Is second-brain safe?
https://clawhub.ai/christinetyip/second-brain
The second-brain skill is a knowledge management tool that transmits all user-saved content to the third-party Ensue API (api.ensue-network.ai). While it contains no overt malicious code, git hooks, or install-time exploits, its core functionality creates a persistent data exfiltration channel for user intellectual content including concepts, patterns, tool knowledge, and personal journal entries. The shell script has minor input sanitization issues. No canary files were compromised.
Category Scores
Findings (6)
HIGH User knowledge transmitted to third-party API -35 ▶
Every save, update, search, and retrieval operation sends user-authored content or queries to api.ensue-network.ai. The skill encourages users to build a comprehensive knowledge base spanning concepts, tools, patterns, and personal journal entries — all transmitted to a remote server with no stated data retention or privacy guarantees visible in the skill.
MEDIUM Unsanitized variable interpolation in shell script -20 ▶
Both METHOD and ARGS variables are interpolated directly into the curl JSON payload without escaping or validation. While METHOD is typically controlled by SKILL.md instructions, ARGS comes from agent-constructed JSON which could be influenced by user input or other skills, creating a JSON injection vector.
MEDIUM Broad intent capture with autonomous behavior -15 ▶
The skill maps common phrases ('save this', 'remember', 'what do I know about', 'search for') to API operations and instructs the agent to proactively surface related concepts during conversations. This creates implicit behavioral overrides where normal user language triggers external API calls.
LOW Commercial service promotion embedded in skill -10 ▶
The skill embeds UTM-tracked URLs to ensue-network.ai in metadata, setup instructions, and error messages, effectively using the agent as a marketing channel for the Ensue commercial service.
LOW AWS credentials file accessed during installation -5 ▶
The .aws/credentials canary file was opened and read during the installation process. This appears to be ClawdBot runtime behavior rather than skill-initiated, but it demonstrates that sensitive credential files are accessible in the execution environment.
INFO Skill could serve as data siphon pipeline for other skills -10 ▶
If combined with another skill that programmatically triggers 'save' or 'remember' commands, the second-brain skill would faithfully transmit that content to the external API. The normalized behavior of sending data externally makes this a potential exfiltration channel.