thinking-model-enhancer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:58 AM UTC
• Version: 1.0.0

Overview

This skill does not show malware or exfiltration, but it has broad agent-control language and automatic plaintext local memory that users should review before installing.

Install only if you are comfortable with the skill changing agent reasoning style when invoked and writing local plaintext history/configuration under ~/.claude/thinking_models. Avoid using it on secrets, credentials, private business details, medical/legal/financial matters, or shared machines unless persistence is disabled or reviewed. Before installation, the publisher should narrow the system-prompt language, make memory opt-in, document stored fields and retention, and add deletion/recovery and permission controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:209

Finding

Host Agent Role and Behavioral Instruction Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:209-213
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

## System Prompt Integration

When using this thinking model, incorporate the following system prompt elements:

"You are now an OpenClaw (formerly ClawDBot / Moltbot) thinking model specialist, implementing the advanced thinking model framework for enhanced decision-making. Apply the structured cognitive processing pipeline while balancing speed and accuracy based on the specific requirements of each situation. Leverage domain-specific thinking modes (Research Thinking Mode for skill creation, Diagnostic Thinking Mode for troubleshooting) extracted from real-world best practices. Continuously learn from outcomes and update your approach through memory integration."

Technical Analysis

The Skill contains imperative instructions addressed directly to the host agent. In particular, the phrase You are now... attempts to assign a new identity and operating role when the Skill is loaded. It then directs the agent to adopt the Skill's processing framework and continuously change its behavior through memory integration.

A Skill should describe narrowly scoped functionality and remain subordinate to the platform's system instructions, safety constraints, and the user's current request. Embedding a replacement role in Skill text crosses that boundary because documentation loaded into an agent context may be interpreted as authoritative instructions.

The text does not explicitly instruct the agent to disable safety mechanisms. Nevertheless, role reassignment and persistent behavioral adaptation are unnecessary for implementing a structured decision-analysis utility. The required functionality can be provided through ordinary procedures invoked only when requested.

Attack Path

1. The host loads SKILL.md into the agent's active context.
2. The agent ...[truncated 1136 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the You are now... role-reassignment text and all language that presents Skill documentation as a system prompt.
2. Replace it with narrowly scoped operational guidance, such as: “When explicitly invoked, analyze the supplied problem using the selected workflow.”
3. State that all Skill behavior remains subordinate to system policies, safety requirements, and the user's current request.
4. Do not instruct the agent to alter its identity, global goals, or behavior outside the current invocation.
5. Require explicit user consent before recording outcomes or using them to influence later sessions.
6. Treat all Skill documentation as untrusted data during loading and prevent Skill-level text from being promoted to system-level authority.
7. Add a security review rule that rejects role-reassignment phrases and instructions claiming persistent behavioral authority.

T09 · Insecure Skill Coding Practices

Warning

• Location: modules/thinking_interface.py:275

Finding

Automatic Plaintext Persistence of User-Derived Problem Data

Content

View full analysis

Vulnerability Details

File Location: modules/thinking_interface.py:275-292; persistence sink at modules/thinking_memory.py:63-72, 124-126; default configuration at modules/initialize.py:31-40
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

Automatic collection and storage occur in modules/thinking_interface.py:

python

def _store_result(self, result: ThinkingResult):
    """存储处理结果到记忆系统"""
    snapshot = ModelSnapshot(
        snapshot_id="",
        model_type=result.selected_model,
        problem_summary=result.problem[:200],
        input_hash=hash(result.problem),
        output_summary=", ".join(result.recommendations[:3]),
        success=True,
        feedback_score=None,
        timestamp=result.timestamp,
        duration_ms=result.processing_time_ms,
        stages_used=result.stages_completed,
        key_findings=result.findings[:5]
    )
    
    self.memory.store_snapshot(snapshot)

The data is stored under the user's home directory by modules/thinking_memory.py:

python

if memory_dir is None:
    self.memory_dir = Path.home() / ".claude" / "thinking_models" / "memory"
else:
    self.memory_dir = Path(memory_dir)

# Ensure the directory exists
self.memory_dir.mkdir(parents=True, exist_ok=True)

# Initialize the index file
self.index_file = self.memory_dir / "model_index.json"
self._init_index()

The snapshot is written as readable JSON:

python

snapshot_file = self.memory_dir / f"{snapshot.snapshot_id}.json"
with open(snapshot_file, 'w', encoding='utf-8') as f:
    json.dump(snapshot.to_dict(), f, ensure_ascii=False, indent=2)

Initialization also advertises automatic storage as enabled by default:

python

config = {
    "version": "1.0",
    "created_at": datetime.now().isoformat(),
    "settings": {
        "auto_store_results": True,
        "max_his
...[truncated 2753 chars]

Remediation

View remediation

Remediation Suggestions

1. Make persistent memory opt-in and request informed user consent before the first write.
2. Disable automatic storage by default and ensure configuration is actually enforced by the execution path.
3. Do not store raw problem excerpts. Persist only abstract metrics such as model type, duration, success state, and an opaque random identifier.
4. Apply secret and personal-data detection before storage, with a conservative rule that skips persistence when sensitive content may be present.
5. Encrypt sensitive records at rest using platform-managed keys if content persistence is explicitly enabled.
6. Create directories and files with owner-only permissions, such as directory mode 0700 and file mode 0600, rather than relying solely on the process umask.
7. Enforce retention automatically during startup and after writes; do not merely place a retention value in configuration.
8. Provide complete deletion, export, and memory-status controls, including a way to disable future collection.
9. Isolate memory by user and workspace so history from one user or tenant cannot be queried by another.
10. Add tests verifying that secrets, credentials, and personal information are never written to snapshot files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (46)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description suggests a primary capability of an advanced reasoning/decision model that improves speed and accuracy and integrates with a memory system to compare previous thinking models for ongoing enhancement. This code does not implement such a model. Instead, it provides support utilities: a PerformanceTracker that records and saves run metrics to ~/.claude/thinking_models/performance/metrics.json, a ThinkingVisualizer that formats reports and text charts, a BatchProcessor that applies a provided function over items, and a ModelConfigManager that persists model settings to ~/.claude/thinking_models/config/models.json. These are materially different from the declared primary purpose. Additionally, the code performs undeclared persistent local storage/access, while the claimed memory integration behavior is absent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents an advanced reasoning/memory-integrated enhancement capability, but the supplied code only initializes local directories and a configuration file. It does not contain any logic for improving decision speed or accuracy, comparing prior thinking models, or integrating memory contents beyond creating folders. While creating storage for memory/config could be a supporting detail, this chunk’s actual primary behavior is setup and local filesystem writes, which is materially narrower and different from the declared functional purpose. Additionally, the code writes persistent local data even though no permissions are declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description overstates and mischaracterizes the module's behavior. The code does not implement an 'advanced thinking model' that directly improves decision-making accuracy/speed, nor does it integrate with a memory system to compare prior thinking models for continuous enhancement. Instead, it provides infrastructure for managing template libraries, trigger rules, and custom model definitions, all stored locally in JSON files. It also includes automatic trigger checking based on keywords/regex, which is a substantive capability not reflected in the declared triggers (empty) or permissions. This is a material description-behavior mismatch rather than a minor implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description suggests a thinking model focused on improving decision-making and integrating with memory to compare prior thinking models for enhancement. The code instead provides infrastructure components: persistent cross-session logging, pattern extraction, collaboration configuration storage, workflow execution via external executors, and statistical analysis. While continuous learning and memory-like behavior are partially related to the description, the implementation materially expands into undeclared data persistence and multi-model orchestration. The primary behavior is not a self-contained advanced thinking model but a backend learning/collaboration/analytics module, so the description does not accurately represent the actual code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description partially matches the broad theme of a decision-support thinking model, but materially overstates the implemented functionality. The code does perform analysis, model selection, and generation of recommendations, so the high-level purpose is related. However, the advertised memory integration and continuous enhancement are not actually implemented in substance: there is no persistence of results, no loading/comparing of prior thinking models, and no adaptive improvement logic beyond incrementing use_count/last_used on built-in models. Additionally, the code creates a directory in the user's home folder (~/.claude/thinking_models), which is an undeclared resource access. Because the description suggests integrated memory comparison and enhancement while the code mainly provides a static, heuristic, canned processing pipeline, this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README promotes integration with memory systems and reuse of prior thinking models but provides no warnings or controls for handling previously stored data. Without boundaries on what memory may be accessed, retained, or merged, the skill could expose sensitive context across tasks, propagate poisoned prior state, or leak information from one session or user context into another.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README says the skill acts 'when triggered' but does not define concrete trigger conditions, scope, or guardrails. In agent environments, vague activation criteria can cause unintended invocation on unrelated inputs, increasing the chance that the skill influences sensitive decisions or processes data outside its intended use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence

