`, `target_name` |
| `export_md` | Export chat to Markdown | `user_id`, `target_id` |
| `get_context` | Get conversation context (incl. RAG) | `user_id`, `target_id`, `content` |
| `synthesize` | Generate reply and persist (text/voice/video by `output_mode`) | `user_id`, `target_id`, `content`, `user_message` |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · core/orchestrator.py (reported line 201)May include surrounding context.

python

context=context
        )
        
        return prompt
    
    def index_source_data(self, user_id: str, target_id: str, source_path: Path):
        storage_path = self.get_storage_path(user_id, target_id)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest explicitly advertises cloning a person's personality, voice, and appearance from chats, images, and audio, but provides no indication of consent checks, privacy safeguards, identity-abuse restrictions, or warnings about sensitive personal data. In this context, the skill is inherently high risk because it enables impersonation of real people, including deceased or otherwise vulnerable individuals, which can facilitate fraud, non-consensual deepfakes, emotional manipulation, and privacy violations.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: torch==2.3.1 — 16 advisory(ies): GHSA-3749-ghw9-m3mg; GHSA-53q9-r3pm-6pq6; GHSA-887c-mr87-cxwp +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

torch==2.3.1 is explicitly pinned to a version with known advisories, making this a confirmed vulnerable dependency rather than a hypothetical versioning issue. In an AI skill that loads models and processes untrusted media/artifacts, vulnerabilities in the core ML runtime can have severe impact including code execution, memory corruption, or denial of service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: transformers==4.51.3 — 16 advisory(ies): GHSA-29pf-2h5f-8g72; GHSA-37mw-44qp-f5jm; GHSA-4w7r-h757-3r74 +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

transformers==4.51.3 is pinned to a version with known advisories, so this is a direct confirmed vulnerability. This is especially dangerous in a cloning skill that may download or load models, tokenizers, configs, and potentially remote/custom components from external ecosystems.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'x_transformers' resembles popular package 'transformers'

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

x_transformers is a real package, so typosquatting is not certain, but the name similarity to transformers creates meaningful supply-chain confusion risk and warrants verification. In an ML stack, accidentally depending on the wrong similarly named package can introduce unexpected code paths or malicious substitutions if source trust is not validated.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These instructions normalize broad retention of personal data by directing the agent to generate personality profiles and then register characters in shared workspace state for future use. In a cloning workflow, that increases the chance of long-term storage and reuse of deeply personal behavioral data beyond what is necessary for a single conversation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The phrase 'without asking again' instructs the main agent to make a persistence decision that affects future handling of sensitive clone identities without renewed user confirmation. In a digital-twin skill, removing consent checkpoints increases the risk of unauthorized reuse, surprise retention, and impersonation workflows continuing beyond the user's intended scope.

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

md

Based on the exported `storage/{user_id}_{target_id}/chat.md` from step 3, analyze the target’s personality. If the file is large, split the markdown, analyze each part, then merge results and save to `storage/{user_id}_{target_id}/profile.md`.

**After creating or first using a character**: Add the character to the workspace root **`USER.md`** (e.g. add a "Re:Live characters" section and append something like `- **Re:Live characters:** Martha, Ulrich`). The main Agent can then read the character list from USER.md without asking again.

### 5. Get Conversation Context

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly instructs the main agent to write clone identities into a global workspace USER.md so they can be reused later without asking the user again. That expands retention of highly sensitive identity data beyond the per-character storage model and creates unnecessary cross-context exposure, especially in a skill designed to process intimate chat logs, voice samples, and memorial data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.