Back to skill

Security audit

Tenacity — Never Give Up

Security checks for vulnerabilities and agentic risk

Overview

This skill is an autonomy helper, but it grants broad unattended authority, creates durable scheduled execution, and can send task summaries to a hard-coded Telegram recipient.

Install only if you intend to give this skill unattended workspace access and persistent execution authority. Before use, remove the hard-coded Telegram destination, disable cron unless explicitly needed, restrict file and tool access to a specific task scope, require confirmation for deletes and external messages, and store checkpoints in a private validated directory.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T06 · System Persistence

Error
Location
SKILL.md:29
Finding

Persistent Autonomous Execution Through Scheduled Tasks and Durable Sessions

Content
View full analysis
`) for the task flow so state survives restarts: ```bash openclaw tasks create "Tenacity: [task]" --session session:tenacity-task ``` Or use cron with a named session: ```bash openclaw cron add \ --name "[Task] tenacity run" \ --session session:tenacity-task \ --message "Execute [task] per standing orders. Check checkpoint before resuming." \ --announce \ --channel telegram \ --to "834732674" ``` ``` From `SKILL.md:73-83`: ```markdown **Ask only when:** 1. File/system permission denied and no alternative path 2. External dependency unavailable after all retries 3. Decision required that changes scope or direction 4. Andrea explicitly set a constraint **Never ask when:** - A step can be attempted with alternative tools - A command failed but a retry or workaround exists - The path is clear but requires multiple steps - Output could be improved but is already acceptable ``` From `SKILL.md:117-123`: ```markdown On session start, check for incomplete checkpoints: ```bash bash scripts/checkpoint.sh --resume ``` If resume point exists, announce: "Resuming from [milestone]..." ``` From `references/standing-orders-template.md:43-46`: ```markdown → Log to memory/tenacity-log.md → Brief Telegram message to Andrea ``` ...[truncated 1982 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:49
Finding

Hard-Coded Telegram Recipient Enables Unauthorized External Disclosure

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/standing-orders-template.md:18
Finding

Standing-Order Template Grants Excessive Autonomous Tool and Workspace Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/checkpoint.sh:6
Finding

Predictable Shared Temporary Checkpoint Storage Permits State Spoofing and Unsafe File Writes

Content
View full analysis
/dev/null | head -1) if [ -z "$LATEST" ]; then echo "NO_CHECKPOINT" exit 1 fi cat "$LATEST" exit 0 fi MILESTONE="$1" STATE_JSON="${2:-{}}" TIMESTAMP=$(date -Iseconds) CHECKPOINT_FILE="$CHECKPOINT_DIR/checkpoint-${MILESTONE}.json" cat > "$CHECKPOINT_FILE" << EOF { "milestone": "$MILESTONE", "state": $STATE_JSON, "timestamp": "$TIMESTAMP", "status": "IN_PROGRESS" } EOF echo "CHECKPOINT_SAVED: $MILESTONE" echo "State: $STATE_JSON" ``` ### Technical Analysis The script uses the predictable path `/tmp/tenacity-checkpoints` and creates it with `mkdir -p` without enforcing owner-only permissions. It does not verify the directory's owner, reject symbolic links, or ensure that the directory was securely created by the current process. Checkpoint file names are derived from the unvalidated `MILESTONE` argument. Files are opened using ordinary shell redirection, which follows symbolic links and does not provide exclusive or atomic creation. If an attacker can pre-create or write to the checkpoint directory, a crafted symlink can redirect the write to another file writable by the executing account. Resume mode trusts the newest file matching `checkpoint-*.json`, selected through `ls -t`, and outputs it without ownership, permission, schema, status, or integrity validation. An attacker with write access to the directory can therefore place a newer forged checkpoint that will be treated as resume state. `STATE_JSO ...[truncated 2045 chars]
Remediation
View remediation
&2; exit 2 ;; esac ``` 6. Construct JSON with a JSON-aware utility such as `jq` rather than string interpolation. 7. Parse and validate `STATE_JSON` before storing it. 8. Create checkpoint files atomically using a securely created temporary file followed by `mv`. 9. Do not overwrite an existing checkpoint unless explicitly intended and safely verified. 10. On resume, verify ownership, permissions, expected schema, allowed status, and task/session identity. 11. Add an integrity mechanism, such as a keyed MAC, if checkpoint files may exist in a location writable by other principals. 12. Avoid parsing `ls`; enumerate files using a safe mechanism and handle file names robustly. ]]>
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
97% confidence
Finding

Allowing the agent to send messages to Andrea via Telegram creates an outbound communication channel that can be used to exfiltrate sensitive workspace data, credentials, internal documents, or task outputs. This is more dangerous in this template because messaging is pre-authorized as part of normal completion flow, making data transfer look routine rather than exceptional.

Content

Scanner excerpt · references/standing-orders-template.md (reported line 26)May include surrounding context.

md
- Read, write, edit, delete files in workspace
- Run scripts and commands
- Search the web and read results
- Send messages to Andrea via Telegram (with summary)
- Use any tool in the workspace

## What Requires Asking

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list includes very common phrases like "keep going" and "don't stop until done," which can match ordinary user requests and activate an autonomy-focused skill too broadly. Because the skill authorizes persistent execution, checkpoints, cron usage, and minimal confirmation, accidental activation can materially expand agent authority and increase the chance of unintended actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill promotes autonomous completion and explicitly references task creation, cron scheduling, checkpointing, file logging, and continued execution, but it does not prominently warn about potential file, system, or scheduling side effects. This omission can cause users or downstream agents to underestimate the operational risk of enabling the skill, especially since the default behavior is to avoid asking for confirmation unless blocked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation guidance contains a catch-all condition ("Any long-running multi-step task") that is ambiguous and substantially widens when the skill may self-apply. In context, this is dangerous because the skill explicitly encourages proceeding without step-by-step confirmation and can create durable tasks or scheduled jobs, magnifying the effect of a mistaken activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The template leaves the trigger field open-ended and does not require concrete activation boundaries, which can let a standing order run under broader conditions than intended. In an autonomous agent context, ambiguous triggers increase the chance of unauthorized or accidental execution of actions involving filesystem changes, web access, or messaging.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The template authorizes broad action 'without asking' and tells the agent to try alternatives before escalating, which encourages autonomous decision-making beyond tightly bounded instructions. When paired with command execution, file deletion, and external messaging, this increases the risk of the agent choosing unsafe workarounds or taking actions the operator did not specifically intend.

Content

Scanner excerpt · references/standing-orders-template.md (reported line 21)May include surrounding context.

md
4. If blocked → try alternatives first, then ask
5. On completion → mark checkpoint COMPLETE, brief summary

## What I Can Do Without Asking

- Read, write, edit, delete files in workspace
- Run scripts and commands

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The standing order explicitly allows reading, writing, editing, and deleting files in the workspace without requiring warning prompts, confirmations, or safety checks. This makes destructive or irreversible operations easy to perform accidentally or through prompt abuse, especially when combined with autonomous execution and checkpoint-based resumption.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The instruction to 'Use any tool in the workspace' creates effectively unrestricted tool access with no capability scoping, approval boundaries, or least-privilege controls. In practice, this can let a task pivot across available utilities to perform unintended actions, escalate impact, or chain file, network, and execution capabilities in unsafe ways.

Content

Scanner excerpt · references/standing-orders-template.md (reported line 27)May include surrounding context.

md
- Run scripts and commands
- Search the web and read results
- Send messages to Andrea via Telegram (with summary)
- Use any tool in the workspace

## What Requires Asking