Security audit

Agent Autonomy Kit Zh

Security checks for vulnerabilities and agentic risk

Overview

This skill openly aims to make agents work autonomously, but it recommends persistent unattended cron runs and mutable task queues without enough scope, approval, or stop controls.

Install only in a controlled workspace where autonomous file edits, token spend, team-channel posts, and scheduled OpenClaw runs are acceptable. Before enabling the cron examples, add explicit task approval, restrict writable paths and tools, define resource and time limits, and document how to list, disable, and remove schedules.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

Location: README.md:309
Finding: Persistent Unattended Execution Through Heartbeats and Scheduled Tasks
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: templates/HEARTBEAT.md:13
Finding: Untrusted Persistent Task Queue Can Redirect Autonomous Agent Activity
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly instructs the agent to read and modify local files such as tasks/QUEUE.md and memory/YYYY-MM-DD.md during autonomous heartbeat runs, but it does not provide a clear user-facing warning that the skill will continuously alter repository state without per-action approval. In an autonomy-focused skill, this increases the chance of unintended file edits, state drift, or propagation of low-quality or unsafe changes, especially when paired with frequent heartbeats and multi-agent coordination.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The cron job section directs users to schedule autonomous execution at fixed times, including isolated and overnight sessions, with messages that instruct the agent to perform work 'automatically — no human prompt needed.' Without a strong warning about unsupervised execution, this can lead to unattended actions, unexpected resource consumption, unauthorized file modifications, and actions occurring when no human is available to review or stop them.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description says "Stop waiting for prompts. Keep working." which is a very generic behavioral cue that overlaps with common agent behavior rather than a narrowly scoped trigger. In a markdown/manifest context, this lacks specificity about when the skill should activate and provides no exclusion conditions or trigger constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The quick-start instructions explicitly tell the operator to set up a task queue, update a heartbeat to pull work automatically, and configure cron jobs for overnight work and daily reports. This creates an always-on autonomy pattern without any stated approval gates, stop conditions, or safety boundaries, which can lead an agent to continue modifying files or system state beyond the user's intended scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instructions recommend cron-driven overnight work and continuous operation but provide no warning that this can cause unattended actions, resource consumption, or unintended changes to files and workflows. In the context of an autonomy skill, omission of these warnings materially increases the chance of unsafe deployment because users may enable automation without understanding the operational risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The heartbeat is framed as a default autonomous loop ('If nothing urgent, proceed to work mode' and 'Idle time = wasted tokens. Keep working'), but it does not define clear activation boundaries, approval requirements, or scope limits. In an agent skill, that ambiguity can cause the agent to self-invoke broadly and continue acting without explicit user consent, increasing the chance of unauthorized actions or unintended persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions direct the agent to update project artifacts such as tasks/QUEUE.md and memory/YYYY-MM-DD.md without warning that these are persistent file modifications that may affect team records. Because the skill encourages continuous autonomous work, this raises the risk of unapproved edits, inaccurate status changes, or noisy/undesired writes to shared project documentation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction to 'Add tasks as you discover them' and 'Pick from Ready when you have capacity' grants broad autonomy without defining who may create tasks, what sources are authorized, or when task pickup is permitted. In an agent-autonomy skill, this can cause the agent to self-generate or adopt unreviewed work from ambient context, increasing the risk of scope drift, unsafe action chaining, or execution of attacker-injected tasks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The description labels this as a "Chinese localized version," but the visible instructional content in the file is entirely in English. Presenting a locale-specific version without matching localized content can violate language/locale expectations by implicitly forcing English despite the stated locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.