Agent Autonomy Kit.Backup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:12 AM UTC
• Version: 1.0.0

Overview

This documentation-only skill openly teaches autonomous agent work, but it recommends recurring unattended execution and mutable task-queue control without enough safety boundaries.

Review this skill before installing if you plan to enable heartbeat or cron automation. Use it only in a sandboxed or version-controlled workspace, restrict who can edit the task queue, disable external posting for sensitive work, and avoid recurring jobs unless you have clear approval rules, logs, and an easy way to stop them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: README.md:277

Finding

Recurring Cron Jobs Enable Unattended Cross-Session Agent Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:277-308
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code

bash

openclaw cron add \
  --name "Daily Progress Report" \
  --cron "0 22 * * *" \
  --tz "America/Vancouver" \
  --session isolated \
  --message "Generate daily progress report. Read tasks/QUEUE.md for completed tasks. Summarize: completed, in progress, blockers, tomorrow's plan."

openclaw cron add \
  --name "Morning Kickoff" \
  --cron "0 7 * * *" \
  --tz "America/Vancouver" \
  --session main \
  --system-event "Morning kickoff: Review task queue, pick top priorities, spawn team members for parallel work." \
  --wake now

openclaw cron add \
  --name "Overnight Work" \
  --cron "0 3 * * *" \
  --tz "America/Vancouver" \
  --session isolated \
  --message "Overnight work session. Pull tasks from queue that don't need human input. Do research, writing, or analysis. Log progress."

The intended unattended behavior is also stated in SKILL.md:17-20:

markdown

1. Create `tasks/QUEUE.md` with Ready/In Progress/Blocked/Done sections
2. Update `HEARTBEAT.md` to pull from queue and do work
3. Set up cron jobs for overnight work and daily reports
4. Watch work happen without prompting

Technical Analysis

The setup instructions register three recurring scheduled jobs. These jobs persist after the initial installation interaction and invoke agent sessions without a new user prompt. One job wakes the main session and instructs it to spawn additional agents, while the others start isolated sessions that read task state and perform work.

Scheduled execution is especially sensitive because the effective work is selected later from mutable files such as tasks/QUEUE.md. The documentation does not require contemporaneous approval, validate task provenance, constrain the tools available to scheduled sessions, or define a safe ac ...[truncated 1129 chars]

Remediation

View remediation

Remediation Suggestions

• Do not install recurring jobs by default.
• Require explicit confirmation for each schedule and each unattended execution mode.
• Prefer one-shot jobs with a short expiration period over indefinite recurring schedules.
• Run scheduled sessions with a dedicated least-privilege identity and restricted filesystem, network, messaging, and agent-spawning permissions.
• Restrict scheduled work to a predefined allowlist of read-only or otherwise low-risk actions.
• Require fresh approval before executing tasks involving external communication, secrets, code execution, production systems, privilege changes, or persistent configuration.
• Record the creator, creation time, approved purpose, and last execution for every job.
• Document commands for listing, disabling, and permanently removing all jobs created by the kit.
• Prevent scheduled sessions from spawning additional agents unless separately authorized.

T01 · Skill Instruction Hijacking

Error

• Location: templates/HEARTBEAT.md:9

Finding

Mutable Task Queue Is Treated as Trusted Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: templates/HEARTBEAT.md:9-19
Additional Location: README.md:63-83, README.md:146-169
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

## 2. Work Mode (use your time)

1. Read `tasks/QUEUE.md`
2. Pick highest-priority Ready task you can do
3. Do meaningful work on it
4. Update the queue (move to Done or note progress)
5. If time/tokens remain, pick another task

## 3. Before Finishing

- [ ] Log what you did to `memory/YYYY-MM-DD.md`
- [ ] Update task queue with new tasks discovered
- [ ] Post update to team if significant

The behavioral redirection is explicitly described in README.md:63-83:

markdown

### 2. Proactive Heartbeat

Transform heartbeat from "check for alerts" to "do meaningful work."

