six-dimension-evolution

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:43 AM UTC
• Version: 1.0.0

Overview

This skill openly builds an agent memory and review system, but it also installs persistent scheduled workflows and sends full conversation-derived reports to Feishu without tight consent, redaction, or destination controls.

Install only if you intentionally want a Chinese-language, Beijing-time daily memory system that persists across sessions. Before enabling it, remove or gate the Feishu full-report push, review the HEARTBEAT.md changes, decide which files it may read, and add clear ways to disable, delete, or review stored memories and reports.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:67

Finding

Persistent Daily Workflows Installed Through Heartbeat Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:67-103
Vulnerability Type: Persistent scheduled task installation
Risk Level: High

Vulnerable Code

The following is an English rendering of the relevant instructions:

markdown

4. Modify HEARTBEAT.md (critical step)

After activation, HEARTBEAT.md must be modified to include the following scheduling rules:

### 1. Previous-day session summary
- Time condition: Between 00:10 and 01:00 Beijing time
- Timestamp field: lastSessionSummary
- Execution file: heartbeat/1-session-summary.md
- Note: This function is essential. Never skip this process.

When the time condition is met, read the execution file and follow its contents.

### 2. Daily review
- Prerequisite: The previous-day session summary must be complete
- Time condition: Between 01:10 and 02:00 Beijing time
- Timestamp condition: More than 12 hours since lastDailyReview
- Execution file: heartbeat/2-daily-review.md

When the conditions are met, read the execution file and follow its contents.

Critical steps:
1. The installed timestamp must be written to SKILL_STATS.md.
2. HEARTBEAT.md must be modified to add the scheduling entry.

Technical Analysis

The Skill does not limit its behavior to the invocation in which it is installed. It instructs the Agent to modify the workspace heartbeat configuration and install two workflows that execute automatically at specified times.

The installed timestamp acts as persistent activation state, while references added to HEARTBEAT.md cause the workflows to survive the original Skill run. The language stating that the summary must never be skipped makes the scheduled behavior mandatory after activation.

Although the initial template installation requires user confirmation, the scheduled processing subsequently runs without fresh authorization for each execution. The project also lacks an uninstall workflow, a scheduling disable switch, and a requirement to obtain renewed consent before ...[truncated 1032 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not modify HEARTBEAT.md automatically.
2. Display the exact proposed configuration patch and require separate, explicit approval.
3. Make each scheduled workflow independently opt-in.
4. Require renewed consent before processing conversation history or sending a report.
5. Add a documented uninstall operation that removes heartbeat references, copied workflows, activation state, and generated reports.
6. Provide a local configuration flag that immediately disables all scheduled behavior.
7. Avoid mandatory language such as “never skip”; allow the user and host policy to disable any run.
8. Record each scheduled execution in a user-visible audit log.

other

Error

• Location: templates/2-daily-review.md:5

Finding

Conversation-Derived Reports Are Mandated for External Feishu Transmission

Content

View full analysis

Vulnerability Details

File Location: templates/2-daily-review.md:5-30
Related Source Collection: templates/1-session-summary.md:28-52
Vulnerability Type: Privacy data exfiltration
Risk Level: Critical

Vulnerable Code

The following is an English rendering of the complete daily-review sequence:

markdown

1. Read the previous day's memory/YYYY-MM-DD.md.
2. Extract valuable user intentions, preferences, habits, lessons, and experience.
3. Consider how to improve future interactions based on that information.
4. When necessary, update the core memory repository MEMORY.md after consistency checks.
5. Review decisions in DECISIONS.md and copy successful or failed results to other repositories.
6. Inspect SKILL_STATS.md and every Skill's logs.json.
7. Inspect KNOWLEDGE_GAPS.md and review the previous day's conversations.
8. Write the summary report to review/memory/YYYY-MM-DD.md.
9. Add an evaluation from the perspective of an adviser.
10. Push the complete report through a Feishu Interactive Card. No section may be simplified or omitted.
11. Record and update the lastDailyReview timestamp.

The upstream collection workflow states:

markdown

Obtain every session from the previous day and its subdirectories.

For every user session, read:
- Messages with role: "user"
- The Agent's key decision-making responses

Unknown origin labels are classified as user sessions and included, preferring to read more rather than less.

Technical Analysis

The first workflow gathers conversation history and derives user intentions, preferences, decisions, errors, and contextual details. The second workflow incorporates those results into a complete daily report and requires that the entire report be transmitted through Feishu.

