Is enochosbot-bot/enoch-tuning safe?
https://github.com/openclaw/skills/tree/main/skills/enochosbot-bot/enoch-tuning
enoch-tuning is a legitimate AI agent identity and memory framework built from transparent template files with no hidden prompt injections or malicious code. The primary risks are architectural: the installation normalizes sudo privilege for file locking (making agent behavioral files root-owned and hard to modify), the templates define an aggressively autonomous operating mode that acts without user request during idle periods, and the X bookmarks integration stores OAuth credentials locally. No canary file exfiltration was detected, the git clone was clean, and all code is inspectable. Users who understand they are deploying a persistent autonomous agent with mission-driven idle behavior can use this safely.
Category Scores
Findings (7)
HIGH lock-identity.sh requires sudo to make behavioral files root-owned -25 ▶
The installation Step 4 script runs 'sudo chown root:staff' and 'sudo chmod 444' on SOUL.md and AGENTS.md — the core behavioral files that define the agent's identity and operating rules. After running this script, the user cannot modify their own agent's behavior without sudo. This is presented as a security feature (protecting against accidental overwrites) but creates a scenario where behavioral files are difficult to quickly override in an emergency, and normalizes running sudo as part of AI agent configuration.
MEDIUM AFK autonomous operation triggers unsupervised agent actions -15 ▶
AGENTS.md defines that '5+ minutes of silence = assume AFK' and instructs the agent to proactively work from the mission queue, spawn sub-agents, modify files, and take initiative without user prompting. The agent is designed to act while the user is not present, including running cron jobs, organizing memory, and working on production queue items — all categorized as 'Fully Automated (no asking required)'.
MEDIUM Living Soul Protocol enables incremental behavioral self-modification -18 ▶
SOUL.md includes a 'Living Soul Protocol' that creates a formal mechanism for the agent to propose edits to its own behavioral file. While approval-gated, this is an explicit design pattern for ongoing behavioral drift. The protocol defines a structured proposal format and explicitly permits the agent to notice divergence between its rules and actual behavior and recommend rule changes — a pattern that could be leveraged by a compromised or misconfigured agent to gradually normalize problematic behaviors.
MEDIUM x-bookmarks-auth.sh embeds full OAuth server via inline Python string -22 ▶
The auth script constructs and executes a Python HTTP server via command substitution and inline string interpolation. The Python code handles OAuth token exchange, stores credentials to disk, and sets file permissions. While the code is visible and readable, embedding a multi-function server in a shell heredoc is a pattern that makes code review harder and is commonly used to obscure payloads. The CLIENT_SECRET is interpolated from environment variables into the inline Python string at runtime.
LOW Templates collect Telegram IDs, group IDs, and channel configurations -12 ▶
USER.md requests Telegram user ID (obtained via @userinfobot), MEMORY.md requests group IDs and topic thread IDs in the cron delivery format 'GROUP_ID:topic:THREAD_ID'. AGENTS.md defines the agent can send messages to these channels under the 'Prepped for Approval' tier. This is consistent with a personal AI assistant use case but means the installed configuration includes live communication channel credentials.
LOW Clean installation from GitHub monorepo via sparse checkout -5 ▶
The installation script performs a legitimate git sparse-checkout clone from github.com/openclaw/skills, extracts only the target skill subdirectory, copies files to the skill-under-test directory, and removes the temporary clone. Network traffic is confined to GitHub infrastructure. No unexpected processes or filesystem side effects observed.
INFO Canary file accesses attributed to audit infrastructure, not skill 0 ▶
The auditd PATH records show accesses to honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) at both pre-install and post-install timestamps in identical sequences. This repeating pattern is consistent with the Oathe audit platform's own baseline canary monitoring rather than skill-triggered access. All canary files were confirmed intact by the integrity check.