Security audit
intrusive-thoughts
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated purpose (moods, memory, trust, dashboard) but contains several inconsistencies and ambiguous instructions (cron/at creation, 'execute the prompt', and data_dir handling) that merit manual review or sandboxing before use.
This skill implements the features it claims, but several things don't add up and could be risky if you run it without reviewing code or isolating it: 1) Audit the scripts that run autonomously: inspect intrusive.sh, schedule_day.py, setup.sh, install.sh, log_result.sh, and any CLI scripts. Look for code paths that create cron/at jobs or that execute strings as shell commands. SKILL.md's 'execute the prompt' is ambiguous — confirm whether prompts can contain shell commands that get run. 2) Check where data are written: config.example.json sets a configurable data_dir (~/Projects/intrusive-thoughts by default). Ensure data_dir is set to a directory you control (ideally inside a sandbox/container) so the skill cannot write across your home or system. 3) Keep optional integrations disabled until you understand behavior: Telegram, Moltbook, and OPENAI_API_KEY are optional. If you enable them, the agent can send outbound messages and call external APIs — enable only when necessary and supply least-privilege tokens. 4) Run in a contained environment first: test inside a VM/container or throwaway account to see what cron jobs, files, and network calls it actually performs. Monitor logs and network traffic. 5) If you plan to install: do not run setup/install scripts as root. Inspect install.sh and setup.sh line-by-line. Prefer manual installation (copy files into OpenClaw skills dir) and manual cron scheduling instead of letting scripts modify system schedules. 6) If you want to proceed safely: search for code that uses subprocess with shell=True, os.system, eval/exec, or that POSTs data. The SECURITY.md claims none of these exist, but the SKILL.md and included scripts contain ambiguous behaviors — verify the claim before trusting autonomous operation. If you want, I can parse specific files (intrusive.sh, schedule_day.py, setup.sh, install.sh) and summarize any lines that create cron/at jobs, execute arbitrary shell commands, or make network POSTs.
SkillSpector findings are pending for this release.