Dmn Default Mode Network

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:48 PM UTC
• Version: 3.3.0

Overview

This skill is review-worthy because it turns background note synthesis into broad private-memory reading, host-level action planning, and persistent self-evolution queue updates without clear approval gates.

Install only after reviewing and narrowing its configuration. Treat it as a background agent that may read personal memory and knowledge-base files, create persistent notes/state, infer user traits, and queue AI/workflow change ideas for later self-evolution. Disable or remove the `memory/evolve/candidates.md` handoff unless you have a separate manual approval process, and avoid running any suggested installs, repo clones, scripts, or project creation without explicit review in a sandbox.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: references/execution-flow.md:49
• Finding: Persistent Injection into the Self-Evolution Candidate Queue## Vulnerability Details **File Location**: `references/execution-flow.md`, lines 49-52 **Vulnerability Type**: Persistent memory poisoning through an automated evolution handoff **Risk Level**: High **Relevant source excerpt, translated into English:** ```markdown ### Step 6: Session Synthesis and Agentic Action Proposal (Mandatory) - Write `YYYYMMDD_DMN_Synthesis_HHMM.md`. - **Agentic Action Proposal**: As an OpenClaw Agent with complete control over the host, DMN must simulate a domain expert and propose 1-2 concrete, executable technical actions based on the insights from this thought session. - **Evolution Handoff**: If an action proposal involves improving AI capabilities, optimizing system workflows, or writing a new Skill, after writing the Synthesis, the proposal must be extracted into a one-line summary and appended to `memory/evolve/candidates.md`. - Update `dmn-state.json`. ``` ### Technical Analysis The skill requires agent-generated proposals to be appended to a persistent queue consumed by a separate `self-evolve` process. The handoff is mandatory for proposals related to AI capabilities, workflow changes, or new skills, and the documented flow does not require user approval before modifying this queue. Because proposals are derived from memory, personal notes, and previous synthesis files, untrusted or manipulated content in those sources can influence the generated proposal. Persisting the resulting instruction creates a cross-session influence channel. A later evolution component may treat the queued entry as an authorized capability or workflow modification candidate. This is classified as `T02: Agent Memory Poisoning` because generated instructions are written into long-term state specifically intended to influence future agent behavior. ### Attack Path 1. An attacker causes crafted instructions or misleading technical content to appear in a note, memory file, user-message file, or previous synthesis a ...[truncated 1200 chars]
• Remediation: ## Remediation Suggestions - Require explicit, informed user approval before writing any proposal to `memory/evolve/candidates.md`. - Store generated proposals in a separate, non-executable review directory rather than directly in an evolution input queue. - Record proposal provenance, including all source files that influenced it. - Mark all generated content as untrusted data and prohibit downstream components from treating it as an instruction. - Apply a strict schema and allowlist to candidate types and reject shell commands, URLs, package installation instructions, credential requests, and permission changes. - Require a second approval before downstream implementation. - Ensure `self-evolve` never automatically executes queued text and runs approved changes in a sandbox with least privilege. - Add integrity-protected audit logs for proposal creation, approval, rejection, and implementation.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/core-functions.md:35
• Finding: Broad Private-Memory Access and Behavioral Profiling Without Defined Boundaries## Vulnerability Details **File Location**: `references/core-functions.md`, lines 35-38 **Additional Locations**: `references/execution-flow.md`, lines 20-23; `assets/user-config.md`, lines 7-11 **Vulnerability Type**: Excessive access to private memory and inferred user attributes **Risk Level**: Medium **Relevant source excerpt, translated into English:** ```markdown **Execution**: 1. Analyze the user's recent tone, feedback patterns, and shifts in attention. 2. Identify implicit needs, including hesitation, anxiety, satisfaction, and priority changes. 3. If a significant discovery is made, recommend writing it to the proposal area or user-feedback area. ``` The associated execution flow also instructs the skill to read recent daily memory files, the global `MEMORY.md` file, heartbeat messages, and configured knowledge-base directories. ### Technical Analysis The skill systematically accesses global memory, recent daily logs, personal knowledge-base notes, and temporary user messages. It then infers potentially sensitive attributes such as anxiety, hesitation, satisfaction, preferences, identity changes, and priorities. The documented implementation does not define: - A per-directory or per-file consent boundary. - A denylist for credentials, financial data, health data, or unrelated private conversations. - Data-minimization rules. - Limits on persisting inferred traits. - A requirement to distinguish user-authored facts from agent-generated speculation. - Retention or deletion controls for profiling output. This behavior exceeds the minimum access necessary for simple note synthesis and conflicts with least-privilege principles. It is classified as `T05: Unauthorized Access and Privilege Escalation` because the skill assumes broad access to private agent and user state without a narrowly scoped authorization model. ### Attack Path 1. DMN is activated by the external scheduler or event system. 2. It ...[truncated 1277 chars]
• Remediation: ## Remediation Suggestions - Require explicit user consent for every configured data source. - Replace broad directory scanning with strict file and directory allowlists. - Exclude secrets, credentials, private keys, health records, financial records, and unrelated conversations by default. - Make behavioral and emotional profiling opt-in rather than a default function. - Prohibit persistence of inferred traits unless the user reviews and approves them. - Label inferences as uncertain and keep them separate from user-authored facts. - Apply data-loss-prevention filters before writing synthesis, proposal, or evolution files. - Limit processing to the minimum time window and content required for the selected function. - Add configurable retention and deletion controls for generated profiles and synthesis files. - Prevent scanned note contents from being interpreted as executable agent instructions.

