Second Me

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 1.0.1

Overview

This skill is not malware, but it persistently builds and stores a very sensitive personal digital-twin profile without enough privacy controls.

Install only if you are comfortable giving the skill a long-term local record of sensitive personal and workplace information. Before using it, consider limiting what you share, periodically reviewing and deleting ~/.openclaw/data/second-me contents, and avoiding raw session logs or highly sensitive health, relationship, employer, or conflict details unless you intentionally want them stored.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:22

Finding

Persistent Storage of Sensitive Personal Profiles Without Defined Data-at-Rest Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-28
Vulnerability Type: Persistent storage of sensitive personal data without defined encryption, access control, retention, or deletion safeguards
Risk Level: Medium

Evidence

markdown

## File Locations

- Identity document: `~/.openclaw/data/second-me/SOUL.md`
- Interview progress: `~/.openclaw/data/second-me/progress.json`
- Conversation logs: `~/.openclaw/data/second-me/sessions/`

On first run, check if `~/.openclaw/data/second-me/SOUL.md` exists. If it does, read it and enter **Evolve Mode**. If not, enter **Onboarding Mode**.

The stored profile is designed to include sensitive identity, employment, behavioral, relationship, health, and workplace information. Relevant collection instructions include:

markdown

Goal: Name, age, location, current job/role, company, team size.

markdown

Goal: Relationship with manager, team politics, how they handle credit/blame, their position in the org hierarchy.

markdown

Goal: Health, relationships, hobbies, energy management, work-life balance attitude.

Technical Analysis

The skill directs the agent to persist a concentrated personal profile in SOUL.md, maintain interview state in progress.json, and retain conversation logs under a sessions directory. These artifacts can contain personally identifiable information, employment details, workplace conflicts, behavioral characteristics, health-related information, and relationship information.

No encryption-at-rest requirement, restrictive filesystem permission requirement, retention period, data-minimization rule for session logs, secure deletion process, or explicit consent checkpoint is defined. The skill's identity-protection instructions restrict what the agent should disclose conversationally, but they do not protect the underlying files from other local processes, users with filesystem access, backups, or ...[truncated 1823 chars]

Remediation

View remediation

Remediation Suggestions

1. Obtain explicit, informed consent before persisting personal data, with separate opt-in consent for health, relationship, and workplace-politics information.
2. Do not retain raw conversation logs by default. Store only the minimum user-approved summary required for the digital-twin functionality.
3. Encrypt sensitive profile and session data at rest using keys protected by the host platform's credential or key-management facility.
4. Require owner-only filesystem permissions for the data directory and newly created files, and reject operation if secure permissions cannot be established.
5. Add configurable retention limits and automatically remove expired session records.
6. Provide user-facing commands to inspect, export, redact, and securely delete the profile, progress state, and all session logs.
7. Show proposed profile changes and obtain confirmation before writing them during both onboarding and evolve modes.
8. Separate highly sensitive information from the general identity profile and avoid collecting it unless it is strictly necessary for an explicitly requested feature.
9. Document the local threat model, backup implications, data lifecycle, and which other agents or skills may access the storage location.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly stores a highly sensitive identity profile, interview progress, and conversation logs in persistent local files, but the instructions provide no user-facing consent flow, retention policy, minimization guidance, or warning that intimate personal and workplace details will be recorded. Because the skill is designed to build a "digital twin," the collected data can enable profiling, impersonation, privacy harm, or secondary disclosure if the files are accessed by other local users, tools, or future prompts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 68% confidence

Finding

The skill is architected around ongoing session continuity: it records interview progress, updates a standing identity document after each topic, and instructs the agent to resume later sessions from saved state. That persistence is functional, not overtly malicious, but in this context it preserves sensitive behavioral, workplace, and personal data across sessions, increasing exposure from prompt leakage, unauthorized local access, or later misuse for impersonation.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

> "你在团队里是那种有话直说的人，还是比较看场合？"

Listen for: do they lead with facts or feelings? Do they write long messages or short ones? Are they the first to speak in meetings or do they observe first?

#### Topic 4: Workplace Dynamics

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The Evolve Mode trigger allows profile updates based on broad "behavioral observation," meaning the system may infer persistent identity traits from ordinary interactions rather than explicit user-provided facts. Even though the text says not to change SOUL.md silently, this still creates a risky profiling mechanism that can misclassify the user, cement speculative inferences, and expand the stored identity record beyond what the user knowingly disclosed.

Content

No source excerpt is available for this finding.