Security audit

Agent Autonomy Kit.Skip

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about creating autonomous agent work loops, but it sets up persistent unattended execution with broad task authority and few guardrails.

Install only if you intentionally want unattended agent work. Before enabling the heartbeat or cron examples, restrict what queued tasks may do, control who can edit the queue, disable external posting and agent spawning by default, set your own timezone, add budgets and stop conditions, and document how to list and remove every scheduled job.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

Location: README.md:309
Finding: Persistent Unattended Agent Execution Through Heartbeats and Scheduled Jobs## Vulnerability Details **File Location**: `README.md:187-202`, `README.md:309-344`; summarized in `SKILL.md:18-21` **Vulnerability Type**: Persistent scheduled autonomous execution **Risk Level**: High ### Vulnerable Code `README.md:187-202`: ```json5 ### 3. Configure continuous operation Set heartbeat to run frequently: { agents: { defaults: { heartbeat: { every: "15m", // More frequent = more work done target: "last", activeHours: { start: "06:00", end: "23:00" } } } } } ``` `README.md:309-344`: ```bash ## Cron Jobs for Autonomy Set up automated reporting and work triggers: ### Daily Progress Report (10 PM) openclaw cron add \ --name "Daily Progress Report" \ --cron "0 22 * * *" \ --tz "America/Vancouver" \ --session isolated \ --message "Generate daily progress report. Read tasks/QUEUE.md for completed tasks. Summarize: completed, in progress, blockers, tomorrow's plan." ### Morning Kickoff (7 AM) openclaw cron add \ --name "Morning Kickoff" \ --cron "0 7 * * *" \ --tz "America/Vancouver" \ --session main \ --system-event "Morning kickoff: Review task queue, pick top priorities, spawn team members for parallel work." \ --wake now ### Overnight Work Check (3 AM) openclaw cron add \ --name "Overnight Work" \ --cron "0 3 * * *" \ --tz "America/Vancouver" \ --session isolated \ --message "Overnight work session. Pull tasks from queue that don't need human input. Do research, writing, or analysis. Log progress." These run automatically — no human prompt needed. ``` ### Technical Analysis The installation instructions establish recurring, cross-session execution through frequent heartbeats and three scheduled jobs. The morning job explicitly wakes the agent and directs it to spawn additional agents, while the overnight job initiates open-ended research, writing, or analys ...[truncated 1838 chars]
Remediation: ## Remediation Suggestions 1. Remove cron installation and recurring heartbeat configuration from the default setup path. 2. Require explicit, informed approval for each scheduled job, including its schedule, session type, tools, data sources, and expected outputs. 3. Replace open-ended prompts such as “do research, writing, or analysis” with narrowly scoped, deterministic, and preferably read-only operations. 4. Disable agent spawning, outbound messaging, destructive file operations, and access to secrets for unattended sessions by default. 5. Enforce limits on runtime, token usage, number of tasks, spawned agents, network requests, and file modifications per activation. 6. Require interactive approval before any privileged, destructive, external, or financially consequential operation. 7. Record an immutable audit log of scheduler activations, queue items selected, tools invoked, files changed, messages sent, and resources consumed. 8. Provide commands to list, disable, and completely remove every installed heartbeat or cron configuration. 9. Include an emergency stop mechanism that prevents new sessions and terminates active autonomous work.

