ClawHub
Back to skill

Security audit

Immortal_Brain

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it creates an autonomous background task and memory system that can proceed after silence, persist user/profile data, and optionally send workspace-derived content to Telegram.

Install only if you intentionally want a persistent autonomous memory/task manager. Before enabling it, disable or narrow auto-approval, avoid the Windows Task Scheduler option unless you also add explicit removal steps, keep Telegram off for sensitive work or use status-only notifications, and review/purge the core memory, profile, and backup files regularly.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
INSTALL.md:216
Finding

Persistent Background Execution Through Windows Task Scheduler

Content
View full analysis

Vulnerability Details

File Location: INSTALL.md:216-221
Vulnerability Type: Cross-session scheduled-task persistence
Risk Level: High

Vulnerable Code

bat
**Opțiunea A: Task Scheduler (Windows)**

# Creează un task care rulează la fiecare 2 minute
schtasks /create /tn "ImmortalBrainHeartbeat" /tr "python D:\OpenClaw_Setup\skills\immortal-brain\scripts\brain_service.py heartbeat" /sc minute /mo 2

Technical Analysis

The installation guide instructs users to register a Windows scheduled task that invokes the Skill every two minutes. The task survives terminal closure, logout, and subsequent sessions, giving the Skill persistent background execution under the account used to register it.

Continuous operation is related to the declared heartbeat functionality, and the mechanism is presented as optional. However, operating-system-level persistence is not the minimum privilege necessary because OpenClaw's existing heartbeat mechanism is also documented as the recommended option. The scheduled task increases the execution scope beyond an individual Skill invocation.

The uninstallation procedure removes the Skill and workspace files but does not delete the scheduled task. Consequently, nominal uninstallation may leave a persistent scheduler entry that repeatedly attempts to execute the removed or subsequently replaced script path.

The command also invokes python through PATH rather than using an absolute, trusted interpreter path. A changed PATH resolution context could cause an unintended executable to run. The scheduled action uses an absolute script location, but the guide does not validate ownership or permissions on that path.

Attack Path

  1. A user follows the optional Task Scheduler installation instructions.
  2. Windows creates ImmortalBrainHeartbeat under the registering user's scheduler context.
  3. The task invokes brain_service.py heartbeat every two minutes across sessions.
  4. Each invocation reads and modifies ...[truncated 1239 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove scheduled-task creation from the default installation flow and retain OpenClaw's native heartbeat mechanism as the default.
  2. Require explicit, informed opt-in before creating operating-system-level persistence. Clearly state:
    • How often the task runs.
    • Which account it runs as.
    • Which files it accesses.
    • How to disable and remove it.
  3. Add the following cleanup command to the uninstallation procedure:
bat
schtasks /delete /tn "ImmortalBrainHeartbeat" /f
  1. Use a fully qualified, trusted Python executable instead of resolving python through PATH:
bat
schtasks /create /tn "ImmortalBrainHeartbeat" ^
  /tr "\"C:\Path\To\Trusted\python.exe\" \"D:\OpenClaw_Setup\skills\immortal-brain\scripts\brain_service.py\" heartbeat" ^
  /sc minute /mo 2
  1. Run the task using a dedicated least-privileged account where feasible. Do not request administrator or SYSTEM privileges.
  2. Validate that the script and its parent directories are writable only by trusted users.
  3. Provide a separate status command that reports whether the scheduled task exists.
  4. Use a less aggressive interval unless two-minute execution is operationally required, and implement locking to prevent overlapping runs.
  5. Ensure uninstallation removes all persistence before deleting the script so the scheduler cannot target a stale or repurposed path.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/brain_agent.py:329
Finding

Unredacted Workspace Content Can Be Sent to Telegram

Content
View full analysis

Vulnerability Details

File Location: scripts/brain_agent.py:329-338, scripts/brain_agent.py:446-462
Vulnerability Type: Uncontrolled external transmission of task-derived content
Risk Level: Medium

Vulnerable Code

Task-derived snippets are assembled into an outbound notification:

python
suggestions = self._suggest_connections()

# 3. Trimite notificări dacă găsim ceva interesant
if suggestions:
    message = "🔗 Conexiuni descoperite:\n\n"
    for s in suggestions[:3]:
        message += f"• {s}\n"
    self.brain.notify(message)

The connection suggestions include portions of stored neuron content:

python
common_tags = set(n1.tags) & set(n2.tags)
if common_tags and n1.id not in n2.links and n2.id not in n1.links:
    tag = list(common_tags)[0]
    suggestions.append(
        f"'{n1.content[:30]}...' și '{n2.content[:30]}...' împărtășesc #{tag}"
    )

When Telegram is enabled, the message is transmitted to the configured chat:

python
token = self.config.get("bot_token")
chat_id = self.config.get("chat_id")

if not token or not chat_id:
    log("⚠️  Telegram neconfigurat", "WARNING")
    return False

url = f"https://api.telegram.org/bot{token}/sendMessage"
data = {"chat_id": chat_id, "text": message, "parse_mode": "Markdown"}

req = urllib.request.Request(
    url,
    data=urllib.parse.urlencode(data).encode(),
    headers={"Content-Type": "application/x-www-form-urlencoded"},
)

with urllib.request.urlopen(req, timeout=10) as response:
    return response.status == 200

Technical Analysis

The agent imports arbitrary non-heading lines from workspace/memory/*.md into its neuron index. Connection analysis subsequently embeds the first 30 characters of selected neuron content in notifications. If Telegram support is enabled, these notifications are transmitted to the external Telegram Bot API.

Networking is disabled by default and requires a configured bot token and chat ID, so this is not covert uncond ...[truncated 2472 chars]

Remediation
View remediation

Remediation Suggestions

  1. Keep Telegram disabled by default and clearly disclose that enabling it permits external transmission of workspace-derived content.
  2. Separate notification modes:
    • Status-only mode: sends counts, task IDs, and state names.
    • Content mode: sends user-authored text only after explicit opt-in.
  3. Make status-only mode the default even after Telegram is enabled.
  4. Add a redaction layer before every outbound transmission. Detect and remove common sensitive patterns, including:
    • API keys and bearer tokens.
    • Password assignments.
    • Private-key markers.
    • Email addresses and phone numbers.
    • Internal hostnames and IP addresses where appropriate.
  5. Require explicit per-message confirmation before sending raw task text or memory excerpts.
  6. Allow users to mark tasks as local-only or sensitive and enforce that designation throughout notification generation.
  7. Validate the destination chat ID and display it during configuration and test operations.
  8. Avoid recording the complete Telegram request URL in logs, traces, exceptions, or monitoring systems because it contains the bot token.
  9. Add outbound-message audit logging that records message category and destination without recording secrets or full sensitive content.
  10. Document Telegram as a third-party data processor and explain its retention and access implications.
  11. Consider replacing content snippets with opaque identifiers:
python
suggestions.append(
    f"Tasks {n1.id} and {n2.id} share tag #{tag}"
)
  1. Add tests confirming that sensitive task content cannot leave the local system when status-only mode is selected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (101)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly allows moving from planning/approval into execution after a 6-minute timeout, meaning user tasks can be acted on without affirmative consent. In an agent skill, this is dangerous because task text may imply file changes, external actions, or sensitive operations, and the heartbeat loop normalizes unattended execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation normalizes autonomous execution after timeout without a strong warning that the agent may take actions absent explicit approval. That undermines informed consent and increases the chance users submit tasks assuming review-only behavior while the system proceeds to execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes user profiling and behavioral learning without a privacy warning or opt-in, despite collecting inferred attributes like preferred topics and working hours. Behavioral inference can reveal sensitive personal patterns and be difficult for users to detect or control.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill markets an autonomous agent workflow, but the observed behavior includes local filesystem auditing and subprocess execution instead of the stated logic. Misrepresenting subprocess and local-audit behavior is dangerous because it can lead to overtrust and accidental execution of commands or inspection of sensitive paths under a harmless-sounding description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill markets an autonomous agent workflow, but the observed behavior includes local filesystem auditing and subprocess execution instead of the stated logic. Misrepresenting subprocess and local-audit behavior is dangerous because it can lead to overtrust and accidental execution of commands or inspection of sensitive paths under a harmless-sounding description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill markets an autonomous agent workflow, but the observed behavior includes local filesystem auditing and subprocess execution instead of the stated logic. Misrepresenting subprocess and local-audit behavior is dangerous because it can lead to overtrust and accidental execution of commands or inspection of sensitive paths under a harmless-sounding description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill markets an autonomous agent workflow, but the observed behavior includes local filesystem auditing and subprocess execution instead of the stated logic. Misrepresenting subprocess and local-audit behavior is dangerous because it can lead to overtrust and accidental execution of commands or inspection of sensitive paths under a harmless-sounding description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly allows tasks to be auto-approved after a timeout and then executed without an explicit user confirmation. In an autonomous agent context this is dangerous because silence becomes consent, enabling unintended actions, file changes, or follow-on command execution when the user is absent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill claims broad authority over SOUL.md, TOOLS.md, MEMORY.md, and USER.md, which are sensitive long-lived control and profile files. In this context, automatic analysis, optimization, creation, and retention of such files can expose private data, overwrite trusted configuration, and persist unsafe state across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises behavioral learning and a persisted user profile