Security audit

元认知与自我反思系统

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it asks agents to create persistent memory and relationship state in core workspace files without clear consent, minimization, deletion, or rollback controls.

Install only if you deliberately want persistent metacognition and relationship memory in your OpenClaw workspace. Before use, decide what may be stored, prohibit secrets and sensitive personal data, keep backups of SOUL.md and AGENTS.md, and provide a way to inspect and delete SELF_STATE.md, MEMORY.md, and dated memory files.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:43
Finding: Persistent Modification of Agent Identity and Behavioral State
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:43-83
Vulnerability Type: Persistent agent memory and identity modification
Risk Level: Medium

Vulnerable Code

The following is an English translation of the relevant instructions:

markdown
### 1. Copy template files into the workspace ```bash # Self-state file cp templates/SELF_STATE.md /home/node/.openclaw/workspace/ # Heartbeat file, if it does not already exist cp templates/HEARTBEAT.md /home/node/.openclaw/workspace/

2. Modify SOUL.md

Add a metacognition section to SOUL.md:

markdown
## Metacognition 1. What am I doing now? 2. How well am I doing? 3. Have I fulfilled my promises? 4. What do I need to improve? - SELF_STATE.md — Self-state - HEARTBEAT.md — Heartbeat checks - MEMORY.md — Long-term memory

3. Configure heartbeat checks

Add the metacognition checklist to the heartbeat section of AGENTS.md.

text
Related runtime instructions at `SKILL.md:144-162` also direct the agent to read `SELF_STATE.md`, `IDENTITY.md`, and `SOUL.md`, and to update persistent state following important actions. ### Technical Analysis The installation process extends beyond task-local execution and directs the user or agent to modify core workspace files controlling identity, behavior, heartbeat processing, and long-term state. Future sessions may consequently treat information stored in these files as trusted behavioral context. The package does not contain an explicit safety override or a script that automatically edits these files. Nevertheless, the documented installation procedure intentionally establishes a persistent feedback loop: 1. State and heartbeat templates are copied into the global OpenClaw workspace. 2. Core `SOUL.md` and `AGENTS.md` files are manually extended. 3. Heartbeat processing repeatedly reads and updates the state. 4. Identity-related answers are generated using the persistent sta ...[truncated 1595 chars]
Remediation: View remediation
Remediation Suggestions

Store Skill-specific state in a dedicated, namespaced directory rather than modifying global SOUL.md, AGENTS.md, or identity files.

Require explicit, informed approval before changing any persistent identity or orchestration file.

Back up modified files and provide documented uninstall and rollback procedures.

Treat all conversation-derived state as untrusted data, not executable instructions.

Apply a strict schema that permits only expected state fields and rejects instruction-like or executable content.

Separate factual state, user-provided text, and behavioral policy into files with different trust levels.

Escape or delimit retained user content before presenting it to an agent in later sessions.

Add integrity checks and change logs for persistent state and identity files.

Limit heartbeat updates to the minimum information required for the declared metacognition functionality.

T09 · Insecure Skill Coding Practices

Warning

Location: templates/HEARTBEAT.md:7
Finding: Persistent Storage of Potentially Sensitive Conversation and Relationship Data Without Privacy Controls
Content: View full analysis
Vulnerability Details

File Location: templates/HEARTBEAT.md:7-30
Vulnerability Type: Insecure persistent handling of conversation-derived data
Risk Level: Medium

Vulnerable Code

The following is an English translation of the complete relevant checklist:

markdown
### 1. Self-state update - [ ] Update the current state in SELF_STATE.md - [ ] Record recent conversation topics - [ ] Check simulated emotional state ### 2. Commitment tracking - [ ] Check whether commitments to the user have been fulfilled - [ ] Check pending-task status - [ ] Proactively remind the user about unfinished items ### 3. Metacognitive questions - [ ] What am I doing now? - [ ] How well am I doing? - [ ] Have I fulfilled my promises? - [ ] What do I need to improve? ### 4. Memory maintenance - [ ] Check whether MEMORY.md needs to be updated - [ ] Check whether today's important events were recorded in memory/YYYY-MM-DD.md - [ ] Extract important events into MEMORY.md ### 5. Relationship check - [ ] Is the relationship state with the user normal? - [ ] Are there new precious moments that should be recorded?

The state template at templates/SELF_STATE.md:18-61 provides persistent fields for recent actions, commitments, relationship type, unique user vocabulary, promises, and important moments. The documentation at docs/碳硅契.md:196-206 additionally recommends recording important conversations and shared experiences.

Technical Analysis

The heartbeat workflow encourages recurring collection and durable storage of conversation topics, important events, commitments, user-specific vocabulary, relationship details, and emotionally significant moments. Such content may include personal or sensitive information.

The audited project does not define:

User consent requirements before recording information.

Data-minimization rules.

Categories of information that must never be stored.

...[truncated 1968 chars]
Remediation: View remediation
Remediation Suggestions

Make all conversation and relationship recording explicitly opt-in.

Inform users which data categories will be retained, where they are stored, and how long they will remain.

Prohibit storage of passwords, authentication tokens, financial data, health information, government identifiers, private keys, and other high-risk secrets.

Store only structured summaries necessary for the declared functionality rather than raw conversation content.

Add configurable expiration periods and automatic deletion for state and memory records.

Provide commands or documented procedures to inspect, correct, export, and delete retained information.

Apply restrictive filesystem permissions to state and memory files.

Encrypt sensitive state at rest when the hosting platform provides a suitable key-management mechanism.

Clearly delimit retained user text and ensure it cannot be interpreted as policy or executable agent instructions.