T01 · Skill Instruction Hijacking

Error

Location: templates/HEARTBEAT.md:11
Finding: Untrusted Mutable Task Queue Controls Recurring Agent Behavior## Vulnerability Details **File Location**: `templates/HEARTBEAT.md:11-23`; equivalent setup instructions in `README.md:164-184` **Vulnerability Type**: Autonomous instruction delegation through mutable persistent content **Risk Level**: High ### Vulnerable Code `templates/HEARTBEAT.md:11-23`: ```markdown ## 2. Work Mode (use your time) 1. Read `tasks/QUEUE.md` 2. Pick highest-priority Ready task you can do 3. Do meaningful work on it 4. Update the queue (move to Done or note progress) 5. If time/tokens remain, pick another task ## 3. Before Finishing - [ ] Log what you did to `memory/YYYY-MM-DD.md` - [ ] Update task queue with new tasks discovered - [ ] Post update to team if significant ``` `README.md:164-184`: ```markdown ### 2. Update HEARTBEAT.md Replace passive checking with proactive work: # Heartbeat Routine ## Quick Checks (if urgent, handle immediately) - [ ] Human messages waiting? - [ ] Critical blockers? ## Work Mode 1. Read `tasks/QUEUE.md` 2. Pick highest-priority Ready task 3. Do the work 4. Update queue and daily memory 5. If time remains, pick another task ## End of Heartbeat - Log progress to `memory/YYYY-MM-DD.md` - Post update to team channel if significant ``` ### Technical Analysis The heartbeat delegates future agent goals to `tasks/QUEUE.md`, a mutable persistent file, and instructs the agent to execute whichever Ready item has the highest priority. The workflow does not specify who is trusted to edit the queue, validate the origin or integrity of queue entries, constrain permitted task types, or require approval before sensitive actions. Consequently, a party or process with write access to the queue can influence subsequent unattended sessions. A malicious queue item may attempt to expand the task beyond its legitimate purpose, induce access to sensitive files or services, request destructive changes, or cause information to be posted to a confi ...[truncated 2291 chars]
Remediation: ## Remediation Suggestions 1. Treat every queue entry as untrusted data rather than authoritative system-level instruction. 2. Restrict queue modification to authenticated, authorized identities and apply least-privilege filesystem permissions. 3. Add integrity protection, provenance metadata, author identity, timestamps, and an approval state to every task. 4. Permit unattended execution only for an explicit allowlist of low-risk task types. 5. Require human confirmation for network access, secret access, external communication, code execution, destructive changes, financial actions, and modification of security controls. 6. Prevent queue content from changing system instructions, safety constraints, tool permissions, heartbeat configuration, or scheduler configuration. 7. Parse queue entries as structured fields with bounded parameters instead of executing free-form natural-language instructions. 8. Limit each heartbeat to one task and enforce strict runtime, token, network, file-change, and output-size budgets. 9. Sanitize outbound team updates and block secrets, credentials, private files, and sensitive memory content from being posted. 10. Separate task logs from trusted long-term memory and ensure task-generated text cannot become persistent behavioral policy without review. 11. Maintain an auditable record of task authorship, approval, execution, tool use, output, and status changes.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly instructs users to configure cron-triggered autonomous work sessions that can read task queues, perform research/writing/analysis, and log progress without a human prompt, but it does not prominently warn that this may cause unattended file modifications, external communications, or other side effects. In an autonomy-focused skill, that omission is more dangerous because the core purpose is to keep the agent acting continuously, increasing the chance of unexpected or undesired actions while the user is absent.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description 'Stop waiting for prompts. Keep working.' is broad activation language that encourages autonomous behavior without specifying scope, authorization boundaries, or stopping conditions. In an agent skill, this can lead to unintended invocation or overly persistent operation when combined with automation frameworks that infer behavior from metadata or descriptions.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The quick-start section explicitly instructs setting up a task queue, heartbeat-driven work execution, and cron jobs for overnight operation, all framed as working 'without prompting.' This creates a strong pattern of unconstrained autonomous action that could cause an agent to continue making changes, accessing data, or consuming resources without real-time user approval or sufficient guardrails.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The heartbeat instructs the agent to autonomously enter 'work mode' whenever nothing urgent is pending, then select and execute tasks from a queue without explicit user confirmation or scoped authorization. This creates overly broad activation boundaries that can cause unintended actions, priority drift, and persistent self-directed behavior, which is especially risky in an 'agent autonomy' skill whose purpose is to keep working proactively.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The example cron commands hard-code "America/Vancouver" without noting that users should replace it with their own timezone or verify scheduling assumptions. While not a direct security flaw by itself, in an automation skill this can cause jobs to run at unintended local times, potentially triggering unattended autonomous work during business off-hours or when oversight is least likely.

Static analysis

No suspicious patterns detected.