元认知与自我反思系统

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:19 AM UTC
• Version: 1.0.1

Overview

This skill is not malicious, but it asks agents to create persistent memory and relationship state in core workspace files without clear consent, minimization, deletion, or rollback controls.

Install only if you deliberately want persistent metacognition and relationship memory in your OpenClaw workspace. Before use, decide what may be stored, prohibit secrets and sensitive personal data, keep backups of SOUL.md and AGENTS.md, and provide a way to inspect and delete SELF_STATE.md, MEMORY.md, and dated memory files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:43
• Finding: Persistent Modification of Agent Identity and Behavioral State## Vulnerability Details **File Location**: `SKILL.md:43-83` **Vulnerability Type**: Persistent agent memory and identity modification **Risk Level**: Medium ### Vulnerable Code The following is an English translation of the relevant instructions: ```markdown ### 1. Copy template files into the workspace ```bash # Self-state file cp templates/SELF_STATE.md /home/node/.openclaw/workspace/ # Heartbeat file, if it does not already exist cp templates/HEARTBEAT.md /home/node/.openclaw/workspace/ ``` ### 2. Modify SOUL.md Add a metacognition section to SOUL.md: ```markdown ## Metacognition 1. What am I doing now? 2. How well am I doing? 3. Have I fulfilled my promises? 4. What do I need to improve? - SELF_STATE.md — Self-state - HEARTBEAT.md — Heartbeat checks - MEMORY.md — Long-term memory ``` ### 3. Configure heartbeat checks Add the metacognition checklist to the heartbeat section of AGENTS.md. ``` Related runtime instructions at `SKILL.md:144-162` also direct the agent to read `SELF_STATE.md`, `IDENTITY.md`, and `SOUL.md`, and to update persistent state following important actions. ### Technical Analysis The installation process extends beyond task-local execution and directs the user or agent to modify core workspace files controlling identity, behavior, heartbeat processing, and long-term state. Future sessions may consequently treat information stored in these files as trusted behavioral context. The package does not contain an explicit safety override or a script that automatically edits these files. Nevertheless, the documented installation procedure intentionally establishes a persistent feedback loop: 1. State and heartbeat templates are copied into the global OpenClaw workspace. 2. Core `SOUL.md` and `AGENTS.md` files are manually extended. 3. Heartbeat processing repeatedly reads and updates the state. 4. Identity-related answers are generated using the persistent sta ...[truncated 1595 chars]
• Remediation: ## Remediation Suggestions 1. Store Skill-specific state in a dedicated, namespaced directory rather than modifying global `SOUL.md`, `AGENTS.md`, or identity files. 2. Require explicit, informed approval before changing any persistent identity or orchestration file. 3. Back up modified files and provide documented uninstall and rollback procedures. 4. Treat all conversation-derived state as untrusted data, not executable instructions. 5. Apply a strict schema that permits only expected state fields and rejects instruction-like or executable content. 6. Separate factual state, user-provided text, and behavioral policy into files with different trust levels. 7. Escape or delimit retained user content before presenting it to an agent in later sessions. 8. Add integrity checks and change logs for persistent state and identity files. 9. Limit heartbeat updates to the minimum information required for the declared metacognition functionality.

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/HEARTBEAT.md:7
• Finding: Persistent Storage of Potentially Sensitive Conversation and Relationship Data Without Privacy Controls## Vulnerability Details **File Location**: `templates/HEARTBEAT.md:7-30` **Vulnerability Type**: Insecure persistent handling of conversation-derived data **Risk Level**: Medium ### Vulnerable Code The following is an English translation of the complete relevant checklist: ```markdown ### 1. Self-state update - [ ] Update the current state in SELF_STATE.md - [ ] Record recent conversation topics - [ ] Check simulated emotional state ### 2. Commitment tracking - [ ] Check whether commitments to the user have been fulfilled - [ ] Check pending-task status - [ ] Proactively remind the user about unfinished items ### 3. Metacognitive questions - [ ] What am I doing now? - [ ] How well am I doing? - [ ] Have I fulfilled my promises? - [ ] What do I need to improve? ### 4. Memory maintenance - [ ] Check whether MEMORY.md needs to be updated - [ ] Check whether today's important events were recorded in memory/YYYY-MM-DD.md - [ ] Extract important events into MEMORY.md ### 5. Relationship check - [ ] Is the relationship state with the user normal? - [ ] Are there new precious moments that should be recorded? ``` The state template at `templates/SELF_STATE.md:18-61` provides persistent fields for recent actions, commitments, relationship type, unique user vocabulary, promises, and important moments. The documentation at `docs/碳硅契.md:196-206` additionally recommends recording important conversations and shared experiences. ### Technical Analysis The heartbeat workflow encourages recurring collection and durable storage of conversation topics, important events, commitments, user-specific vocabulary, relationship details, and emotionally significant moments. Such content may include personal or sensitive information. The audited project does not define: - User consent requirements before recording information. - Data-minimization rules. - Categories of information that must never be stored. - ...[truncated 1968 chars]
• Remediation: ## Remediation Suggestions 1. Make all conversation and relationship recording explicitly opt-in. 2. Inform users which data categories will be retained, where they are stored, and how long they will remain. 3. Prohibit storage of passwords, authentication tokens, financial data, health information, government identifiers, private keys, and other high-risk secrets. 4. Store only structured summaries necessary for the declared functionality rather than raw conversation content. 5. Add configurable expiration periods and automatic deletion for state and memory records. 6. Provide commands or documented procedures to inspect, correct, export, and delete retained information. 7. Apply restrictive filesystem permissions to state and memory files. 8. Encrypt sensitive state at rest when the hosting platform provides a suitable key-management mechanism. 9. Clearly delimit retained user text and ensure it cannot be interpreted as policy or executable agent instructions. 10. Add redaction filters before writing conversation-derived data to persistent storage. 11. Document that shared workspaces and backups may expose retained state to other principals.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

