人脑系统

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 0.1.7

Overview

This is a coherent memory/self-maintenance skill, but it needs review because it copies broad local memory and another skill’s authority state into durable files and can run a long-lived automatic watcher.

Install only if you intentionally want a local agent memory and self-maintenance system. Before running it, remove or redact authority.json and other sensitive files from recall/checkpoint/consolidation/dream/backup flows, fix the PID shell command, and avoid enabling the hot-reload watcher or cron-style maintenance unless you know how to stop it and delete generated state.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

hot=False
if pidfile.exists():
    pid=pidfile.read_text().strip()
    hot=subprocess.run(['bash','-lc',f'kill -0 {pid}'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode==0
checks.append(('hot reload running', hot))
cron=subprocess.run(['bash','-lc','crontab -l 2>/dev/null | grep -q OPENCLAW_BRAIN_SYSTEM'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode==0
checks.append(('cron installed', cron))

• Confidence: 92% confidence
• Finding: hot=subprocess.run(['bash','-lc',f'kill -0 {pid}'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode==0

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print('\n== root ==')
subprocess.run(['id'])
print('\n== exec policy ==')
subprocess.run(['openclaw','exec-policy','show'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
brain=load('skills/brain-system/state/brain-state.json') or {}
auth=load('skills/server-body-ops/state/authority.json') or {}
tq=load('skills/brain-system/state/task-queue.json') or {}

• Confidence: 90% confidence
• Finding: subprocess.run(['openclaw','exec-policy','show'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest presents the skill as an internal cognition/memory system, but the documented routes extend into skill installation, web access, and external/action orchestration. That scope mismatch can mislead operators and downstream policy engines, causing the skill to be invoked in contexts where broader operational powers were not expected or reviewed.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Embedding skill discovery and installation into a 'brain system' gives it an unnecessary supply-chain expansion path. If triggered loosely, it could fetch or install additional untrusted skills, compounding risk far beyond memory management and enabling privilege creep through transitive capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The routing matrix authorizes spawning subagents or background processes, which materially expands autonomy and persistence beyond a cognition protocol. In a skill framed as self-maintenance and long-term memory, this makes the scope more dangerous because it can initiate ongoing activity without the narrow expectations a user might have from a 'brain' workflow.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script explicitly reads and emits `skills/server-body-ops/state/authority.json`, which belongs to a different skill and appears unrelated to simple memory recall. In an agent environment, printing another skill's authority or control state into model-visible context can unintentionally expand privileges, leak sensitive operational configuration, or let downstream prompts act on internal control metadata.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script explicitly reads and prints `skills/server-body-ops/state/authority.json`, which is outside the stated brain-system memory recovery scope and likely contains sensitive authorization or privilege state. Pulling unrelated authority data into a general session-recovery dump increases the chance of cross-skill data exposure and privilege-context leakage to whatever consumes the script output.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script explicitly reads durable state from another skill, `skills/server-body-ops/state/authority.json`, and includes it in a brain-system consolidation note without any visible access control, need-to-know check, or minimization. In a long-memory/self-maintenance skill, this cross-skill aggregation is more dangerous because it centralizes privileged or sensitive state into a new artifact that may be easier for other workflows or users to consume.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The dashboard reveals system identity and execution-policy information unrelated to the advertised brain-system workflow. In a root-scoped workspace, these details provide useful reconnaissance for privilege targeting, sandbox evasion, or planning follow-on abuse, making the skill context more dangerous than a generic local dashboard.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: Inspecting and displaying host disk information is outside the declared cognitive-memory/task-management scope of the skill. While lower severity than policy disclosure, it still leaks environmental details that can aid reconnaissance and unnecessarily expands the skill’s access to host-level operational data.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases include broad terms like memory, self-optimization, reflection, and attention management that can appear in normal conversation. Because the skill also carries operational behaviors such as file/state updates and maintenance routines, over-broad activation increases the chance of unintended invocation and side effects.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script reads potentially sensitive state from `skills/server-body-ops/state/authority.json` and embeds source excerpts into a durable markdown file under `memory/dreams`. Because it copies raw content windows into a less-controlled derivative artifact without minimization, redaction, or access controls, sensitive authority/configuration details could be retained longer, surfaced in later context, or disclosed to other components that consume workspace memory.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script reads internal workspace files and prints their contents directly with only a generic `# BOOT RECALL` header, giving no meaningful warning that sensitive state is being surfaced. In practice, this creates an easy path for private memory, task data, checkpoints, and operational metadata to enter prompts, logs, transcripts, or user-visible output without consent or need-to-know filtering.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script creates a compressed backup on disk containing potentially sensitive workspace artifacts such as memory, checkpoints, and agent/system files, but provides no disclosure, consent gate, retention control, or access-hardening. In this skill context, the archived data likely includes long-term memory and operational state, which increases the chance of unintended sensitive data persistence and later disclosure if the host is shared, compromised, or backups accumulate.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The watcher automatically triggers execution of maintenance scripts whenever monitored files change, with no confirmation, authorization check, or trust validation on the changed content. In this skill context, which is explicitly designed for persistent self-maintenance and long-running agent behavior, that makes unauthorized file modification more operationally powerful by turning simple file writes into repeated code execution pathways.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This script reads and prints raw contents of multiple core workspace files, including memory and authority/state files, with no warning, consent check, minimization, or redaction. In a long-lived agent environment, these files can contain secrets, private history, operational state, or security-relevant metadata, so dumping them to output materially increases the risk of unintended disclosure.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The script verbatim prints pinned memory, brain state, authority state, task queue, and the latest checkpoint, which is a direct data-exfiltration primitive in a language-model workflow. Because the data is injected as natural language into model context/output, sensitive instructions, secrets, prior user data, or internal control state can be propagated, echoed, or acted upon by later steps far beyond the original storage boundary.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The script aggregates multiple workspace files, including state and memory artifacts, into a timestamped markdown checkpoint specifically intended to be reloaded in future conversations. This creates a durable secondary store of potentially sensitive data and increases the chance of unintended disclosure, prompt-context leakage, or propagation of stale/poisoned instructions across sessions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The script copies raw contents of durable-state files into a dated markdown note, creating another persistent plaintext copy of potentially sensitive memory, authority, and task data. Even with tail truncation, this increases data exposure, retention, and discoverability because sensitive state is duplicated into human-readable workflow documents that may be indexed, read by other skills, or retained longer than the original sources.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.