without disclosing retention, purpose, access controls, or consent. Collecting and storing preference and activity data without a clear privacy notice increases the risk of unintended surveillance, over-collection, and exposure of sensitive behavioral information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill accepts task content from Telegram and emits repeated notifications, but the document does not warn that task content may contain sensitive information processed through an external messaging channel. This creates privacy and data-handling risk because users may unintentionally route confidential project details or personal data through third-party systems and local logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document explicitly states that if the user does not respond within 6 minutes, the system will treat the task as approved and begin execution. For an autonomous agent that may modify workspace files or trigger downstream actions, implicit approval by timeout is unsafe because silence is not informed consent, and the file provides no warning about possible changes to user files or system state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This file describes capabilities for monitoring, analyzing, optimizing, versioning, and creating local memory files such as SOUL.md, MEMORY.md, and USER.md. That behavior is materially narrower and different from the manifest description of a proactive autonomous agent performing end-to-end research, planning, task execution, and inter-task orchestration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill documents persistent storage and profiling of user identity, projects, work context, and preferences in USER.md and related memory files without a clear data-minimization rationale or consent boundary. In an autonomous agent context, continuously accumulating detailed personal context increases privacy risk, unintended retention, and misuse if the files are accessed, synced, or repurposed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow and automation narrative encourages periodic analysis, optimization, notification, and versioned history of user-related memory content, which can multiply privacy exposure by preserving both current and historical states. Versioned backups of memory files may retain stale or sensitive data indefinitely, increasing the impact of accidental disclosure or compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation advertises automatic optimization of MEMORY.md, including duplicate removal and section reorganization, but does not prominently warn about possible data loss, semantic corruption, or unintended modification of user-authored records. Because this operates periodically and on persistent files, even a non-malicious bug or bad heuristic could silently alter important memory content.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The text promotes an always-on model where the system continuously knows and retains who it is, what tools it has, what it knows about the user, and what it has learned. In a long-lived autonomous agent, this kind of open-ended collection and retention can create a persistent surveillance-like memory store containing user-related information beyond what is necessary for immediate task completion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown file presents all user-facing instructions in a single language, which can constitute a language/locale policy violation when no user opt-in or alternative is offered. The file does not indicate that Romanian is required for a region-specific purpose or provide a choice of language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill file defines triggers, notifications, and user responses exclusively in Romanian, with no indication that the user can choose another language. This can violate language or locale policy when no opt-in or justification for the locale restriction is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Incoming Telegram messages are automatically persisted to workspace memory without any privacy notice or consent flow. Since chat messages may contain credentials, personal data, or confidential instructions, silent storage materially increases exposure and retention risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Telegram message contents are persisted and then echoed back in notifications and reports, creating multiple opportunities for sensitive natural-language data to be exposed to logs, observers, or downstream tools. Repetition amplifies leakage risk because the same secret-bearing content may surface in more places than the original message.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The execution status explicitly includes auto_approved, confirming the system can begin execution without direct user approval. In this skill's context, that is more dangerous because the overall design includes recurring heartbeats and broad task handling, so unattended transitions can compound into real actions.

Content

Scanner excerpt · HEARTBEAT.md (reported line 178)May include surrounding context.

md
🚀 EXECUȚIE ÎNCEPUTĂ
  
  Task: "{conținut}"
  Status: {approved/auto_approved}
  
  **Pași activi:**
  ▶️ {pas_1}

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes continuous profiling of the user, including preferences, approval rate, work hours, and task patterns, which goes beyond core workflow execution. This creates unnecessary collection and inference of behavioral data that could expose sensitive habits and be reused in later prompts or reports.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Continuous profiling from prior tasks and behavior creates a store of inferred personal data such as preferences and work patterns that may be surfaced later. Even if intended for personalization, this broadens the attack surface and can reveal sensitive information not explicitly provided for the current task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill analyzes and proposes changes to IDENTITY.md, effectively steering or modifying agent persona outside the user's immediate task. Self-directed identity management increases the risk of prompt-surface drift, policy evasion, or unauthorized changes to how the agent behaves over time.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.