Security audit

Second Me

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malware, but it persistently builds and stores a very sensitive personal digital-twin profile without enough privacy controls.

Install only if you are comfortable giving the skill a long-term local record of sensitive personal and workplace information. Before using it, consider limiting what you share, periodically reviewing and deleting ~/.openclaw/data/second-me contents, and avoiding raw session logs or highly sensitive health, relationship, employer, or conflict details unless you intentionally want them stored.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:22
Finding: Persistent Storage of Sensitive Personal Profiles Without Defined Data-at-Rest Protections## Vulnerability Details **File Location**: `SKILL.md`, lines 22-28 **Vulnerability Type**: Persistent storage of sensitive personal data without defined encryption, access control, retention, or deletion safeguards **Risk Level**: Medium ### Evidence ```markdown ## File Locations - Identity document: `~/.openclaw/data/second-me/SOUL.md` - Interview progress: `~/.openclaw/data/second-me/progress.json` - Conversation logs: `~/.openclaw/data/second-me/sessions/` On first run, check if `~/.openclaw/data/second-me/SOUL.md` exists. If it does, read it and enter **Evolve Mode**. If not, enter **Onboarding Mode**. ``` The stored profile is designed to include sensitive identity, employment, behavioral, relationship, health, and workplace information. Relevant collection instructions include: ```markdown Goal: Name, age, location, current job/role, company, team size. ``` ```markdown Goal: Relationship with manager, team politics, how they handle credit/blame, their position in the org hierarchy. ``` ```markdown Goal: Health, relationships, hobbies, energy management, work-life balance attitude. ``` ### Technical Analysis The skill directs the agent to persist a concentrated personal profile in `SOUL.md`, maintain interview state in `progress.json`, and retain conversation logs under a sessions directory. These artifacts can contain personally identifiable information, employment details, workplace conflicts, behavioral characteristics, health-related information, and relationship information. No encryption-at-rest requirement, restrictive filesystem permission requirement, retention period, data-minimization rule for session logs, secure deletion process, or explicit consent checkpoint is defined. The skill's identity-protection instructions restrict what the agent should disclose conversationally, but they do not protect the underlying files from other local processes, users with filesystem access, backups, or ...[truncated 1823 chars]
Remediation: ## Remediation Suggestions 1. Obtain explicit, informed consent before persisting personal data, with separate opt-in consent for health, relationship, and workplace-politics information. 2. Do not retain raw conversation logs by default. Store only the minimum user-approved summary required for the digital-twin functionality. 3. Encrypt sensitive profile and session data at rest using keys protected by the host platform's credential or key-management facility. 4. Require owner-only filesystem permissions for the data directory and newly created files, and reject operation if secure permissions cannot be established. 5. Add configurable retention limits and automatically remove expired session records. 6. Provide user-facing commands to inspect, export, redact, and securely delete the profile, progress state, and all session logs. 7. Show proposed profile changes and obtain confirmation before writing them during both onboarding and evolve modes. 8. Separate highly sensitive information from the general identity profile and avoid collecting it unless it is strictly necessary for an explicitly requested feature. 9. Document the local threat model, backup implications, data lifecycle, and which other agents or skills may access the storage location.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill explicitly stores a highly sensitive identity profile, interview progress, and conversation logs in persistent local files, but the instructions provide no user-facing consent flow, retention policy, minimization guidance, or warning that intimate personal and workplace details will be recorded. Because the skill is designed to build a "digital twin," the collected data can enable profiling, impersonation, privacy harm, or secondary disclosure if the files are accessed by other local users, tools, or future prompts.

Session Persistence

Medium

Category: Rogue Agent
Content: > "你在团队里是那种有话直说的人，还是比较看场合？" Listen for: do they lead with facts or feelings? Do they write long messages or short ones? Are they the first to speak in meetings or do they observe first? #### Topic 4: Workplace Dynamics
Confidence: 68% confidence
Finding: The skill is architected around ongoing session continuity: it records interview progress, updates a standing identity document after each topic, and instructs the agent to resume later sessions from saved state. That persistence is functional, not overtly malicious, but in this context it preserves sensitive behavioral, workplace, and personal data across sessions, increasing exposure from prompt leakage, unauthorized local access, or later misuse for impersonation.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The Evolve Mode trigger allows profile updates based on broad "behavioral observation," meaning the system may infer persistent identity traits from ordinary interactions rather than explicit user-provided facts. Even though the text says not to change SOUL.md silently, this still creates a risky profiling mechanism that can misclassify the user, cement speculative inferences, and expand the stored identity record beyond what the user knowingly disclosed.

Static analysis

No suspicious patterns detected.