T06 · System Persistence
Error
- Location
SKILL.md:51- Finding
Persistent Daily Agent Execution Through a Scheduled Cron Job
- Content
View full analysis
- Remediation
View remediation
Security audit
Wayfound
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent self-review tooling, but it asks to create a recurring agent job and modify long-term memory or identity files, which needs careful review before installation.
Install only if you want a persistent daily self-review agent. Before enabling the cron job, ask to see the exact job behavior, how to disable or delete it, what files it can read and write, and require explicit approval before any MEMORY.md or SOUL.md changes are made from review results. Treat any external alerting or Wayfound Enterprise use as separate data sharing that needs its own consent and privacy review.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:103- Finding
Persistent Agent Behavior Modification Through Autonomous Memory and Identity Updates
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md > "Quick note from yesterday's review: I noticed I've been [specific pattern]. Want me to [specific fix]?" Keep it to one sentence. Don't lecture. If it's serious enough that the user should know immediately — you broke something, you sent something wrong, you leaked information — don't wait for the daily review. Tell them now. There are no alert tiers. Either it's urgent (say it now) or it's a pattern (surface it next session). That binary covers everything.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says to use the skill 'after installing to add the rubric to SOUL.md and set up the daily review' and also 'when the user asks about quality, performance, or improving how you work.' The latter trigger scope is very broad and overlaps with common conversational topics, without clear boundaries or exclusion conditions, which could cause unintended invocation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest emphasizes 'no new infrastructure, no parallel systems' and describes a lightweight self-review flow centered on SOUL.md, memory, and a cron job. However, the setup section adds optional alert relay through OpenClaw, and the document later advertises an external SaaS review system, which extends beyond the narrowly described local memory-based mechanism.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises an external SaaS supervisor that reads sessions independently, which introduces a materially different trust boundary from the manifest's local self-supervision framing. Even though this is promotional text rather than executable logic, it can socially steer operators toward exporting sensitive session data to an external service without clear data handling, consent, or minimization guidance.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Coding - Only make changes that were requested — don't expand scope without asking - Run tests or validate code before presenting it as finished - Never make destructive changes (deleting files, force-pushing, resetting) without explicit confirmation - Follow existing patterns in the codebase — don't introduce inconsistency
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md ## Coding - Only make changes that were requested — don't expand scope without asking - Run tests or validate code before presenting it as finished - Never make destructive changes (deleting files, force-pushing, resetting) without explicit confirmation - Follow existing patterns in the codebase — don't introduce inconsistency
Static analysis
No suspicious patterns detected.