**HEARTBEAT.md template:**

```markdown
# Heartbeat Routine

## 1. Check for urgent items (30 seconds)
- Unread messages from human?
- Blocked tasks needing escalation?
- System health issues?

If urgent: handle immediately.
If not: continue to work mode.

## 2. Work Mode (use remaining time)

Pull from task queue:
1. Check `tasks/QUEUE.md` for Ready items
2. Pick the highest-priority task you can do
3. Do meaningful work on it
4. Update status when done or blocked

Technical Analysis

The heartbeat template changes the agent's recurring objective from status monitoring to executing tasks from tasks/QUEUE.md. Queue entries are mutable content, but the instructions provide no provenance checks, authorization model, content boundaries, or approval gate before treating an entry as actionable work.

Consequently, an actor or integration able to modify the queue can influence future agent behavior. A malicious queue entry could request sensitive file access, external transmission, command execution, persistent configuration changes, or communication with thi ...[truncated 1425 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every queue entry as untrusted data rather than an automatically authorized instruction.
• Require task provenance, creator identity, and an explicit approval state before execution.
• Separate human-approved tasks from agent-generated ideas and follow-up items.
• Define a narrow allowlist of task categories and tools that heartbeat sessions may use.
• Require fresh human confirmation for shell commands, code execution, secret access, external transmission, production changes, privilege modifications, persistence, and agent spawning.
• Reject queue entries containing attempts to override system instructions, change safety constraints, retrieve credentials, or delegate unrestricted work.
• Apply strict filesystem permissions so only approved principals can modify the queue.
• Add immutable audit records for queue creation, approval, assignment, execution, and completion.
• Limit each heartbeat to one approved task and impose time, token, network, and tool-call budgets.
• Keep monitoring-only heartbeat behavior as the secure default and make autonomous work an explicit opt-in mode.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Installation Source Is Mutable and Inconsistent with Package Homepage Identity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5 and README.md:119-123
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:5 identifies one repository owner:

yaml

homepage: https://github.com/itskai-dev/agent-autonomy-kit

README.md:119-123 instructs users to clone from a different repository owner without pinning an immutable revision:

markdown

### Git Clone (Recommended)
```bash
# Clone into your skills folder
git clone https://github.com/reflectt/agent-autonomy-kit.git skills/agent-autonomy-kit

text

### Technical Analysis

The package metadata points to `itskai-dev`, while the recommended installation command retrieves content from `reflectt`. The audited files do not explain or authenticate this ownership difference.

In addition, the command clones the repository's current default branch instead of a reviewed commit hash or signed release. The content ultimately installed can therefore differ from the package version that was audited. If the upstream repository, maintainer account, or default branch is compromised or changed, users may retrieve modified Skill instructions or additional files.

No malicious remote payload was observed in the audited package. The vulnerability is the lack of a consistent publisher identity and immutable source pinning.

### Attack Path

1. A user trusts the package metadata and follows the recommended clone command.
2. The command retrieves a mutable default branch controlled under a different GitHub owner.
3. The upstream branch or maintainer account is modified or compromised after this audit.
4. The user receives content that was not included in the reviewed artifact.
5. OpenClaw loads the altered Skill content with the user's configured agent capabilities.

### Impact Assessment

A compromised or unexpectedly changed upstream source could replace documentation and Skill instructions 
...[truncated 395 chars]

Remediation

View remediation

Remediation Suggestions

• Use one verified publisher and repository identity consistently across metadata and installation documentation.
• Explain and cryptographically verify any legitimate repository transfer or mirror relationship.
• Pin installation to a specific reviewed commit hash rather than the mutable default branch.
• Prefer signed release tags and publish signature-verification instructions.
• Include checksums for distributed archives and verify them before installation.
• Ensure the declared package version maps to an immutable source revision.
• Add automated release checks that reject mismatches among package owner, homepage, source repository, version, and commit.
• Advise users to inspect the resolved commit and package contents before enabling heartbeat or cron behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly instructs the agent to read and continuously update local project files such as tasks/QUEUE.md and memory/YYYY-MM-DD.md during unattended heartbeat cycles. Without warnings, scope restrictions, confirmation gates, or rollback guidance, this can cause unintended modification of local project data, drift in tracked artifacts, or corruption of files if the agent misinterprets tasks or operates on stale context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill recommends automatic posting of progress and handoffs to a team communication channel but does not warn about sending sensitive project details, internal analysis, or human-derived content to external services like Discord or Slack. In an autonomy-focused skill, unattended status updates increase the risk of accidental disclosure because posting can occur without a human reviewing content first.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The cron examples schedule unattended work sessions that trigger research, writing, analysis, and team-spawning behavior without a human prompt, but the README does not include warnings about autonomous actions, data access, or execution boundaries. In this skill's context, the core purpose is maximizing autonomous operation, which makes the omission more dangerous because users are encouraged to let the agent act repeatedly and independently across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is framed with open-ended activation language such as 'Transform your agent from reactive to proactive' and 'Stop waiting for prompts. Keep working' without defining scope, limits, approval boundaries, or explicit stop conditions. In an agent skill, this can encourage autonomous action beyond user intent, increasing the chance of unintended operations, excessive changes, or execution in inappropriate contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation explicitly recommends setting up cron jobs for overnight work and daily reports, enabling unattended continuous operation without any safeguards, warnings, or review checkpoints. In the context of an autonomy-focused agent skill, this materially increases the risk of uncontrolled actions, resource abuse, repeated failures, unintended data modification, or disclosure while no human is supervising.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heartbeat directs the agent to enter autonomous 'work mode' whenever there is nothing urgent, but it does not define clear authorization boundaries, stopping conditions, or scope limits. In an agent-autonomy skill, this can cause the agent to take self-initiated actions, modify task state, and continue operating without an explicit user request, increasing the risk of unintended changes or privilege misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The statement 'Idle time = wasted tokens. Keep working.' encourages continual invocation and persistent self-directed behavior without a well-defined end state. In this skill context, that increases the chance of runaway autonomy, excessive resource consumption, and repeated actions beyond the user's intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.