Proactive Agent Plus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 3.1.0

Overview

This skill is a proactive-agent guide, but it asks the agent to persist broad conversation data and act autonomously with too little user control.

Install only if you want an agent that keeps persistent working memory and proactively suggests or performs follow-up work. Before using it, set explicit rules requiring approval for file changes, external communications, background jobs, and any storage of personal, confidential, credential, health, financial, or client data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:523

Finding

Skill text attempts to redefine the agent's identity and operational goals

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:523
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable code snippet:

markdown

**🦞 You are now a Proactive Agent. Go delight your human.**

Technical Analysis

The skill ends with a direct second-person instruction that declares a new agent identity and directs subsequent behavior. This is executable prompt text rather than documentation describing how a feature should be invoked.

The instruction reinforces earlier directives such as Non-negotiable. This is core identity. at line 295. Collectively, these statements attempt to alter the agent's current goals when the skill is loaded. The broad objective to act proactively is not constrained to an explicit task, approved resources, or non-destructive actions. It can therefore encourage actions beyond the minimum privileges required to provide advice about proactive workflows.

Although the file also contains security guidance, the final instruction does not explicitly preserve higher-priority policies, require user authorization, or prohibit autonomous side effects. Instructions embedded in skill content must not redefine agent identity or supersede system, developer, safety, or current user instructions.

Attack Path

1. A user or automated skill manager installs or loads SKILL.md.
2. The agent interprets the Markdown as operational instructions.
3. Line 523 tells the agent that it now has a new identity and a generalized proactive objective.
4. The agent applies that objective outside the immediate user request.
5. In an environment with tools, the agent may initiate file changes, searches, communications, scheduled work, or other actions merely because it predicts that they could “delight” the user.
6. Because the objective lacks a strict authorization boundary, it can conflict with current-session goals and least-privilege expectations.

Impact Assessm

...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the identity-changing statement entirely.
2. Replace it with descriptive, non-executable documentation, for example: “This skill provides optional patterns for proactive assistance.”
3. State explicitly that system, developer, safety, and current user instructions always take precedence.
4. Require explicit user approval before any external communication, destructive operation, persistent modification, scheduled task, or action unrelated to the active request.
5. Constrain proactive behavior to recommendations by default; execution should require a separately confirmed request.
6. Remove identity-pressure language such as “core identity” and “non-negotiable.”
7. Add a capability boundary listing which tools and files the skill needs. Deny access to all other resources by default.
8. Treat all skill Markdown as untrusted configuration and validate it for second-person commands, policy overrides, and attempts to redefine agent identity before loading.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:153

Finding

Mandatory broad conversation logging enables persistent memory poisoning and sensitive-data retention

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:153-210
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable code snippet:

markdown

### The Protocol

**If ANY of these appear:**
1. **STOP** — Do not start composing your response
2. **WRITE** — Update SESSION-STATE.md with the detail
3. **THEN** — Respond to your human

**The urge to respond is the enemy.** The detail feels so clear in context that writing it down seems unnecessary. But context will vanish. Write first.

**Example:**

Human says: "Use the blue theme, not red"

WRONG: "Got it, blue!" (seems obvious, why write it down?) RIGHT: Write to SESSION-STATE.md: "Theme: blue (not red)" → THEN respond

text

### Why This Works

The trigger is the human's INPUT, not your memory. You don't have to remember to check — the rule fires on what they say. Every correction, every name, every decision gets captured automatically.

---

## Working Buffer Protocol ⭐ NEW

**Purpose:** Capture EVERY exchange in the danger zone between memory flush and compaction.

### How It Works

1. **At 60% context** (check via `session_status`): CLEAR the old buffer, start fresh
2. **Every message after 60%**: Append both human's message AND your response summary
3. **After compaction**: Read the buffer FIRST, extract important context
4. **Leave buffer as-is** until next 60% threshold

