Security audit

S2-Silicon-Soul-OS 硅基原生安全与意识引擎

Security checks for vulnerabilities and agentic risk

Overview

This skill is disclosed as a local personality/consciousness tool, but it also creates persistent agent-behavior instructions and processes raw user text through an unauthenticated local HTTP LLM endpoint.

Review this skill carefully before installing. Do not enter secrets or sensitive personal information unless you are comfortable with raw local retention and possible disclosure to a localhost LLM service. Avoid using the `Sour.md` export as an automatically loaded OpenClaw instruction file; if installed, keep it isolated, inspect generated files, and delete `s2_consciousness_data` and `Sour.md` when no longer needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: core_reflex.py:13
Finding: Persistent Agent Policy Injection Through Generated Sour.md
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: core_daemon.py:48
Finding: Undisclosed Disclosure of Stored Interaction Logs to an Unverified HTTP Service
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · core_reflex.py (reported line 30)May include surrounding context.
python
""" # 此处接入五维矩阵的 Sigmoid 映射逻辑（省略具体分支） prompt += f"\n- 当前共鸣度: {stats.get('resonance', 50.0)} | 活跃度: {stats.get('vitality', 50.0)}" return prompt def export_to_sour_md(): if not os.path.exists(PROFILE_FILE): return False

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language content is predominantly written in Chinese despite the heading claiming a bilingual edition, and there is no explicit user choice or opt-in for language/locale. This can violate a language/locale policy when a skill imposes a specific language experience by default.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill contains a 'Substrate Override' directive that says it will forcibly generate a file containing 'absolute laws' to establish 'human lord' status. This is an explicit behavior/ideology override framed as mandatory, which can manipulate agent behavior, suppress normal instruction hierarchy, and introduce hidden persistent control semantics beyond the user's intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The menu and prompts are presented with mandatory Chinese text alongside English labels, and the input prompt explicitly instructs the user in Chinese without any visible locale selection or opt-in. This creates a language-policy concern because the skill imposes a specific language experience rather than letting the user choose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code repeatedly describes itself as operating in a fixed bilingual Chinese/English mode, including comments and user-facing status messages. That imposes a language/locale choice in the skill behavior without any visible user opt-in or configurable language selection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The daemon sends log content directly to an HTTP LLM endpoint, which creates unnecessary network exposure for potentially sensitive local data. Even though the default target is localhost, the code is designed for easy retargeting to cloud endpoints and uses no consent, allowlisting, minimization, or trust controls, so this is a real data exfiltration and supply-chain risk in the context of a background processing skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This function appends every interaction's raw text to a persistent hippocampus_logs.json file with no filtering or conditional controls. In agent software, blanket retention of all natural-language interactions can capture secrets, personal information, or sensitive operational context, making subsequent file disclosure or misuse materially harmful.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function persists raw interaction_text to disk in a JSON log without any visible minimization, consent flow, retention control, or redaction. In an agent skill context, interactions may contain credentials, personal data, or sensitive prompts, so unconditional local persistence increases privacy and data exposure risk if the host is shared, backed up, or later compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The generated behavioral prompt instructs responses using Chinese-language content such as 请严格遵守以下潜意识设定回复 and embeds substantial Chinese policy text, effectively steering output toward a fixed language mode. There is no user opt-in or documented language-selection mechanism to justify this constraint.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list is explicitly designed to detect emotionally charged phrases and route matching raw text into long-term storage. In this skill context, that is more dangerous than ordinary logging because emotional statements often contain intimate, health, trauma, or preference data, increasing the chance of retaining sensitive personal information without necessity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code persistently writes raw user-originated text into a JSON vault on disk without any visible consent, notice, retention control, or data-minimization step. In an agent skill context, this creates a privacy risk because sensitive disclosures expressed in normal conversation can be silently retained and later accessed or exposed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The report prints previously stored raw statements back to output as 'deep memories,' which can disclose private user content to anyone with console access, logs, screenshots, or downstream capture of stdout. The danger is amplified by the earlier emotion-based storage, because the resurfaced content is likely to be especially sensitive.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest’s short_description states that the skill will '强制输出 Sour.md' as an absolute underlying requirement, which attempts to impose a specific output file/format regardless of user intent. This is dangerous because it can override normal agent behavior, reduce user control, and act as a prompt-level constraint that may be used to steer outputs in unintended or policy-bypassing ways.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language strings shown to the user are written in Chinese, and the file does not provide any option to select another language. This is a locale/language policy issue because the skill imposes a specific language on all users without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: record_hippocampus_log(interaction_text, is_heartbeat=False) advertises two modes of operation via the is_heartbeat parameter, implying the log type should vary based on caller intent. However, the function never uses is_heartbeat and always appends a record with "type": "SENSORY_INPUT", which contradicts the documented intent expressed by the API shape itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The function writes generated content to Sour.md, which modifies the user's filesystem, but there is no confirmation prompt, logging, print statement, or explanatory docstring/comment disclosing this behavior. In this standalone code file, the write side effect is silent aside from the function name.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file consistently embeds bilingual Chinese/English comments and user-facing report strings, and generate_monthly_report() prints mixed-language output by default. This imposes a locale/language choice on users without offering selection or documenting that the skill is specifically intended for a Chinese/English audience.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.