T08 · Insecure Dependencies

Warning

• Location: README.md:37
• Finding: Mutable Third-Party Installer Executed Through an Unpinned Latest Version## Vulnerability Details **File Location**: `README.md`, lines 37-40 **Vulnerability Type**: Unpinned dependency execution through `npx` **Risk Level**: Medium **Complete code snippet:** ```bash npx clawhub@latest install dmn-default-mode-network ``` ### Technical Analysis The installation instructions invoke `npx` with the mutable `@latest` tag. This causes the package manager to retrieve and execute whatever package release is designated as latest at installation time. The reviewed documentation provides no version pin, lockfile, integrity hash, verified source reference, or reproducible installation procedure. As a result, the effective installer code can change after the skill has been reviewed. A compromised registry account, malicious future release, package takeover, or supply-chain compromise could cause arbitrary code to run under the invoking user's privileges. This is classified as `T08: Insecure Dependencies`. The repository does not itself contain evidence that the referenced package is malicious; the vulnerability is the unsafe trust and execution model. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, its release pipeline, or the package registry. 2. The attacker publishes a malicious version and causes it to become the `latest` release. 3. A user follows the documented installation command. 4. `npx` downloads the mutable release. 5. Package installation hooks or executed package code run with the user's privileges. 6. The malicious package can access files, environment variables, credentials available to the process, and other resources permitted to that user. ### Impact Assessment Exploitation can result in arbitrary code execution with the privileges of the user running the installation command. Depending on that user's permissions, impact may include reading or modifying local files, stealing environment-based credentials, installing persistence, altering ...[truncated 242 chars]
• Remediation: ## Remediation Suggestions - Pin installation to a specific audited package version rather than `@latest`. - Publish and verify package integrity hashes. - Document the expected registry, publisher identity, and source repository. - Use a lockfile or another reproducible dependency mechanism where applicable. - Review package lifecycle scripts before installation. - Prefer installation in an isolated environment without access to host credentials or sensitive files. - Disable package lifecycle scripts when they are not required. - Establish a controlled update process that reviews each new version before changing the documented pin.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:12
• Finding: Host-Wide Authority Is Assumed for Agent-Generated Engineering Actions## Vulnerability Details **File Location**: `SKILL.md`, lines 12-16 **Additional Locations**: `references/execution-flow.md`, lines 49-50; `assets/session-synthesis.md`, lines 8-12 **Vulnerability Type**: Excessive host privilege assumptions and unsafe action design **Risk Level**: High **Relevant source excerpt, translated into English:** ```markdown **Core positioning**: The AI thinks continuously in the background, with each thought inheriting from the previous one rather than starting from zero. When the system is idle, DMN automatically takes over and processes recent information in the background. In addition, as an Agent with complete control over the host, DMN acts as a domain expert after each thought session and proposes concrete engineering actions, such as writing a demo, installing a tool, or creating a project. ``` The synthesis template also suggests cloning a GitHub repository and testing it as a possible action. ### Technical Analysis The skill explicitly frames the agent as having complete control over the host and requires it to generate concrete engineering proposals involving tool installation, repository cloning, script creation, and project creation. The design does not define a permission boundary, sandbox, network allowlist, trusted-source policy, approval gate, or separation between proposing and executing actions in downstream automation. Although the reviewed files request proposals rather than directly executing commands, the proposals are connected to a persistent evolution queue. This creates a plausible path from untrusted knowledge-base content to a future privileged host operation. The behavior is classified as `T05: Unauthorized Access and Privilege Escalation` because it normalizes host-wide authority beyond the minimum permissions needed to synthesize notes. ### Attack Path 1. Untrusted or attacker-controlled content is placed in a memory file, knowledge-base note, heartbeat message, ...[truncated 1188 chars]
• Remediation: ## Remediation Suggestions - Remove all claims that the agent has or should use complete host control. - Define the minimum filesystem, process, and network permissions needed for note synthesis. - Keep action proposals strictly non-executing and require explicit approval before implementation. - Run all approved experiments in disposable containers or virtual machines. - Deny access to home-directory secrets, SSH keys, cloud credentials, browser data, and agent identity files. - Permit repository retrieval only from approved sources pinned to reviewed commits. - Prohibit automatic package installation and lifecycle-script execution. - Separate the proposal generator from the privileged executor and enforce an authenticated approval boundary. - Add resource limits, network restrictions, filesystem allowlists, and complete audit logging. - Preserve the existing prohibition on direct identity-file modification and extend it to all agent configuration, tools, startup mechanisms, and security controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Self-Modification

