three-minds Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

three-minds is an AI agent skill, created by enderfga and published at enderfga/three-minds. ClawSecure audited three-minds across 18 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 12 findings concentrate in Command Injection, Data Exfiltration and Policy Violation, including Pattern detected: from 'child_process' and Pattern detected: spawnSync(. 8 were rated high or critical severity.

Is three-minds safe?

ClawSecure audited three-minds and assigned a security score of 0/100 (High Risk), identifying 12 findings across Command Injection and Data Exfiltration. Review the findings below before installing.

What did ClawSecure find in three-minds?

ClawSecure identified 12 findings in three-minds, concentrated in Command Injection, Data Exfiltration and Policy Violation. 8 were rated high or critical severity. The most severe include Pattern detected: from 'child_process' and Pattern detected: spawnSync(.

How was three-minds audited?

ClawSecure ran three-minds through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 18 files from enderfga/three-minds.

What does a score of 0 mean?

ClawSecure assigned three-minds a security score of 0/100, placing it in the High Risk range. This is driven by 12 findings led by Command Injection that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for three-minds

ClawSecure detected 12 security findings in three-minds, spanning Command Injection, Data Exfiltration, Policy Violation and Permissions Manifest.

critical · Pattern detected: from 'child_process'. Command Injection finding detected in src/council.ts:9.
critical · Pattern detected: spawnSync(. Command Injection finding detected in src/council.ts:58.
critical · Pattern detected: spawnSync(. Command Injection finding detected in src/council.ts:79.
critical · Pattern detected: spawnSync(. Command Injection finding detected in src/council.ts:93.
high · Pattern detected: fs.writeFileSync(. Data Exfiltration finding detected in src/council.ts:359.
high · Pattern detected: fs.readFileSync(. Data Exfiltration finding detected in src/council.ts:369.
high · Pattern detected: fs.readFileSync(. Data Exfiltration finding detected in src/council.ts:373.
high · Pattern detected: fs.writeFileSync(. Data Exfiltration finding detected in src/index.ts:63.
medium · Only 82% of skill content could be analyzed. 3 of 18 files are opaque.... Policy Violation finding.
medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
info · Skill manifest does not include a 'license' field. Specifying a license.... Policy Violation finding detected in SKILL.md.
moderate · Vulnerability in uuid@9.0.0: uuid: Missing buffer bounds check in.... Supply Chain finding detected in package.json.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for three-minds

Harden command execution

three-minds constructs or runs system commands. Validate that commands are built only from trusted inputs, never pass user-controlled strings directly to a shell, and restrict execution to an allow-list of expected commands.

Audit external network connections

three-minds sends data to external endpoints. Confirm each destination is expected and authorized, and remove any callback that exfiltrates data. ClawSecure monitors for known exfiltration and C2 endpoints.

Resolve policy violations

three-minds trips ClawSecure policy checks. Review each flagged pattern against your security policy and remediate or document an accepted exception before production use.

Related Security Research

Why Generic Scanners Fail at AI Agent Security→Understanding Our 3-Layer Audit Protocol→

Related AI Agent Security Audits

awesome-openclaw-skillsScore 0/100 memUScore 0/100 understand-anythingScore 0/100 62ac696296b54aadScore 0/100 6bc837afc1a86e89Score 0/100

Scanned on May 3, 2026. three-minds is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan