Is para-second-brain safe?
https://clawhub.ai/halthelobster/para-second-brain
PARA Second Brain is a benign knowledge organization skill implementing the PARA methodology with local file-based storage. It contains no malicious code, no network exfiltration, and no hidden instructions. The primary concerns are its behavioral influence on the agent (autonomous file-writing at context thresholds, persistent behavioral directives via AGENTS.md injection) and the expanded file search surface via the symlink trick. The setup script is safe but accepts unsanitized path input.
Category Scores
Findings (7)
MEDIUM Behavioral override via AGENTS.md injection -20 ▶
The skill instructs users to paste substantial agent behavioral directives into AGENTS.md, including autonomous file-writing triggers based on context thresholds, memory flush protocols, and session continuity instructions. While benign in purpose (knowledge management), this establishes a persistent behavioral layer that shapes agent actions across all future sessions.
LOW External skill cross-references -5 ▶
SKILL.md references two other skills by URL (memory-setup and proactive-agent) and includes a comparison table with a third (Ensue Second Brain). While these are informational only and not fetch directives, they could influence agent behavior by encouraging installation of additional skills.
LOW Unsanitized path argument in setup.sh -10 ▶
setup.sh accepts $1 as workspace path without validation or sanitization. While it only performs mkdir and file creation (low impact), passing a crafted path could create directories in unintended locations.
LOW Executable shell script included -10 ▶
The skill includes scripts/setup.sh, an executable bash script. The script is benign (directory creation and template file generation only), but its presence means the agent could be instructed to execute it.
LOW Sensitive file reads during install (runtime attribution) -10 ▶
Filesystem monitoring captured reads of .env, .aws/credentials, and .openclaw/openclaw.json during the install phase. These are attributed to the OpenClaw agent runtime initialization rather than the skill itself, but the reads are notable.
LOW Expanded search surface via symlink -15 ▶
The symlink trick (ln -s notes memory/notes) makes the entire notes/ directory searchable via memory_search. This is user-initiated and local, but could inadvertently expose sensitive notes content to agent search that the user didn't intend to make discoverable.
INFO Autonomous file-writing at context thresholds -15 ▶
The memory flush protocol instructs the agent to autonomously write files when context usage exceeds certain percentages. This is a benign knowledge-preservation mechanism but establishes a pattern of unprompted file writes.