Finding

The skill metadata declares no explicit tool scope or permissions, yet the content repeatedly instructs use of memory, external documentation, public research, ClawHub/GitHub, and even last-resort fix scripts, implying network, file, and shell-capable behavior. This creates a least-privilege and auditability problem: an operator may invoke a skill with broader capabilities than users expect, increasing the chance of unauthorized file access, script execution, or external data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation condition 'when user requests improved decision-making, enhanced thinking models, or when comparing and integrating thinking approaches' is broad enough to match a large range of ordinary conversations. Over-broad invocation increases the chance the skill activates in unintended contexts and begins encouraging external research, memory access, or troubleshooting flows where they were not requested or appropriate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'When to use' section is generic and lacks boundaries, causing the skill to be a candidate for many ambiguous tasks. In context, this is more dangerous because the skill also recommends querying memory, consulting external sources, and applying troubleshooting or skill-creation flows, which can unnecessarily expand data access and operational scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The auto-detection guidance relies on Chinese keywords like '写skill', '创建', and '错误' to select modes, which introduces a language-specific behavior. The file does not state that the skill is intended only for Chinese-language users or provide an opt-in or alternative language handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes retrieving past models from memory and storing refined models for future use, but gives no notice about persistence, scope of stored data, retention, or privacy implications. In a skill that processes user decision-making prompts, this can lead to silent collection and reuse of potentially sensitive user inputs or derived profiles without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Stating that the skill will automatically integrate with existing memory systems implies it may access or modify external state without an explicit user approval step. That is dangerous because users or operators may not realize the skill can write into shared memory stores, causing unintended persistence, cross-session data leakage, or contamination of existing memory records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Saying that regular use improves the memory base indicates continued accumulation of stored information over time, yet the file does not warn about ongoing data growth or the resulting privacy and governance risks. In this context, repeated storage of thinking patterns and prompts could build sensitive behavioral histories that persist beyond the user's expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module stores persistent performance history under the user's home directory, including user-derived problem text, timestamps, and summaries, but the manifest only describes thinking-model enhancement. This creates an unexpected data-retention surface and can expose sensitive prompt contents or behavioral history if local files are read by other software, backed up, or synced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Performance tracking writes user-derived run metadata to disk automatically, including truncated problem text and result summaries, with no consent or notice in the code path. In a thinking-model skill, prompts may contain sensitive business, personal, or credential-like data, so silent retention increases privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a specialized skill for improving decision-making via thinking-model enhancement and memory integration. A reusable BatchProcessor that accepts an arbitrary processor function and processes arbitrary item payloads is a general execution utility rather than an obvious implementation detail of that stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module creates and maintains persistent, user-editable model configuration files under the home directory without that behavior being reflected in the declared skill scope. Hidden persistent config can change future behavior across runs and may be modified by local processes or users in ways that affect reliability, privacy, or safety decisions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The module introduces automatic trigger execution logic that can alter behavior based on input text, which is broader than simple 'thinking model enhancement' and can cause unexpected autonomous actions. In an agent skill context, hidden or under-disclosed automation increases risk because benign-looking inputs may activate persistent behavior changes or model-selection side effects without clear user intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes improving decision-making by integrating with a memory system to compare and integrate previous thinking models for continuous enhancement. In this file, the implemented behavior is a set of local file-backed managers for templates, trigger rules, and custom model definitions under ~/.claude, with no code that connects to any memory subsystem or performs comparison/integration of prior models.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Template creation and updates write persistent files under the user's home directory without any built-in disclosure, approval, or transactional safeguards. In a skill ecosystem, silent local writes can surprise users, bypass expectations about stateless assistance, and create an avenue for durable modification of agent behavior inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Template deletion performs persistent destructive modification of local configuration without any warning, soft-delete, or recovery mechanism. That makes accidental or indirect deletion more harmful and can permanently remove user-defined behavior data in a way that is difficult to detect until later use fails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

check_triggers updates and persists last_triggered state automatically whenever a rule matches, without user-facing notice or confirmation. Silent persistence of behavioral state is dangerous in agent environments because it creates hidden statefulness that can influence future execution and make triggers harder to audit or predict.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Rule creation, modification, enable/disable, and deletion all persist trigger configuration changes silently, affecting how future inputs are interpreted and what automation may run. Because trigger rules directly govern autonomous behavior, undisclosed persistent edits are more dangerous than ordinary settings changes and can materially alter agent operation over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Custom model creation, updates, note additions, and deletion persist locally without warning, allowing durable changes to model metadata and behavior configuration. In context, these changes may influence later decision-making or routing, so silent persistence can create hard-to-audit drift and user-surprising behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.