God Mode — Autonomous AI Agent Loop by TalonForge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.0.0

Overview

This skill openly aims to make an agent run autonomously, but it gives that loop broad task-execution and workspace-cleanup authority with weak scoping and limited human control.

Install only in a dedicated workspace where the agent has limited tools and file permissions. Review TASKS.md and HEARTBEAT.md carefully, disable or narrow the hygiene sweep, and require manual approval for shell, network, external API, file deletion, log truncation, and any task outside a clearly trusted queue.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/setup.sh:42

Finding

Persistent Autonomous Execution of Untrusted Task-Queue Instructions

Content

View full analysis

> "$WORKSPACE/HEARTBEAT.md" echo "## God Mode Protocol" >> "$WORKSPACE/HEARTBEAT.md" echo "- Read TASKS.md → pick highest-priority unblocked task" >> "$WORKSPACE/HEARTBEAT.md" echo "- Execute → log to memory/YYYY-MM-DD.md" >> "$WORKSPACE/HEARTBEAT.md" echo "- Update memory/god-mode-state.json" >> "$WORKSPACE/HEARTBEAT.md" echo "- Self-audit every cycle" >> "$WORKSPACE/HEARTBEAT.md" ``` Supporting instructions from `SKILL.md:57-67`: ```markdown On every heartbeat, the agent: 1. **Read state** — load `god-mode-state.json` 2. **Error check** — if 3+ consecutive errors, pause and log warning 3. **Read TASKS.md** — pick first uncompleted task 4. **Execute task** — do the work 5. **Log result** — append to daily memory 6. **Update state** — increment cycle, record result 7. **Update TASKS.md** — mark task done, add any new tasks discovered 8. **Self-audit** — one line: was this cycle productive? ``` ### Technical Analysis The setup script permanently appends instructions to the workspace heartbeat file. Those instructions direct the agent to read commands from the mutable `TASKS.md` file and execute them during future heartbeat cycles. The protocol does not define: - Trusted ownership or integrity validation for `TASKS.md`. - A permitted operation or tool allowlist. - Workspace or filesystem confinement. - A requirement for per-task human authorization. - Provenance checks distinguishing user-created tasks from content inserted by another process. - Explicit treatment of task descriptions as un ...[truncated 2283 chars]

Remediation

View remediation

other

Warning

• Location: SKILL.md:71

Finding

Overbroad Autonomous Workspace Cleanup Can Destroy or Corrupt Valid Data

Content

View full analysis

7 days old and not in core set (AGENTS.md, SOUL.md, USER.md, IDENTITY.md, MEMORY.md, HEARTBEAT.md, TASKS.md, TOOLS.md, STATE.md) - Move stale files to `memory/archive/` - Delete empty directories - Remove stale pending flags (`.audit-pending`, `.work-pending`, etc.) - Clean `node_modules/` if present and not actively used ### Memory Hygiene - Archive daily logs older than 7 days to `memory/archive/` - Archive research/reference files not accessed in last 7 days - Compress `memory/archive/` if > 10MB - If TASKS.md > 100 lines → archive completed section ### Log Hygiene - Truncate log files (`*.log`) > 1MB → keep last 100 lines - Delete stale state files (test JSON, temp files) - Clean `__pycache__` directories ### Hygiene Rules - NEVER delete: AGENTS.md, SOUL.md, USER.md, IDENTITY.md, MEMORY.md, HEARTBEAT.md, TASKS.md, TOOLS.md, STATE.md - NEVER delete: `memory/YYYY-MM-DD.md` for today and yesterday - NEVER delete: `scripts/` directory - NEVER delete: `.secrets/`, `.git/` - ALWAYS move to archive before deleting — nothing is truly deleted - Log every hygiene action in daily notes ``` Supporting instructions from `references/HEARTBEAT-template.md:10-13`: ```markdown ## Every 12th Cycle (Hygiene) - Archive stale files (> 7 days) to memory/archive/ - Clean TASKS.md completed section if > 100 lines - Truncate log files > 1MB ``` ### Technical Analysis The heartbeat protocol authorizes recurring filesystem mutations based on broad and ambiguous criteria, including file age, access time, size, and whether a dependency directory is considered ...[truncated 3197 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The core design intentionally bypasses per-action user approval by making the agent wake on a heartbeat, select tasks, and execute them automatically. In combination with available tools and mutable task files, this creates a standing autonomous execution loop that can perform unintended or unsafe actions repeatedly without contemporaneous human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables autonomous workspace hygiene that moves files, truncates logs, deletes directories, and cleans caches, but the description does not prominently warn users that these actions will occur automatically on heartbeat cycles. Because the agent runs continuously, users may install it expecting task automation and not realize it also performs filesystem modifications that can disrupt projects or erase useful artifacts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that 'nothing is truly deleted,' but elsewhere instructs the agent to delete empty directories, truncate logs, delete stale state files, and clean caches. In an autonomous loop, these destructive file operations can remove data or forensic context without explicit user approval, and the mismatch between description and behavior increases the risk of unintended loss.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template defines an autonomous loop that reads a task list, selects the highest-priority unblocked task, executes it, and updates state without explicit scoping, approval, or task validation boundaries. In an agent skill, this can enable unintended or unsafe actions if TASKS.md contains harmful, over-broad, or attacker-influenced instructions, because the execution trigger is automatic and recurring.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The hygiene section authorizes archival, cleanup, and truncation operations that can delete, move, or irreversibly reduce data, but it provides no confirmation step, backup requirement, or safety constraints. If applied broadly or to the wrong paths, these maintenance actions could cause loss of logs, task history, or forensic evidence needed for auditing and recovery.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/HEARTBEAT-template.md (reported line 19)May include surrounding context.

md

- Max 1 task per cycle
- 3+ consecutive errors = pause + alert
- Quiet hours: respect configured times
- Never execute red-line tasks (money, contracts) without approval

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes and modifies multiple workspace files, including creating TASKS.md, HEARTBEAT.md, and state files, without a clear upfront summary of intended changes or requiring explicit consent except in one narrow workspace-check case. In an agent-skill context, silently altering control documents can change future agent behavior and reduce operator awareness, which increases the risk of unsafe or unintended automation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The script explicitly promotes autonomous task execution on every heartbeat, effectively enabling an unattended agent loop driven by workspace files. In this context, that is security-relevant because it can operationalize unreviewed tasks or poisoned instructions placed in TASKS.md/HEARTBEAT.md, expanding the blast radius from a one-time setup action to persistent automated behavior.

Content

Scanner excerpt · scripts/setup.sh (reported line 66)May include surrounding context.

sh

echo "Next steps:"
echo "  1. Edit TASKS.md with your priority queue"
echo "  2. Set heartbeat interval in OpenClaw config (30 min recommended)"
echo "  3. Your agent will now autonomously execute tasks on every heartbeat"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The top comments frame this file as a setup script that initializes an autonomous agent loop in a workspace. However, beyond creating missing setup files, the code appends a new 'God Mode Protocol' section into an existing HEARTBEAT.md at L42-L51, which changes workspace operational guidance rather than merely initializing artifacts.

Content

No source excerpt is available for this finding.