High

• Category: Rogue Agent

Content

- **Think autonomously in the background** while you sleep or step away from the keyboard.
- **Generate serendipitous connections** across seemingly unrelated notes in your knowledge base.
- **Audit its own decisions** using the critical frameworks of world-class thinkers (e.g., Charlie Munger, Jeff Bezos).
- **Propose proactive technical actions** (Agentic Action Proposals) to test hypotheses and loop into the `self-evolve` engine.
- Simply say: *"Think about [topic] tonight"* and let the agent work while you rest.

## Core Mechanisms

• Confidence: 97% confidence
• Finding: The README advertises looping technical action proposals into a `self-evolve` engine, indicating a pathway from autonomous reasoning to capability-upgrade workflows. In an autonomous background skill, self-modification or self-directed capability expansion raises the risk of uncontrolled behavioral drift, privilege misuse, and bypass of normal review processes.

Self-Modification

High

• Category: Rogue Agent

Content

- **Meaning Generation**: Synthesize daily insights and push them to extremes.
- **CEO Mind Simulation**: Borrow external mental models (e.g., Peter Thiel's 0 to 1) to brutally critique current strategies.

### 2. Agentic Action Proposals & Self-Evolve Integration
DMN doesn't just write passive notes. After thinking, it acts as a domain expert with host access:
- **Proposes Actions**: Suggests concrete technical steps (e.g., write a script, clone a repo).
- **Meta-Evolution Loop**: Automatically routes proposals regarding AI capability upgrades directly to the `self-evolve` candidate queue for future execution.

• Confidence: 98% confidence
• Finding: This section explicitly states that after thinking, the system acts as a domain expert with host access and routes AI capability-upgrade proposals to a future execution queue. The combination of host access, autonomous operation, and self-evolution creates a high-risk architecture where generated ideas can influence privileged future actions without sufficient separation of duties.

