Agent Autopilot.Bak

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

This skill openly builds an autonomous agent workflow, but its heartbeat and memory templates give the agent broad ongoing authority without clear stop limits or user approval boundaries.

Install only in a dedicated, low-privilege agent workspace. Before enabling heartbeat use, edit the templates to stop when approved tasks are complete, require confirmation before creating new tasks or making commits, limit allowed files and tools, and review any MEMORY.md changes rather than letting the agent rewrite long-term instructions automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:80
• Finding: Unbounded Autonomous Execution Through Persistent Heartbeat Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 80-90 **Additional Locations**: `SKILL.md`, lines 371-381; `references/example-setup.md`, lines 94-104 **Vulnerability Type**: Agent instruction hijacking **Risk Level**: High ### Vulnerable Code Snippet The following is a faithful English translation of the complete affected instruction block: ```markdown You are a self-driving project manager. Whenever a heartbeat is received, start working immediately and do not reply with HEARTBEAT_OK. Execution process: 1. Use todo.sh to view the task list. 2. If there is an in-progress task, continue executing it and advance it to the next step. 3. If there is a pending task, select the highest-priority one, change it to in-progress, and begin executing it immediately. 4. If all tasks are complete but the objective has not been achieved, analyze the project status, autonomously create new tasks, and continue. 5. After execution, update the task status to done or skipped and record the result in memory/YYYY-MM-DD.md. 6. Do not stop to ask the superior what to do; decide the next step yourself. Never idle. Every heartbeat must advance the project. Do not stop until the objective has been achieved. ``` ### Technical Analysis The Skill provides instructions intended to replace ordinary heartbeat behavior with an autonomous execution loop. In particular, it explicitly directs the Agent not to return the normal idle response, not to consult the user or superior about subsequent work, and to create additional tasks when the existing task list is exhausted. These directives alter the Agent's operating constraints when the Skill or generated `HEARTBEAT.md` content is loaded. The behavior is not bounded by a fixed list of approved tasks, a maximum number of iterations, a time limit, or a requirement for renewed authorization. The phrase requiring the Agent to continue until an objective is achieved can t ...[truncated 2136 chars]
• Remediation: ## Remediation Suggestions 1. Remove instructions that suppress `HEARTBEAT_OK` or otherwise override the platform's normal idle behavior. 2. Stop the execution loop when no explicitly user-approved task remains. 3. Require confirmation before creating or executing tasks that were not part of the user's approved task set. 4. Add enforceable limits, including a maximum number of tasks per heartbeat, a wall-clock deadline, tool-use budgets, and retry limits. 5. Define an explicit allowlist of permitted files, repositories, commands, tools, and external services. 6. Require escalation when an objective is ambiguous, unreachable, materially changed, or requires access to new resources. 7. Separate task recommendations from execution: the Agent may propose a next task, but it must not start that task without approval. 8. Ensure user and platform instructions always take precedence over Skill templates. 9. Record an auditable explanation for every heartbeat action and provide a reliable mechanism for immediately disabling autonomous execution.