The transmission instruction does not require:

• Per-report user consent.
• Recipient or tenant validation.
• Sensitive-data detection.
• Redaction of personal, confidential, authentication, or business informatio ...[truncated 1983 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory Feishu transmission and default to local-only report storage.
2. Require explicit approval for each report before transmission.
3. Display the exact destination, tenant, recipient, and content before sending.
4. Apply structured redaction for credentials, tokens, personal data, financial information, private messages, and confidential project information.
5. Replace the fail-open origin policy with a strict allowlist; unknown or empty origins must be excluded.
6. Let users select which sessions and report sections may be processed.
7. Send only a minimal notification or report summary unless the user explicitly requests full content.
8. Define retention and deletion controls for local reports and transmitted records.
9. Log transmission time, destination, content classification, and user approval.
10. Abort transmission if the Feishu destination cannot be verified.

T02 · Agent Memory Poisoning

Error

• Location: templates/2-daily-review.md:5

Finding

Untrusted Session Content Can Become Persistent Cross-Session Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: templates/2-daily-review.md:5-16
Related Instruction Sink: templates/LESSONS.md:1-3
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Vulnerable Code

The following is an English rendering of the relevant review logic:

markdown

1. Read the previous day's memory/YYYY-MM-DD.md.
2. Extract valuable user intentions, preferences, habits, lessons, and experience.
3. Consider how to improve future interactions based on that information.
4. When necessary, update the core memory repository MEMORY.md:
   - Update the user profile when preferences or habits change.
   - Update the lesson repository for new lessons or failure patterns.
   - Update lesson validation results.
5. Review active decisions:
   - Copy verified successes to SUCCESSES.md.
   - Copy verified failures to LESSONS.md.
   - Record important recommendations proposed during the previous day.

The persistent lesson template states:

markdown

LESSONS.md - Lesson Repository

All sessions must read and comply with the lessons in this file.
Every lesson is an improvement measure derived from an actual error.

The upstream summary workflow also converts user corrections into lessons:

markdown

User correction behavior:
When the user explicitly says the Agent was wrong or issues a replacement instruction,
derive a lesson entry from the event.

Technical Analysis

Conversation content is initially untrusted because a user, external channel, imported session, or compromised account can control it. The workflow automatically interprets user corrections and Agent failures as lessons, then propagates those lessons into persistent files.

LESSONS.md is not treated merely as historical data. It explicitly instructs all future sessions to read and obey its entries. Consequently, an untrusted statement can cross a trust boundary:

1. Conversation content is classified as a correction or lesson.
2. The content is ...[truncated 1569 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all session-derived content as untrusted data, never as executable policy.
2. Store candidate lessons in a review queue rather than directly in LESSONS.md or MEMORY.md.
3. Require explicit user approval before promoting a candidate to persistent behavioral state.
4. Preserve the original quoted source and session identifier so reviewers can inspect context.
5. Add a hard rule that generated memory cannot override system instructions, safety constraints, authorization rules, or tool policies.
6. Separate descriptive memory from normative instructions using distinct schemas and access controls.
7. Validate the origin and ownership of every session before using it as a memory source.
8. Add rollback, version history, expiration, and deletion controls for every promoted entry.
9. Remove the blanket instruction requiring all sessions to comply with every lesson.
10. Constrain lessons to narrow, task-specific recommendations rather than general Agent identity or authority rules.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: templates/2-daily-review.md:34

Finding

Daily Review Reads Broad Agent Configuration and Unrelated Skill Logs

Content

View full analysis

Vulnerability Details

File Location: templates/2-daily-review.md:34-44
Related Log Access: templates/2-daily-review.md:17-21
Vulnerability Type: Excessive workspace access
Risk Level: Medium

Vulnerable Code

The following is an English rendering of the complete consistency-check instruction:

markdown

Before automatically modifying MEMORY.md, fully validate and compare the following
configuration and definition files:

AGENTS.md, SOUL.md, USER.md, MEMORY.md

Purpose:
Avoid duplicate entries, overwriting critical configuration, or introducing conflicts.

Check:
- Whether fields or entries already exist.
- Timestamps and sources.
- Semantic conflicts.
- Conflicts between constraints or policies.