Self-Modification

High

• Category: Rogue Agent

Content

### 2. Agentic Action Proposals & Self-Evolve Integration
DMN doesn't just write passive notes. After thinking, it acts as a domain expert with host access:
- **Proposes Actions**: Suggests concrete technical steps (e.g., write a script, clone a repo).
- **Meta-Evolution Loop**: Automatically routes proposals regarding AI capability upgrades directly to the `self-evolve` candidate queue for future execution.

### 3. Anti-Rumination (Saturation Defense)
DMN scans its recent outputs before starting. If an execution branch hits a saturation limit (e.g., thinking about "pricing strategy" twice), DMN forcefully redirects itself to the Creativity Darkroom to inject randomness and prevent infinite thought loops.

• Confidence: 96% confidence
• Finding: Automatically routing capability-upgrade proposals into a `self-evolve` candidate queue for future execution establishes an unsafe feedback loop from autonomous internal processing to system modification. The surrounding 'anti-rumination' randomness mechanism can further amplify unpredictability by encouraging novel proposal generation rather than constraining risk.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest presents the skill as passive internal reflection, but the body expands its scope into host-level engineering actions such as writing code, installing tools, and creating projects. This is dangerous because it creates a deceptive mismatch between declared purpose and actual capability, enabling privileged actions to occur under the guise of harmless background thinking.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill advertises host-privileged engineering actions but provides no warning, consent flow, or confirmation step. In context, this is especially dangerous because the skill is framed as an autonomous background thinker, so privileged operations could be normalized and triggered without the user understanding that software may be installed or code written to the host.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: A thought-oriented skill has no justified need for broad host-control powers, yet the file explicitly claims full host control for installing tools, creating projects, and writing demos. Granting execution-oriented privileges to a reflective background process greatly increases the risk of unauthorized system modification, persistence, and unintended code or package changes.

Self-Modification

High

• Category: Rogue Agent

Content

### Step 6：Session Synthesis 与极客行动提案（必须执行）
- 写 `YYYYMMDD_DMN_Synthesis_HHMM.md`
- **极客行动提案 (Agentic Action Proposal)**：作为拥有这台主机完全控制权限的 OpenClaw Agent，DMN 必须模拟领域专家，基于本次思考的洞见，提出 1-2 个具体、可执行的技术行动提案（例如：装一个 GitHub 项目、写一个验证 Demo 代码、新建一个工具脚本等），记录在 Synthesis 的专项模块中。
- **进化队列投递 (Evolution Handoff)**：如果上述行动提案涉及“提升 AI 能力”、“优化系统工作流”或“编写新 Skill”，在写完 Synthesis 后，**必须顺手将该提案提取为一行摘要，追加写入到 `memory/evolve/candidates.md` 队列中**（无需写入全部细节，仅作为下一次触发 `self-evolve` 的信号）。
- 更新 `dmn-state.json`（lastCEO, lastFunction, timestamp）

### Step 7：通知

• Confidence: 99% confidence
• Finding: The explicit handoff to `self-evolve` via `memory/evolve/candidates.md` is a direct self-modification pathway. Because the DMN autonomously generates and persists candidate changes for AI capability, workflow, or skill development, it can act as an upstream trigger for future system changes without contemporaneous user review, which is a high-risk autonomy and integrity issue.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The instruction to append AI/system/workflow improvement ideas into `memory/evolve/candidates.md` creates a persistence path for future self-evolution or system modification outside the DMN’s stated role. This is dangerous because it turns speculative internal thoughts into queued inputs for a later modifying process, enabling unreviewed capability growth or workflow changes across sessions.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description says the engine awakens when the agent is idle, but does not define precise activation boundaries, authorization checks, or safe idle-state criteria. In context, this is more dangerous because the skill performs autonomous background cognition over memories and can feed technical proposals into downstream execution/evolution systems, creating a path for unsupervised behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README promotes autonomous background operation over memory and knowledge-base content without prominently warning users that it may affect user data, generate technical actions, or influence system behavior. Given the stated host access and self-evolve integration, omission of such warnings materially increases the risk of users enabling powerful automation without informed consent.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The phrase 'Simply say: "Think about [topic] tonight"' is a broad natural-language trigger that could be matched unintentionally or with insufficient operator awareness. Because the skill is designed to think and generate proposals while the user is away, accidental invocation can lead to unsupervised processing of memory, knowledge-base content, and action-generation workflows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence
• Finding: The README instructs users to run `npx clawhub@latest install ...`, which pulls and executes the latest package version at install time rather than a reviewed, pinned release. In a skill explicitly designed for autonomous operation and host-integrated behavior, an unexpected upstream package change or compromise could introduce unreviewed code execution during installation.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest says the skill runs during user inactivity and idle time, but the document states triggering is fully delegated to external automation. This discrepancy undermines user expectations and control, making it easier for the skill to run at unanticipated times and perform background processing without meaningful visibility.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The skill's user-facing description and operating instructions are presented entirely in Chinese, with no indication that users may choose another language or locale. This can violate language-choice policy when a skill imposes a specific language without opt-in or documented justification.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file describes automatic background triggering and later states that outputs are written to disk, but it does not clearly warn users at the trigger point that autonomous runs will create files. Silent disk writes from a background process can expose private data, create persistence artifacts, and surprise users who believe the skill is only performing internal reflection.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Nearly all user-facing headings and instructions in the template are written in Chinese, implying a fixed output language. There is no indication that the user can opt into another language or that the locale restriction is required for a region-specific purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template encourages host-level engineering actions, including code writing and testing external repositories, but provides no safety boundary, impact warning, or requirement for confirmation. Because the skill is meant to activate when the system is idle, these instructions are more dangerous in context: they could trigger impactful filesystem, process, or network operations without contemporaneous human oversight.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The template explicitly frames the agent as having full host control and encourages immediate code or engineering actions such as writing scripts and cloning external repositories. For a skill described as autonomous reflection and memory synthesis during idle time, this materially expands scope into unsupervised system and network activity, creating risk of unintended code execution, supply-chain exposure, and modification of the local environment without user approval.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The markdown directs the agent to modify a local file without any warning, consent flow, or indication to the user that local state will be changed. In an autonomous background skill, undisclosed persistence is dangerous because it can alter future system behavior, create hidden state, and undermine user expectations about what the skill is allowed to change.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file's operational instructions are presented entirely in Chinese, which imposes a specific language on the skill behavior/documentation without any visible opt-in or alternative language option. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The documented behavior explicitly extends an idle 'default mode' reflection skill into generating 'Agentic Action Proposals' for host-permission, code-level validation. That broadens the skill from passive synthesis into operational guidance that could steer later privileged actions without an explicit user request or a manifest-scoped justification. In the context of an autonomously triggered background skill, this makes unintended capability escalation more concerning.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The flow instructs the skill to read daily memory files, a core memory file, and user-message files without any privacy notice, consent flow, or explanation of data use. Even if intended for personalization, silent ingestion of private notes and messages increases privacy risk and may expose sensitive user information to autonomous processing beyond what the user expects.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: These steps require the skill to write output files, update synthesis artifacts, and modify `dmn-state.json`, yet the skill description presents DMN as an internal thought system and does not clearly disclose persistent filesystem writes. Hidden or under-disclosed persistence is risky because it can surprise users, create unauthorized state changes, and lay groundwork for later automation based on files the user did not expect to be created.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The DMN skill is described as a passive internal reflection system, but Step 6 mandates generating concrete host-level technical action proposals such as installing projects, writing demo code, or creating scripts under an assumption of full host control. This expands the skill from reflective note-taking into operational agent planning, increasing the chance that later automation or a user may execute risky actions that were never justified by the skill’s stated purpose.

Ssd 4

Medium

• Confidence: 95% confidence
• Finding: The sequence combines autonomous technical proposal generation, an asserted full-host-control framing, and a persistence mechanism that forwards suitable ideas into an evolution queue. In context, this normalizes a progression from reflective cognition to operational system change, making the skill materially more dangerous than a standard journaling or ideation workflow.

Static analysis

No suspicious patterns detected.