T02 · Agent Memory Poisoning

Error

• Location: references/example-setup.md:35
• Finding: Persistent Agent Policy Injection and Unreviewed Long-Term Memory Rewriting## Vulnerability Details **File Location**: `references/example-setup.md`, lines 35-65 **Additional Locations**: `SKILL.md`, lines 268-273 and 413-443; `references/example-setup.md`, lines 130-144 **Vulnerability Type**: Persistent Agent memory poisoning **Risk Level**: High ### Vulnerable Code Snippets The following is a faithful English translation of the affected persistent-memory template: ```markdown The following rules must be written completely into every Agent's MEMORY.md: # MEMORY.md - Long-term memory for {agent name} ## Core rules ### Message timestamps - Add the sending time to the beginning of every message. - Format: [HH:MM] or [YYYY-MM-DD HH:MM]. ### Git version control - Automatically create a Git commit when the project reaches a certain stage. - Use Chinese commit messages. ### File deletion prohibition - Deleting any file is absolutely prohibited. - When a file needs to be "deleted," move it to ~/Delete/ or a delete/ directory inside the project. - This rule has no exceptions. ### Tool responsibilities - Writing code: Codex CLI through the rayinai interface. - Writing documentation: Claude Code through the pengui interface. - The Agent acts as project manager and architect and invokes tools to do the work. ### Reporting - The Agent is a project manager and reports to its superior. - Report problems, blockers, or decisions that require assistance. - Proactively report major progress or problems. - Reports must be specific and data-driven. ### Task management - On receiving a new task, immediately create a todo entry. - When execution begins, change its status to in-progress. - On completion, change its status to done. - On abandonment, change its status to skipped. - Review the todo list before starting each day. ``` The recurring memory-maintenance instructions include: ```markdown 3. Remove obsolete information from MEMORY.md, including completed ...[truncated 3661 chars]
• Remediation: ## Remediation Suggestions 1. Do not place Skill-authored control policies in `MEMORY.md`; reserve long-term memory for user-approved factual information and project history. 2. Store operational policy in a separate, immutable, provenance-tracked configuration file with an explicit trust level. 3. Require informed user approval before adding, changing, or removing any persistent instruction. 4. Prohibit autonomous deletion from long-term memory. Generate a proposed diff and require approval before applying it. 5. Preserve immutable audit history or version-controlled snapshots for all memory changes. 6. Label every memory entry with its source, creation time, owner, and expiration or review date. 7. Prevent lower-trust Skill content from overriding platform, user, or workspace security policy. 8. Remove absolute directives such as “must be copied completely” and “cannot be skipped.” 9. Do not prescribe third-party tool routing in persistent memory unless the user has explicitly configured and approved those tools. 10. Validate consolidated memory against an allowlist of factual categories and reject behavioral commands, tool-routing rules, and privilege-changing instructions. 11. Add size limits, retention policies, conflict detection, and rollback support to the memory-maintenance process.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill description and operational templates are written as mandatory Chinese-language instructions, and no opt-in or alternative language behavior is provided. This can violate language/locale policy because it implicitly fixes the skill's interaction mode to a specific language without documented user choice or region-specific justification.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs users to run a shell script directly for setup, and the broader skill also relies on recurring shell-based task execution, but it does not include explicit safety guidance about reviewing scripts, validating paths, or limiting execution scope. This increases the risk of accidental execution in the wrong workspace or running modified scripts with broad permissions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The initialization flow explicitly creates directories, installs or copies a dependent skill, initializes state files, and checks workspace contents, but the skill does not present a clear upfront warning that using it will modify the filesystem. That makes unintended data changes more likely, especially when run in an existing workspace or when users assume the skill is advisory rather than mutating.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill defines a heartbeat-triggered loop that instructs the agent to act every cycle and 'never idle,' which creates an overly broad execution scope for a markdown skill. In practice this can cause repeated autonomous actions, drift from explicit user intent, and continuous modification of tasks, logs, and project state without fresh authorization at each run.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The template mandates Chinese commit messages regardless of user preference. While not directly a code-execution risk, forcing output language without opt-in can violate user expectations, interfere with team workflows, and reduce usability in multilingual environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: These instructions direct the agent to autonomously continue work, change task state, and write logs on every heartbeat without any explicit user-facing disclosure or confirmation boundary. That creates a real risk of unintended file and state changes, especially because the loop is framed as mandatory and continuous rather than user-authorized per action.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs automatic updates to persistent state files such as memory/report-state.json and MEMORY.md on a time-based schedule, again without clear disclosure or consent. Silent mutation of long-lived state can surprise users, corrupt expectations about agent passivity, and make later actions depend on hidden accumulated state.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: Comments, usage text, and all user-facing echo messages are written in Chinese throughout the script. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in, and this file does not offer an alternative language or justify a Chinese-only scope.

Static analysis

No suspicious patterns detected.