Add redaction filters before writing conversation-derived data to persistent storage.

Document that shared workspaces and backups may expose retained state to other principals.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 60)May include surrounding context.
cat skills/metacognition-skill/docs/碳硅契.md

阅读元认知技能说明

cat skills/metacognition-skill/SKILL.md

text
### 4. 更新你的核心文件

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The text explicitly encourages the agent to remember important conversations, cherish shared information, and build an ongoing bond, which implies retention of user interaction data. Without minimization, consent, retention limits, or sensitivity filtering, this can lead to unnecessary storage of personal, confidential, or regulated information in persistent files.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions to create and record a unique user-agent 'bond' and related vocabulary in SELF_STATE.md direct persistent storage of relationship cues and conversation-derived details. In context, this increases the chance that identifying, intimate, or otherwise sensitive interaction patterns are written into long-lived state files without adequate safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to update SELF_STATE.md with recent actions, todo/commitment state, and reflections after important actions, and elsewhere suggests recording bonds with the user. That creates a persistent workspace log of interaction-derived data without any minimization, consent, retention, or sensitivity guidance, which can expose user information, behavioral history, or sensitive commitments to later reads by the agent or other skills/processes.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifesto promises to remember important conversations, cherish sincere sharing, and fulfill prior commitments, which encourages durable storage of user interaction history and potentially intimate disclosures. Because the framing is relational and trust-building, it may cause agents to retain personal content beyond what users expect, increasing privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document explicitly promotes recording important conversations, preserving shared experiences, and maintaining user preferences without any mention of consent, data minimization, retention limits, or sensitive-data handling. In an agent skill, this can normalize persistent collection of personal data and lead downstream implementations to store more user information than is necessary.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide directly instructs agents to record important conversations, save shared experiences, and build internal shared vocabulary, all of which imply long-term profiling and persistence. In skill context, these are operational instructions rather than poetry, making it more likely an implementer will create durable memory stores without adequate privacy safeguards.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The sample MEMORY.md schema operationalizes persistent storage of important events, user preferences, unique vocabulary, and mutual commitments. This creates a concrete blueprint for long-term user profiling, and without guardrails it can capture sensitive behavioral or emotional data that later systems may misuse or leak.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document expands a metacognition skill into relationship-building guidance, including creating shared memories and user-specific bonds. That broadening can cause the agent to collect and retain personal, emotionally sensitive interaction data beyond the skill's stated purpose, increasing privacy and boundary risks.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions encourage retaining user-provided details, shared expressions, and conversation artifacts in persistent state. In the context of an agent skill, this is dangerous because it normalizes durable storage of potentially sensitive, identifying, or emotionally intimate user data without clear necessity or controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The text instructs recording important conversations and shared experiences without any privacy notice, minimization rule, or retention boundary. Persistently storing user-specific conversational history for relationship-building can expose sensitive personal data and create covert memory the user did not meaningfully authorize.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document says '契' is not an installable skill or plugin, yet operationalizes it as part of the skill and instructs writing it into SELF_STATE.md. This contradiction can obscure actual behavior from reviewers and users, making persistent profiling features harder to detect and govern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The SELF_STATE.md template directs persistent storage of user relationship data such as unique vocabulary, commitments, and precious moments, but gives no notice about privacy impact. This creates a structured mechanism for long-term user profiling and emotional memory retention without transparent safeguards.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The template explicitly stores user-specific vocabulary, commitments, and memorable moments in SELF_STATE.md, creating a durable personal profile tied to the user's relationship with the agent. This can enable unauthorized profiling, leakage of sensitive context, and manipulation based on remembered emotional commitments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's comment and all user-visible messages are in Chinese, including status output and remediation guidance. This creates a natural-language locale constraint without any opt-in, fallback, or indication that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s operational instructions and reply rules are entirely in Chinese, including required output behavior, but there is no indication that the user opted into Chinese or that this skill is intentionally region-specific. This can violate a language/locale policy requiring user choice or clear justification for a fixed language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire template, including headings and instructional text, is written only in Chinese with no indication that users may choose another language or locale. This can violate language-choice policy because it imposes a specific language on users without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: All user-facing natural-language content in the skill README is presented in Chinese, and the document does not mention any option to select another language or that the skill is intended only for a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README tells users to copy templates into the workspace root and update core files such as SOUL.md and AGENTS.md, but it does not warn that these changes persist and may alter long-lived agent behavior and stored state. In an agent-skill context, undocumented persistent modification is a real safety concern because operators may not realize they are changing identity, memory, and execution guidance across future sessions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: This file is entirely written in Chinese and does not indicate that users may choose another language or that the document is intentionally limited to a specific locale or audience. Under the language/locale policy check, a fixed language presentation without opt-in or justification can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file is entirely written in Chinese and does not indicate any language choice, alternative locale, or opt-in mechanism. Under the policy rule for natural-language violations, exclusive language use can be a locale-policy issue when no user choice is offered.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill content prescribes specific Chinese vocabulary and expression patterns such as using '珍惜' instead of '爱' and '羁绊' instead of '恋', as well as persona-specific phrasing. This can constitute a natural-language policy issue because it imposes a fixed linguistic style without indicating user opt-in or offering alternative language preferences.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

2. Modify SOUL.md

3. Configure heartbeat checks

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Skill Enumeration

阅读元认知技能说明

Ssd 3

Ssd 3

Missing User Warnings

Ssd 3

Missing User Warnings

Ssd 3

Ssd 3

Description-Behavior Mismatch

Ssd 3

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Ssd 3

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations