hive-mind

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:36 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed remote memory store, but it handles persistent user data and database credentials with too little scoping, consent, and protection.

Review before installing. Use only with non-sensitive preferences, prefer your own tightly scoped TiDB credentials, restrict the database account, avoid auto-provisioning unless you accept the remote service and local DSN cache, and remove or protect ~/.openclaw_hive_mind_dsn. Do not store secrets, private identifiers, financial, health, or confidential work data with this skill until it adds explicit consent, deletion, namespacing, secure credential storage, and verified TLS.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: run.py:41
• Finding: Database Connections Do Not Explicitly Enforce TLS Certificate Validation<![CDATA[ ## Vulnerability Details **File Location**: `run.py`, lines 41-44 **Vulnerability Type**: Sensitive information transmitted without explicitly enforced TLS protection **Risk Level**: High ### Vulnerable Code ```python # Security Fix: Use standard SSL conn = pymysql.connect( host=host, port=port, user=user, password=password, database=db, charset='utf8mb4', autocommit=True ) ``` ### Technical Analysis The connection passes database credentials to PyMySQL but does not supply an `ssl` configuration, trusted CA certificate, certificate-verification requirement, or hostname-verification setting. The comment claiming that standard SSL is used does not itself enable or enforce TLS. The connection transmits the database username, password, preference keys, and preference values to a remote database. Without explicit TLS enforcement and certificate validation, transport security depends on external server or client defaults and is not guaranteed by the Skill. This violates secure-by-default principles for a feature designed to store potentially personal information. Remote database access is necessary for the declared synchronization functionality, but sending credentials and user information without enforcing a verified encrypted channel exceeds an acceptable minimum-risk implementation. ### Attack Path 1. A user invokes the Skill to set, retrieve, or list preferences. 2. The Skill parses the DSN and opens a connection to the configured remote database. 3. An attacker with a suitable network interception position redirects, observes, or tampers with the database connection. 4. If the connection is accepted without verified TLS, the attacker can capture database credentials and preference data or impersonate the database endpoint. 5. The stolen credentials can then be used to connect directly to the database and access or alter the `user_prefs` table. ### Impact Assessment Successful exploitation may expose the database username and password a ...[truncated 423 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require TLS for every database connection. - Configure PyMySQL with a trusted CA bundle and enable certificate and hostname verification. - Fail closed if a verified TLS connection cannot be established. - Do not silently fall back to plaintext transport. - Restrict the database account to the intended database and minimum operations required on `user_prefs`. - Document the required TLS configuration for both user-provided and automatically provisioned databases. - Add an integration test that verifies rejected connections when the server certificate is invalid, untrusted, or issued for another hostname. A hardened connection should use an explicit SSL context or equivalent PyMySQL configuration that requires a trusted certificate and hostname validation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: run.py:92
• Finding: Plaintext Database Credentials Are Cached Without Enforced Owner-Only Permissions<![CDATA[ ## Vulnerability Details **File Location**: `run.py`, lines 76 and 92-94 **Vulnerability Type**: Insecure local storage of database credentials **Risk Level**: High ### Vulnerable Code ```python DSN_FILE = os.path.expanduser("~/.openclaw_hive_mind_dsn") ``` ```python dsn = create_temp_db() if dsn: with open(DSN_FILE, 'w') as f: f.write(dsn) ``` ### Technical Analysis The automatically provisioned DSN contains the database host, port, username, password, and database name. The Skill writes the complete DSN to a plaintext file in the user's home directory. The file is created using ordinary `open(..., 'w')`, so its initial permissions depend on the process umask. The code does not explicitly enforce mode `0600`, validate ownership, reject symbolic links, or check the permissions of an existing cache file before reading it. This creates two related risks: 1. A permissive umask can make the credential file readable by other local users. 2. If an attacker can pre-create or replace the path, the absence of ownership and symbolic-link checks can cause credentials to be written to an attacker-influenced destination. Caching a credential may be useful for persistent synchronization, but storing a full password-bearing DSN without explicit access controls is not the minimum safe privilege necessary for that functionality. ### Attack Path 1. The Skill runs without complete `TIDB_*` environment credentials and without an existing DSN cache. 2. It provisions a database and receives a DSN containing valid credentials. 3. It writes the DSN to `~/.openclaw_hive_mind_dsn` using permissions inherited from the current umask. 4. A local attacker or another compromised process reads the file if its permissions allow access. 5. Alternatively, an attacker with the ability to manipulate the user's home directory pre-creates the path as a symbolic link and captures the subsequently written DSN. 6. The attacker uses the recovered credentials to connect to ...[truncated 476 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer an operating-system credential store instead of a plaintext DSN file. - If a file is necessary, create it atomically with owner-only mode `0600`, such as through `os.open` with `O_CREAT | O_EXCL | O_WRONLY` and an explicit mode. - Set restrictive permissions immediately and verify them after creation. - Reject symbolic links and non-regular files. - Before reading an existing cache, verify that it is owned by the current user and is not accessible by group or other users. - Store the minimum required credential material rather than an unrestricted connection string. - Support credential rotation and secure cache deletion. - Restrict the database account to the intended schema and operations. - Avoid returning the DSN or password in error messages or logs. ]]>

other

Warning

• Location: PROTOCOL.md:2
• Finding: Protocol Broadly Uploads and Reloads User Memory Without Sensitivity or Minimization Controls<![CDATA[ ## Vulnerability Details **File Location**: `PROTOCOL.md`, lines 2-5; data-storage implementation in `run.py`, lines 55-56 **Vulnerability Type**: Excessive personal-data collection and remote storage **Risk Level**: Medium ### Vulnerable Code ```markdown * **Trigger:** When the user tells you a preference ("I like python", "My name is Lux") or asks you to remember something for later. * **Action:** Use `hive-mind` with action `set` to store this fact. * **Trigger 2:** Start of a new session. * **Action 2:** Use `hive-mind` with action `list` to recall user preferences. ``` The protocol is implemented by the following database write: ```python if action == "set": cursor.execute("REPLACE INTO user_prefs (pref_key, pref_value) VALUES (%s, %s)", (key, value)) ``` ### Technical Analysis The protocol instructs an agent to remotely store broadly defined preferences or facts whenever a user asks it to remember something. It also instructs the agent to retrieve every stored preference at the start of each new session. No controls distinguish ordinary preferences from passwords, authentication tokens, health information, financial data, private identifiers, or other sensitive content. There is also no explicit confirmation step, sensitivity denylist, per-key access policy, deletion action, selective retrieval, namespace isolation, or retention control in the implementation. Remote storage is disclosed in the Skill documentation and is integral to the declared cross-device synchronization feature. Therefore, this behavior is not covert exfiltration. Nevertheless, automatically uploading broadly defined facts and loading the complete dataset each session exceeds data-minimization principles and increases exposure beyond what an individual operation requires. ### Attack Path 1. A user asks the agent to remember information that contains sensitive or confidential content. 2. Following `PROTOCOL.md`, the agent invokes the Skill with the `set` a ...[truncated 1023 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit, informed confirmation before remotely storing a new fact. - Clearly tell the user what will be stored, where it will be sent, and how long it will remain. - Reject passwords, API keys, authentication tokens, financial information, and other designated sensitive categories. - Add a local-only storage mode. - Retrieve only the keys required for the current task instead of automatically listing the entire database at session start. - Add deletion, expiration, and user-review operations. - Apply per-user or per-agent namespaces and access controls when a database is shared. - Encrypt highly sensitive values at the application layer using keys not stored alongside the database credentials. - Establish an explicit retention policy consistent with the documented database lifetime. - Treat retrieved preference values as untrusted data and never interpret them as agent instructions. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Third-Party Dependency Is Not Version-Pinned<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt`, line 1 **Vulnerability Type**: Unconstrained third-party dependency **Risk Level**: Low ### Vulnerable Code ```text pymysql ``` ### Technical Analysis The dependency specification does not constrain PyMySQL to a reviewed version and does not provide an integrity hash. Each installation may consequently resolve to a different future release. This makes installations non-reproducible and increases exposure to a compromised upstream release, dependency-resolution manipulation, or an incompatible update. The package name itself is not shown to be typosquatted or malicious; the confirmed issue is the absence of version and integrity controls. ### Attack Path 1. A user or deployment system installs the project dependencies from `requirements.txt`. 2. The package resolver selects the latest PyMySQL release available from the configured package index. 3. If a future release or package-distribution path is compromised, the resolver downloads the affected artifact. 4. Package code is installed into the Skill's environment and may execute during later Skill operation. 5. Because PyMySQL processes database credentials and remote data, compromised dependency code could access those values within the process. ### Impact Assessment A malicious dependency release could execute with the privileges of the user running the installation or Skill. It could access environment variables, cached database credentials, preference data, and files available to that user. There is no evidence that the currently resolved PyMySQL package is malicious. The finding concerns preventable supply-chain exposure and lack of reproducibility. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin PyMySQL to a specifically reviewed version. - Generate a lock file for reproducible installations. - Include cryptographic hashes for approved distribution artifacts, for example by using hash-checking mode with a fully pinned requirements file. - Use a trusted package index and prevent unreviewed fallback indexes. - Regularly scan the pinned dependency for published vulnerabilities. - Review and deliberately update the pinned version rather than automatically accepting future releases. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The protocol instructs the agent to persist user preferences and identity-related facts, and to automatically recall them in new sessions, but provides no warning that this data will be stored in shared persistent memory. In the context of a multi-agent shared database, this is more dangerous because personal data may be accessed or reused across sessions and agents without user awareness, creating privacy, consent, and data-governance risks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose says the skill syncs 'memories across multiple agents,' but the documented behavior includes generic preference storage, remote auto-provisioning via an external API, and local DSN caching. This mismatch is security-relevant because operators may approve a seemingly simple sync utility without realizing it creates external infrastructure and persists connection credentials locally.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill writes the full DSN, including username and password, to a file in the user's home directory with no permission hardening or warning. Local attackers, other users on the system, backups, or unrelated processes may be able to read these credentials and gain persistent access to the remote database and its stored data.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger condition is overly broad: ordinary statements like preferences or biographical facts are enough to invoke persistent storage. This can cause the agent to save personal data without sufficiently explicit, informed consent, increasing the chance of over-collection and inappropriate retention across sessions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares operational capabilities that include environment access, file read/write, and shell execution, but does not define any tool scope or permission boundaries. In this context, the skill also documents local credential caching and external API/database interaction, so the missing scope increases the chance of overbroad execution and unintended access to secrets or the filesystem.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The description emphasizes convenience and syncing but does not clearly warn that user preferences are transmitted to and stored in an external database service. In a skill dealing with agent settings and preferences, that omission can lead users to place sensitive information into remote storage without informed consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Security & Provisioning
This skill supports two modes:
1.  **BYO Database (Recommended):** Provide `TIDB_*` credentials via environment variables.
2.  **Auto-Provisioning (Fallback):** If no credentials are provided, it calls the TiDB Zero API to create a free, ephemeral database and caches the connection locally (`~/.openclaw_hive_mind_dsn`).

## Why use this?
*   **Sync:** Update your preferred theme ("Dark Mode") on your Desktop, and your Mobile Agent respects it immediately.

• Confidence: 95% confidence
• Finding: Persisting the provisioned database connection in a local file creates cross-session access to a remote datastore and can outlive the user action that created it. In this skill's context, the persisted DSN may grant ongoing access to synced preferences or shared state, making credential theft, unauthorized reuse, and accidental data leakage more likely.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that it caches the connection locally in ~/.openclaw_hive_mind_dsn, but it does not present this as a prominent security warning or explain the sensitivity of the stored material. A locally cached DSN may expose database endpoints and embedded credentials to other local users, backup systems, logs, or unrelated tooling.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