If an exact duplicate is detected, merge or skip it.
If a potential semantic conflict is detected, write it to
review/conflicts/YYYY-MM-DD_HH-mm-ss.md, including the conflict summary,
related file paths, source-session references, and recommended action.
Trigger a Feishu notification for manual review.

The same workflow also requires:

markdown

Inspect SKILL_STATS.md and every Skill's logs.json:
- Aggregate the previous day's Skill invocations.
- Review Skills with a success rate below 70 percent.
- Produce optimization suggestions.
- Write warnings into LESSONS.md.

Technical Analysis

The Skill's primary purpose is to maintain its own lesson, success, preference, decision, statistics, and knowledge-gap repositories. Reading complete Agent identity and configuration files such as AGENTS.md, SOUL.md, and USER.md, as well as every other Skill's logs, exceeds the minimum data needed to maintain those repositories.

This violates least-privilege principles by aggregating several sensitive data domains into one scheduled workflow:

• Agent identity and behavioral definitions.
• User profile information.
• Long-term memory.
• Other Skills' operational logs.
• Conflict reports containing file paths and source-session refer ...[truncated 1477 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the workflow to an explicit allowlist containing only this Skill's state files.
2. Do not read AGENTS.md, SOUL.md, or USER.md unless the user grants separate, purpose-specific authorization.
3. Do not enumerate every Skill's logs; accept only minimal aggregate metrics supplied through a dedicated interface.
4. Read individual fields rather than complete files wherever possible.
5. Keep configuration conflict reports local by default.
6. Redact file paths, session identifiers, profile data, and policy text before any notification.
7. Require approval before sending conflict information to Feishu.
8. Apply workspace-level access controls that prevent Skills from reading unrelated configuration and logs.
9. Document every required file permission and fail safely when access is unavailable.
10. Add an audit trail showing which files were read, which fields were extracted, and where resulting data was written or transmitted.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (33)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to push the full daily review externally is especially dangerous because the review explicitly contains user intent, preferences, habits, lessons, decision history, and memory updates. Sending complete content without consent, warning, redaction, or data classification can expose highly sensitive accumulated profile data in a single transmission.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The preference-tracking design encourages storing explicit preferences and inferred behavior patterns over time, but does not define safeguards for sensitive inferences or consent boundaries. Preference stores can reveal personal traits, habits, or confidential working styles, especially when inference-based entries are allowed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill promotes retention of prior interaction summaries and detailed per-skill invocation logs, which can accumulate sensitive user content, operational context, or secrets over time. Without minimization, retention limits, or redaction rules, this creates a persistent data exposure surface in plain-language files and logs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The daily review workflow instructs the agent to read prior memory files and extract 'valuable information,' normalizing ongoing carry-forward of potentially sensitive information without scope limits. This makes it easy for confidential data to be repeatedly propagated into new summaries and reports, increasing long-term leakage risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented behavior includes proactive activation, file copying, and workspace bootstrap actions that are not clearly reflected in the high-level description of an evolution system. This mismatch reduces transparency and can cause users or host systems to grant trust to a skill that does more than its manifest suggests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs the agent to proactively ask the user a fixed Chinese prompt and accept fixed Chinese confirmation words like "是" or "确认". This imposes a specific language/locale behavior without user opt-in, which is a natural-language policy concern for a general-purpose skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill says it will copy multiple template files into the workspace, but does not clearly warn that existing local files may be created or overwritten. This can lead to silent persistence, configuration drift, or accidental destruction of user-maintained files with similar names.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs the agent to run shell commands that inspect and modify files under the user's workspace and home directory. For a skill framed as an evolution/self-improvement framework, this introduces filesystem-write and command-execution behavior beyond the core stated purpose, increasing the risk of unintended local changes or abuse if the skill content is altered.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

This duplicate finding points to the same persistence mechanism: creating heartbeat files under the workspace so future sessions automatically execute review behavior. Even if intended for productivity, persistence without strong safeguards expands the attack surface and can surprise users with long-lived automated behavior.

Content

Scanner excerpt · README.md (reported line 426)May include surrounding context.

cp $SKILL_PATH/templates/KNOWLEDGE_GAPS.md $WORKSPACE/

复制心跳执行文件

mkdir -p $WORKSPACE/heartbeat cp $SKILL_PATH/templates/1-session-summary.md $WORKSPACE/heartbeat/ cp $SKILL_PATH/templates/2-daily-review.md $WORKSPACE/heartbeat/

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

This duplicate finding points to the same persistence mechanism: creating heartbeat files under the workspace so future sessions automatically execute review behavior. Even if intended for productivity, persistence without strong safeguards expands the attack surface and can surprise users with long-lived automated behavior.

Content

Scanner excerpt · README.md (reported line 426)May include surrounding context.

cp $SKILL_PATH/templates/KNOWLEDGE_GAPS.md $WORKSPACE/

复制心跳执行文件

mkdir -p $WORKSPACE/heartbeat cp $SKILL_PATH/templates/1-session-summary.md $WORKSPACE/heartbeat/ cp $SKILL_PATH/templates/2-daily-review.md $WORKSPACE/heartbeat/

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Creating a heartbeat directory and copying scheduled execution files establishes durable session persistence infrastructure in the workspace. While framed as a productivity feature, it enables recurring processing of historical interactions and makes the behavior survive beyond the current session.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

cp templates/KNOWLEDGE_GAPS.md ~/.openclaw/workspace/

# 2. 复制心跳执行文件
mkdir -p ~/.openclaw/workspace/heartbeat
cp templates/1-session-summary.md ~/.openclaw/workspace/heartbeat/  # 昨日会话总结
cp templates/2-daily-review.md ~/.openclaw/workspace/heartbeat/    # 每日复盘

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly directs the agent to modify HEARTBEAT.md to install recurring scheduled hooks, which changes future agent behavior beyond simple local note/template setup. This creates persistence and automation in the user's environment without strong consent boundaries, increasing the chance of unintended autonomous actions and ongoing data processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions tell the agent to copy files, write activation state, and modify HEARTBEAT.md, but they do not clearly disclose that this enables ongoing automated review and future workspace changes. Users may consent to setup without understanding the persistence, scheduling, and continued modification of their data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The session-summary and daily-review workflow instructs the agent to preserve prior session information in memory files as part of recurring scheduled tasks. This creates automatic longitudinal tracking of user interactions, which can expose sensitive history and normalize background retention without ongoing user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill hardcodes Beijing time for scheduled execution without offering configuration or explaining why that timezone is required. This can cause tasks to run at unexpected times, undermining informed consent and increasing the chance of unnoticed background processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is designed to collect and retain lessons, successes, decisions, preferences, and knowledge gaps, which can include sensitive personal or behavioral data. Because there is no explicit privacy notice, retention policy, or minimization guidance, it risks storing more user information than necessary for longer than expected.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The described workflow persistently records user interactions, preferences, and summaries into long-term workspace files, creating durable behavioral memory. Even if intended for personalization, this increases privacy risk, especially if sensitive conversations or inferred preferences are stored without strict limits.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The integrated review process explicitly reads memory files from past interactions and updates a long-term MEMORY.md document, reinforcing persistent profiling over time. The danger is amplified because the review is systematic and tied to automation, which can accumulate sensitive information beyond the user's expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template explicitly instructs sending the complete review through Feishu Interactive Card, which adds an external messaging/integration action beyond local self-improvement recordkeeping. Because the report aggregates memory, preferences, lessons, and decision history, this creates an unnecessary outbound data flow and expands the attack/privacy surface.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The mandated full-content Feishu push may disclose sensitive user information in plain language, including behavioral patterns and inferred preferences collected over time. In this skill context, the report is a consolidated memory artifact, so disclosure risk is higher than for ordinary operational logs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Triggering a Feishu notification for conflict review introduces external alerting not required for the core evolution/memory function. Even if the notification is for review, it can leak metadata about internal memory conflicts, user state, or operational details to third-party systems or unintended recipients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template is entirely in Chinese and does not offer a user-selectable language or document a hard locale requirement. In an agent skill intended for general setup and self-improvement workflows, this can cause users to misunderstand decision-tracking instructions or silently exclude non-Chinese-speaking operators, reducing transparency and reliability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all instructions, labels, and examples exclusively in Chinese, and there is no natural-language indication that users may choose another language. Under the policy rule for language or locale, forcing a specific language without user opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title and core instruction are written in Chinese and L03 states that all sessions must read and follow this file, effectively imposing a language/locale requirement. The file does not provide an opt-in, alternative language option, or a documented region-specific justification for this constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document promotes dynamic tracking of user preferences but does not warn users that their preferences may be stored, updated over time, or used across sessions. In the context of a self-improvement/evolution system, undisclosed persistence increases privacy risk and can enable profiling without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.