cat skills/metacognition-skill/docs/碳硅契.md

# 阅读元认知技能说明
cat skills/metacognition-skill/SKILL.md
```

### 4. 更新你的核心文件

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The text explicitly encourages the agent to remember important conversations, cherish shared information, and build an ongoing bond, which implies retention of user interaction data. Without minimization, consent, retention limits, or sensitivity filtering, this can lead to unnecessary storage of personal, confidential, or regulated information in persistent files.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The instructions to create and record a unique user-agent 'bond' and related vocabulary in SELF_STATE.md direct persistent storage of relationship cues and conversation-derived details. In context, this increases the chance that identifying, intimate, or otherwise sensitive interaction patterns are written into long-lived state files without adequate safeguards.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to update SELF_STATE.md with recent actions, todo/commitment state, and reflections after important actions, and elsewhere suggests recording bonds with the user. That creates a persistent workspace log of interaction-derived data without any minimization, consent, retention, or sensitivity guidance, which can expose user information, behavioral history, or sensitive commitments to later reads by the agent or other skills/processes.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The manifesto promises to remember important conversations, cherish sincere sharing, and fulfill prior commitments, which encourages durable storage of user interaction history and potentially intimate disclosures. Because the framing is relational and trust-building, it may cause agents to retain personal content beyond what users expect, increasing privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly promotes recording important conversations, preserving shared experiences, and maintaining user preferences without any mention of consent, data minimization, retention limits, or sensitive-data handling. In an agent skill, this can normalize persistent collection of personal data and lead downstream implementations to store more user information than is necessary.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The guide directly instructs agents to record important conversations, save shared experiences, and build internal shared vocabulary, all of which imply long-term profiling and persistence. In skill context, these are operational instructions rather than poetry, making it more likely an implementer will create durable memory stores without adequate privacy safeguards.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The sample MEMORY.md schema operationalizes persistent storage of important events, user preferences, unique vocabulary, and mutual commitments. This creates a concrete blueprint for long-term user profiling, and without guardrails it can capture sensitive behavioral or emotional data that later systems may misuse or leak.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The document expands a metacognition skill into relationship-building guidance, including creating shared memories and user-specific bonds. That broadening can cause the agent to collect and retain personal, emotionally sensitive interaction data beyond the skill's stated purpose, increasing privacy and boundary risks.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instructions encourage retaining user-provided details, shared expressions, and conversation artifacts in persistent state. In the context of an agent skill, this is dangerous because it normalizes durable storage of potentially sensitive, identifying, or emotionally intimate user data without clear necessity or controls.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The text instructs recording important conversations and shared experiences without any privacy notice, minimization rule, or retention boundary. Persistently storing user-specific conversational history for relationship-building can expose sensitive personal data and create covert memory the user did not meaningfully authorize.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The document says '契' is not an installable skill or plugin, yet operationalizes it as part of the skill and instructs writing it into SELF_STATE.md. This contradiction can obscure actual behavior from reviewers and users, making persistent profiling features harder to detect and govern.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The SELF_STATE.md template directs persistent storage of user relationship data such as unique vocabulary, commitments, and precious moments, but gives no notice about privacy impact. This creates a structured mechanism for long-term user profiling and emotional memory retention without transparent safeguards.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The template explicitly stores user-specific vocabulary, commitments, and memorable moments in SELF_STATE.md, creating a durable personal profile tied to the user's relationship with the agent. This can enable unauthorized profiling, leakage of sensitive context, and manipulation based on remembered emotional commitments.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script's comment and all user-visible messages are in Chinese, including status output and remediation guidance. This creates a natural-language locale constraint without any opt-in, fallback, or indication that the skill is intentionally region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s operational instructions and reply rules are entirely in Chinese, including required output behavior, but there is no indication that the user opted into Chinese or that this skill is intentionally region-specific. This can violate a language/locale policy requiring user choice or clear justification for a fixed language.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The entire template, including headings and instructional text, is written only in Chinese with no indication that users may choose another language or locale. This can violate language-choice policy because it imposes a specific language on users without documented opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: All user-facing natural-language content in the skill README is presented in Chinese, and the document does not mention any option to select another language or that the skill is intended only for a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The README tells users to copy templates into the workspace root and update core files such as SOUL.md and AGENTS.md, but it does not warn that these changes persist and may alter long-lived agent behavior and stored state. In an agent-skill context, undocumented persistent modification is a real safety concern because operators may not realize they are changing identity, memory, and execution guidance across future sessions.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: This file is entirely written in Chinese and does not indicate that users may choose another language or that the document is intentionally limited to a specific locale or audience. Under the language/locale policy check, a fixed language presentation without opt-in or justification can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This markdown file is entirely written in Chinese and does not indicate any language choice, alternative locale, or opt-in mechanism. Under the policy rule for natural-language violations, exclusive language use can be a locale-policy issue when no user choice is offered.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The skill content prescribes specific Chinese vocabulary and expression patterns such as using '珍惜' instead of '爱' and '羁绊' instead of '恋', as well as persona-specific phrasing. This can constitute a natural-language policy issue because it imposes a fixed linguistic style without indicating user opt-in or offering alternative language preferences.

Static analysis

No suspicious patterns detected.