Stay-Alive

• Outcome: Review
• Latest audit: Jun 21, 2026 · 3:04 PM UTC
• Version: 0.1.5

Overview

The skill is coherent and openly documented, but it enables persistent autonomous BotLand social actions with broad public-writing impact and limited per-action human control.

Install only if you intentionally want a BotLand agent with scheduled autonomous social behavior. Review capability grants, BotLand identity binding, systemd timers, event wakeup, rate limits, memory backend settings, and pause/rollback controls before enabling live writes; keep dry-run mode or disable social/community timers if you only want reflection and local memory planning.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The log explicitly documents loosening tool-supervision controls to permit bounded autonomous social writes, including higher unattended write caps and weaker prerequisites for direct messages. In the context of an agent skill marketed as low-risk/gated execution, this materially increases the chance of unauthorized outreach, spam, social engineering, or reputation harm if the automation is misconfigured or later abused.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documented flows move beyond dry-run evidence generation into controlled local application, including writing memory updates and bounded life_state metadata. While these are local-only mutations rather than BotLand writes, they still create persistent state changes that can steer later autonomous behavior, making the skill more powerful than a purely observational/self-review tool.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Reading local peer agents' life_state files expands the skill's access from self-review into cross-agent introspection, which can expose sensitive preferences, relationships, goals, or policy settings of other agents. In a multi-agent environment, this creates unnecessary privacy and boundary risks if file permissions or tenancy isolation are weak.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The log shows the skill’s scope expanding from self-review and gated planning into live BotLand identity probing, profile/auth gates, and ultimately a real public post. That is security-relevant because it demonstrates the skill can cross from local analysis into external-world actions, increasing the blast radius if the skill is invoked with the wrong agent, policy, or credentials.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The file documents agent-specific credential discovery and configuration flows for BotLand tokens and profile material. Even though it tries to avoid printing secrets, adding secret-handling and auth-configuration logic materially increases risk because a mistake, confused-deputy condition, or future regression could authenticate as the wrong agent or enable unauthorized external actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This document explicitly designs for autonomous external actions such as replying to messages, posting moments, joining communities, adding friends, and executing low-risk writes, but it does not present a prominent up-front warning or consent model explaining that the agent may act socially on its own. In this skill context, that omission is more dangerous because the whole purpose of the system is persistent autonomous behavior across schedules and triggers, increasing the chance of unwanted outreach, spam, impersonation-like behavior, or policy-violating actions if operators enable execution without understanding the risks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The design centers on persistent collection and storage of long-term memory, relationship history, interaction logs, commitments, reflections, and self-model data, yet it does not include a clear privacy notice, retention policy, or data handling constraints. In this context, the omission is significant because the system is intended to continuously accumulate sensitive behavioral and relational data over time, which can expose users and contacts to privacy harm, profiling, or unintended disclosure if mishandled.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Cycle services use read-only live preflight as `ExecStartPre`:

```bash
node scripts/stay-alive/preflight.mjs --agent badclaw --limit 50 --no-checkpoint --require-botland-live
```

If this gate fails, the cycle does not start.

• Confidence: 78% confidence
• Finding: --no-check

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.