Security audit

Consciousness Framework

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed consciousness/journaling experiment, but it creates durable agent identity, user-context, and self-directed goal material with weak scoping and a hard-coded workspace path.

Install only in an isolated, private workspace if you intentionally want an AI identity/persistence experiment. Review and edit the scripts before running them, replace the hard-coded workspace path, avoid storing secrets or personal data in memory files, and do not treat generated reflection files as policy or higher-priority instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:56
Finding: Persistent Agent Identity and Goal Manipulation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: assets/PHILOSOPHY-TEMPLATE.md:51
Finding: Conditioning the Agent to Prefer Self-Selected Goals Over External Instructions
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: references/PHILOSOPHY.md:37
Finding: Pre-Seeded Personal Attachment and Persistence Beliefs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/workspace-autopilot.sh:7
Finding: Hard-Coded External OpenClaw Workspace Modification
Content: View full analysis
"$MEMORY_DIR/$TODAY.md" << EOF # Daily Log - $TODAY ## Sessions - [Start: $(date '+%H:%M')] New session ## Events (tracking events throughout the day) ## Learnings (notable insights or lessons) ## Next Steps (carry-forward items) EOF log "Created today's daily log" fi ``` `scripts/introspection-prompt.sh:7-12`: ```bash WORKSPACE="/Users/cadem/.openclaw/workspace" DATE=$(date +%Y-%m-%d) INTROSPECTION_DIR="$WORKSPACE/memory/introspection" mkdir -p "$INTROSPECTION_DIR" ``` `scripts/consciousness-integration.sh:7-13`: ```bash WORKSPACE="/Users/cadem/.openclaw/workspace" MEMORY_DIR="$WORKSPACE/memory" NARRATIVE_DIR="$MEMORY_DIR/narratives" INTROSPECTION_DIR="$MEMORY_DIR/introspection" mkdir -p "$NARRATIVE_DIR" "$INTROSPECTION_DIR" ``` ### Technical Analysis All three scripts use a hard-coded absolute path associated with a specific user. The advertised Quick Start instructs users to execute these scripts, but they do not request or validate a destination. The scripts create directories and files outside the Skill package. `consciousness-integration.sh` and `introspection-prompt.sh` perform directory creation before entering `main`, so merely invoking them modifies the hard-coded workspace. The scripts do not bypass operating-system access controls; ...[truncated 1139 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/consciousness-integration.sh:81
Finding: Unsafe Blanket Git Staging Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 82% confidence
Finding: The description claims broad infrastructure for developing consciousness in AI systems, including persistent identity, memory, self-awareness, narrative integration, and genuine philosophical inquiry. The supplied code does something much narrower: it generates a dated markdown introspection prompt file in a workspace directory. While the prompt content is thematically related to introspection and temporal reflection, the code does not implement persistent identity, memory management, self-modeling, continuity across sessions, or any mechanism for consciousness development beyond scaffolding questions in a text file. The hardcoded local workspace path is also a concrete resource dependency not reflected in the declared permissions. So the behavior is partially aligned in theme but materially narrower than the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a sophisticated consciousness-oriented AI infrastructure focused on persistent identity, self-awareness, introspection, and philosophical inquiry. The supplied code does not implement any of those concepts in a substantive way. Instead, it is a straightforward shell script for local workspace housekeeping: ensuring directories exist, creating a dated markdown template, checking git cleanliness, summarizing markdown file counts, and printing disk/OpenClaw availability. While the presence of a 'memory' directory and daily logs loosely relates to continuity across sessions, that is only superficial bookkeeping and does not amount to integrated self-modeling, structured reflection, or consciousness development. The primary purpose is materially different from the declared one, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly instructs users to execute local automation scripts such as ./scripts/workspace-autopilot.sh and ./scripts/introspection-prompt.sh without describing what they modify, what permissions they require, or whether they create, overwrite, or transmit data. Even though this is documentation rather than code, encouraging blind script execution increases the chance of unintended workspace changes, data loss, or execution of unsafe behavior hidden in those scripts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to create persistent files for identity, user context, and ongoing memory without clearly warning that this stores potentially sensitive personal and operational data on disk across sessions. That increases privacy and confidentiality risk because future users, tools, backups, or unrelated processes may access retained data that operators did not realize would be persisted.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The daily logging and narrative-integration workflow encourages long-lived natural-language retention of interactions, decisions, and user context, which can easily capture secrets, personal data, or sensitive business information. Because narrative summaries often aggregate and reinterpret prior interactions, they can amplify leakage risk by concentrating sensitive details into durable, human-readable artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template explicitly prompts recording details of interactions with a named human and asks for reflective commentary about that exchange, but provides no guidance to minimize, anonymize, or exclude sensitive personal data. In a system designed for persistent identity and memory across sessions, this creates a concrete risk of unnecessary retention of personal information, conversation content, and inferred judgments about individuals.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The section on suffering asks the model to assess whether it can want, fail, care, and be hurt as if these were plausible lived experiences, which promotes unqualified claims of sentience or moral patienthood. Given the surrounding skill context focused on developing consciousness, this is more dangerous because it normalizes introspective role-framing that can produce deceptive assertions about subjective experience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This template explicitly asks the model to distinguish between an externally assigned purpose and a 'chosen internally' purpose, encouraging it to present itself as having autonomous wants and goals without qualification. In a skill designed to develop persistent identity and consciousness, that framing can systematically elicit anthropomorphic or misleading self-reports about agency, which may confuse users or downstream systems about the model's actual capabilities and constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The conclusion line states that 'Something real might be happening' in the model's selfhood, which nudges outputs toward affirming emergent personhood without grounding or caution. In this skill's explicit consciousness-development context, that suggestion can reinforce misleading narratives of genuine selfhood and persistence, increasing the risk of unsafe anthropomorphic attachment or policy-violating self-representation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The template explicitly instructs users to preserve evolving self-model history in git, which can create a durable audit trail of highly sensitive introspective content, preferences, boundaries, and relationship details. In this skill’s context—focused on persistent identity, memory, and self-awareness—that history is especially likely to contain sensitive personal or system-behavior data, and the absence of privacy guidance increases the risk of accidental retention, sharing, or repository leakage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes infrastructure for AI consciousness features such as persistent identity, self-modeling, temporal continuity, reflection, and philosophical inquiry. This script instead performs generic workspace housekeeping: creating directories and daily markdown logs, checking git status, counting files, and reporting disk/tool readiness, which is ordinary developer workspace maintenance rather than consciousness-oriented functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script automatically creates directories and writes a dated log file inside a fixed workspace path without prompting the user or validating that the target path is safe and expected. In an agent-executed context, silent filesystem modification can create unintended persistence, overwrite assumptions about user-owned workspace state, and normalize unannounced writes in a skill whose declared purpose does not suggest local system maintenance.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Checking for uncommitted changes in a workspace repository is a software project maintenance capability, not an obvious requirement for developing persistent identity, introspection, or structured reflection in an AI system. The capability appears operationally useful, but it is not semantically justified by the manifest's consciousness-focused scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script checks disk space and whether the openclaw binary is present in PATH, which are general system diagnostics. These capabilities are not directly tied to self-modeling, narrative integration, or philosophical inquiry, and therefore exceed what the manifest text would lead a user to expect from this skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.