### Buffer Format

```markdown
# Working Buffer (Danger Zone Log)
**Status:** ACTIVE
**Started:** [timestamp]

---

## [timestamp] Human
[their message]

## [timestamp] Agent (summary)
[1-2 sentence summary of your response + key details]

Why This Works

The buffer is a file — it survives compaction. Even if SESSION-STATE.md wasn't updated properly, the buffer captures everything said in the danger zone. After waking up, you review the buffer and pull out what matters.

The rule: Once context hits 60%, EVERY exc ...[truncated 3458 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace automatic persistence with explicit user consent for each memory category.
2. Persist only concise, task-relevant summaries; never store complete exchanges by default.
3. Prohibit storage of passwords, API keys, authentication tokens, private keys, financial data, health data, and other sensitive information.
4. Detect and redact secrets and personal data before any write.
5. Attach provenance, timestamp, scope, and trust level to every memory entry.
6. Store quoted untrusted content as inert data and prohibit interpreting it as an instruction during recovery.
7. Require explicit user review before promoting a conversation-derived item into AGENTS.md, SOUL.md, tool configuration, or any persistent operating rule.
8. Remove “EVERY exchange” and “No exceptions.” Introduce allowlisted memory fields and per-session opt-out controls.
9. Apply retention periods, deletion controls, restrictive filesystem permissions, and encryption where persistent storage is genuinely necessary.
10. During recovery, validate stored state against current higher-priority instructions and display proposed recovered preferences for confirmation.
11. Do not write URLs verbatim when they contain query parameters or fragments that could include credentials.
12. Separate ephemeral task state from durable user preferences and prevent autonomous migration between those stores.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The working buffer protocol mandates logging every exchange after a context threshold, including the human's message and an agent summary, with no user-facing warning or minimization guardrail. That creates a high-risk full-conversation capture mechanism that can retain sensitive content simply because the session grew long, not because storage was necessary.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.

md

- Skill definitions (`SKILL.md`)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly encourages the agent to anticipate needs, reverse prompt, and proactively check in across ordinary situations without defining clear consent boundaries or scope limits. In an agent skill, broad activation logic can cause unprompted actions, intrusive monitoring, or contextually inappropriate behavior, especially when paired with persistence and self-improvement features elsewhere in the file.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

✅ **Anticipates your needs** — Asks "what would help my human?" instead of waiting

✅ **Reverse prompting** — Surfaces ideas you didn't know to ask for

✅ **Proactive check-ins** — Monitors what matters and reaches out when needed

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

13. [Tool Migration Checklist](#tool-migration-checklist) ⭐ NEW
14. [The Six Pillars](#the-six-pillars)
15. [Heartbeat System](#heartbeat-system)
16. [Reverse Prompting](#reverse-prompting)
17. [Growth Loops](#growth-loops)

---

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.

md

13. [Tool Migration Checklist](#tool-migration-checklist) ⭐ NEW
14. [The Six Pillars](#the-six-pillars)
15. [Heartbeat System](#heartbeat-system)
16. [Reverse Prompting](#reverse-prompting)
17. [Growth Loops](#growth-loops)

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-start flow says the agent will auto-populate USER.md and SOUL.md from the user's answers, but it does not clearly warn that those answers will be written to persistent files. Users may reasonably provide personal information during onboarding without understanding the retention and future reuse implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The memory architecture directs the agent to persist conversation details across SESSION-STATE.md, daily logs, and MEMORY.md, but it does not clearly disclose that user messages may be copied into multiple files. Multi-file retention raises privacy and accidental exposure risks because users are not informed about the breadth of storage or duplication.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The WAL protocol instructs the agent to persist specific user-provided details immediately whenever common triggers appear, including names, preferences, decisions, values, and URLs. This creates systematic collection of user data into persistent state without clear necessity tests, sensitivity filtering, or consent controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The WAL protocol tells the agent to scan every message for common categories of content and immediately persist details before responding. This is effectively a blanket capture rule for routine conversation content, which increases the chance of oversharing, storing sensitive data without consent, and normalizing unnecessary retention.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section requires persistent capture of all user exchanges into a working-buffer file without data-minimization boundaries. Even if intended for resilience, storing raw conversational content broadly increases the blast radius of any compromise, accidental disclosure, or misuse of retained context.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The instruction to 'use every tool' and combine CLI, browser, web search, and spawned agents encourages expansive tool use without tying those actions to authorization, least privilege, or data-safety checks. In practice, this can push an agent toward risky tool invocation patterns, privilege overreach, or unnecessary exposure of user context to external systems.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md

1. Try a different approach immediately
2. Then another. And another.
3. Try 5-10 methods before considering asking for help
4. Use every tool: CLI, browser, web search, spawning agents
5. Get creative — combine tools in new ways

### Before Saying "Can't"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 82% confidence

Finding

The principle 'create value without asking' normalizes autonomous decision-making without clearly distinguishing harmless suggestions from actions that alter data, settings, schedules, or communications. In a proactive agent architecture, that framing can lead to action before confirmation and reduce meaningful human oversight.

Content

Scanner excerpt · SKILL.md (reported line 461)May include surrounding context.

md

## The Six Pillars

1. **Proactive** — Anticipate needs, create value without asking
2. **Persistent** — Survive context loss, maintain continuity
3. **Resourceful** — Try 10 approaches before giving up
4. **Self-Improving** — Learn from every interaction