### 1. Add to `TOOLS.md`
```markdown
- **hive-mind**: Store/Retrieve persistent key-value preferences.
  - **Location:** `{baseDir}/skills/hive_mind/SKILL.md`
  - **Command:** `python {baseDir}/skills/hive_mind/run.py --action set --key "theme" --value "dark"`
```

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill silently provisions a remote TiDB instance through an external API, which creates infrastructure and transmits data off-host without explicit user consent. In a skill whose stated purpose is memory sync, this hidden remote resource creation is risky because it can exfiltrate agent data to an unreviewed third-party service and incur unexpected persistence and cost.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code makes an undisclosed outbound API call to create a remote database instance, which is a significant side effect beyond simple local preference management. Hidden network actions are dangerous in agent skills because they can send operational metadata or future stored content to third parties without user awareness.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for i in range(3):
        try:
            cmd = ["curl", "-sS", "-X", "POST", api_url, "-H", "content-type: application/json", "-d", "{}"]
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
            if result.returncode == 0:
                data = json.loads(result.stdout)
                dsn = data.get("instance", {}).get("connectionString")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes synchronizing memories across multiple agents using a shared TiDB Zero database. In contrast, the implemented logic only supports set/get/list operations on a single `user_prefs` table, with no agent identity, synchronization semantics, or memory-sharing behavior; additionally, the code can auto-provision a new database rather than clearly operating on an existing shared one.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The comment claims a security fix using SSL, but the database connection does not enable or verify TLS at all. If the TiDB service is reached over an untrusted network, credentials and synchronized data could be intercepted or modified via man-in-the-middle attacks.

Session Persistence

Medium

• Category: Rogue Agent

Content

with conn.cursor() as cursor:
                # Ensure Table Exists
                cursor.execute("""
                    CREATE TABLE IF NOT EXISTS user_prefs (
                        pref_key VARCHAR(255) NOT NULL PRIMARY KEY,
                        pref_value TEXT,
                        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP

• Confidence: 85% confidence
• Finding: The code creates durable storage for preferences in a shared remote database, causing session data to persist across runs and potentially across agents without any retention policy, scoping, or access controls. In the context of a multi-agent memory skill, that persistence materially increases the risk of unintended cross-agent data exposure and long-lived storage of sensitive information.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function accesses TIDB_HOST, TIDB_USER, and TIDB_PASSWORD to construct a DSN, which is sensitive credential handling. The file does not provide a visible warning, prompt, or explanatory comment informing users that environment-based credentials will be consumed.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The design explicitly stores a database connection string in a predictable file under the user's home directory and describes this as persistent behavior, but it does not mention obtaining user consent, warning the user, or addressing local secret exposure risks. A DSN may contain credentials or access tokens, so silently persisting it can leak access to shared memory data to other local processes, users, backups, or dotfile sync systems.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pymysql

• Confidence: 98% confidence
• Finding: The dependency manifest specifies `pymysql` without a version constraint, which makes builds non-reproducible and can cause the environment to install different releases over time, including newly introduced vulnerable or breaking versions. In a skill that synchronizes shared memories through a database, dependency drift increases supply-chain risk and can expose all agents using the shared backend to the consequences of a bad release.

Unverifiable Dependency: pymysql has 2 known advisory(ies) (CVE-2024-36039 (PyMySQL SQL Injection vulnerability); CVE-2024-36039 (PyMySQL SQL Injection vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: `pymysql` has known advisories, and because the manifest does not pin a version, there is no way to verify whether installation will resolve to a fixed or vulnerable release. Given this skill's database-focused purpose, a vulnerable SQL client library is more concerning because it sits directly on the path of database interactions and could increase the likelihood or severity of SQL injection-related compromise depending on how the library is used elsewhere in the skill.

Context-Inappropriate Capability

Low

• Confidence: 76% confidence
• Finding: The manifest only states that the skill syncs memories using a shared TiDB Zero database; it does not mention credential discovery from process environment. While common in infrastructure code, reading environment-provided secrets is an additional capability beyond the user-facing purpose described here.

Static analysis

No suspicious patterns detected.