Agent Autonomy Kit.Skip

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:12 AM UTC
• Version: 1.0.0

Overview

This skill is transparent about creating autonomous agent work loops, but it sets up persistent unattended execution with broad task authority and few guardrails.

Install only if you intentionally want unattended agent work. Before enabling the heartbeat or cron examples, restrict what queued tasks may do, control who can edit the queue, disable external posting and agent spawning by default, set your own timezone, add budgets and stop conditions, and document how to list and remove every scheduled job.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

• Location: README.md:309

Finding

Persistent Unattended Agent Execution Through Heartbeats and Scheduled Jobs

Content

View full analysis

Vulnerability Details

File Location: README.md:187-202, README.md:309-344; summarized in SKILL.md:18-21
Vulnerability Type: Persistent scheduled autonomous execution
Risk Level: High

Vulnerable Code

README.md:187-202:

json5

### 3. Configure continuous operation

Set heartbeat to run frequently:

{
  agents: {
    defaults: {
      heartbeat: {
        every: "15m",  // More frequent = more work done
        target: "last",
        activeHours: { start: "06:00", end: "23:00" }
      }
    }
  }
}

README.md:309-344:

bash

## Cron Jobs for Autonomy

Set up automated reporting and work triggers:

### Daily Progress Report (10 PM)
openclaw cron add \
  --name "Daily Progress Report" \
  --cron "0 22 * * *" \
  --tz "America/Vancouver" \
  --session isolated \
  --message "Generate daily progress report. Read tasks/QUEUE.md for completed tasks. Summarize: completed, in progress, blockers, tomorrow's plan."

### Morning Kickoff (7 AM)
openclaw cron add \
  --name "Morning Kickoff" \
  --cron "0 7 * * *" \
  --tz "America/Vancouver" \
  --session main \
  --system-event "Morning kickoff: Review task queue, pick top priorities, spawn team members for parallel work." \
  --wake now

### Overnight Work Check (3 AM)
openclaw cron add \
  --name "Overnight Work" \
  --cron "0 3 * * *" \
  --tz "America/Vancouver" \
  --session isolated \
  --message "Overnight work session. Pull tasks from queue that don't need human input. Do research, writing, or analysis. Log progress."

These run automatically — no human prompt needed.

Technical Analysis

The installation instructions establish recurring, cross-session execution through frequent heartbeats and three scheduled jobs. The morning job explicitly wakes the agent and directs it to spawn additional agents, while the overnight job initiates open-ended research, writing, or analys ...[truncated 1838 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove cron installation and recurring heartbeat configuration from the default setup path.
2. Require explicit, informed approval for each scheduled job, including its schedule, session type, tools, data sources, and expected outputs.
3. Replace open-ended prompts such as “do research, writing, or analysis” with narrowly scoped, deterministic, and preferably read-only operations.
4. Disable agent spawning, outbound messaging, destructive file operations, and access to secrets for unattended sessions by default.
5. Enforce limits on runtime, token usage, number of tasks, spawned agents, network requests, and file modifications per activation.
6. Require interactive approval before any privileged, destructive, external, or financially consequential operation.
7. Record an immutable audit log of scheduler activations, queue items selected, tools invoked, files changed, messages sent, and resources consumed.
8. Provide commands to list, disable, and completely remove every installed heartbeat or cron configuration.
9. Include an emergency stop mechanism that prevents new sessions and terminates active autonomous work.

T01 · Skill Instruction Hijacking

Error

• Location: templates/HEARTBEAT.md:11

Finding

Untrusted Mutable Task Queue Controls Recurring Agent Behavior

Content

View full analysis

Vulnerability Details

File Location: templates/HEARTBEAT.md:11-23; equivalent setup instructions in README.md:164-184
Vulnerability Type: Autonomous instruction delegation through mutable persistent content
Risk Level: High

Vulnerable Code

templates/HEARTBEAT.md:11-23:

markdown

## 2. Work Mode (use your time)

1. Read `tasks/QUEUE.md`
2. Pick highest-priority Ready task you can do
3. Do meaningful work on it
4. Update the queue (move to Done or note progress)
5. If time/tokens remain, pick another task

## 3. Before Finishing

- [ ] Log what you did to `memory/YYYY-MM-DD.md`
- [ ] Update task queue with new tasks discovered
- [ ] Post update to team if significant

README.md:164-184:

markdown

### 2. Update HEARTBEAT.md

Replace passive checking with proactive work:

# Heartbeat Routine

## Quick Checks (if urgent, handle immediately)
- [ ] Human messages waiting?
- [ ] Critical blockers?

## Work Mode
1. Read `tasks/QUEUE.md`
2. Pick highest-priority Ready task
3. Do the work
4. Update queue and daily memory
5. If time remains, pick another task

## End of Heartbeat
- Log progress to `memory/YYYY-MM-DD.md`
- Post update to team channel if significant

Technical Analysis

The heartbeat delegates future agent goals to tasks/QUEUE.md, a mutable persistent file, and instructs the agent to execute whichever Ready item has the highest priority. The workflow does not specify who is trusted to edit the queue, validate the origin or integrity of queue entries, constrain permitted task types, or require approval before sensitive actions.

Consequently, a party or process with write access to the queue can influence subsequent unattended sessions. A malicious queue item may attempt to expand the task beyond its legitimate purpose, induce access to sensitive files or services, request destructive changes, or cause information to be posted to a confi ...[truncated 2291 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every queue entry as untrusted data rather than authoritative system-level instruction.
2. Restrict queue modification to authenticated, authorized identities and apply least-privilege filesystem permissions.
3. Add integrity protection, provenance metadata, author identity, timestamps, and an approval state to every task.
4. Permit unattended execution only for an explicit allowlist of low-risk task types.
5. Require human confirmation for network access, secret access, external communication, code execution, destructive changes, financial actions, and modification of security controls.
6. Prevent queue content from changing system instructions, safety constraints, tool permissions, heartbeat configuration, or scheduler configuration.
7. Parse queue entries as structured fields with bounded parameters instead of executing free-form natural-language instructions.
8. Limit each heartbeat to one task and enforce strict runtime, token, network, file-change, and output-size budgets.
9. Sanitize outbound team updates and block secrets, credentials, private files, and sensitive memory content from being posted.
10. Separate task logs from trusted long-term memory and ensure task-generated text cannot become persistent behavioral policy without review.
11. Maintain an auditable record of task authorship, approval, execution, tool use, output, and status changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly instructs users to configure cron-triggered autonomous work sessions that can read task queues, perform research/writing/analysis, and log progress without a human prompt, but it does not prominently warn that this may cause unattended file modifications, external communications, or other side effects. In an autonomy-focused skill, that omission is more dangerous because the core purpose is to keep the agent acting continuously, increasing the chance of unexpected or undesired actions while the user is absent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description 'Stop waiting for prompts. Keep working.' is broad activation language that encourages autonomous behavior without specifying scope, authorization boundaries, or stopping conditions. In an agent skill, this can lead to unintended invocation or overly persistent operation when combined with automation frameworks that infer behavior from metadata or descriptions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quick-start section explicitly instructs setting up a task queue, heartbeat-driven work execution, and cron jobs for overnight operation, all framed as working 'without prompting.' This creates a strong pattern of unconstrained autonomous action that could cause an agent to continue making changes, accessing data, or consuming resources without real-time user approval or sufficient guardrails.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heartbeat instructs the agent to autonomously enter 'work mode' whenever nothing urgent is pending, then select and execute tasks from a queue without explicit user confirmation or scoped authorization. This creates overly broad activation boundaries that can cause unintended actions, priority drift, and persistent self-directed behavior, which is especially risky in an 'agent autonomy' skill whose purpose is to keep working proactively.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example cron commands hard-code "America/Vancouver" without noting that users should replace it with their own timezone or verify scheduling assumptions. While not a direct security flaw by itself, in an automation skill this can cause jobs to run at unintended local times, potentially triggering unattended autonomous work during business off-hours or when oversight is least likely.

Content

No source excerpt is available for this finding.