NextSteps

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:27 AM UTC
• Version: 1.0.1

Overview

This skill is not malicious, but it automatically changes agent replies and keeps persistent behavioral memory in ways users should review before installing.

Install only if you want automatic next-step suggestions on most responses and are comfortable with local .nextsteps files tracking selections, ignored suggestions, inferred preferences, and backlog topics. Review or disable persistence behavior before use, and avoid using it where strict output formats or private cross-channel context must not be modified or remembered.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:4

Finding

Persistent Modification of Agent Responses Through Mandatory Next-Step Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4, SKILL.md:15-18, SKILL.md:62-86, and SKILL.md:150-152
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

SKILL.md:4:

markdown

Append context-aware next-step suggestions after agent responses. Generates actionable follow-ups, surfaces unfinished tasks from memory, and includes creative lateral suggestions. Self-learns user preferences for count, categories, and format. Activate by: (1) any response when nextsteps is enabled, (2) user says /nextsteps, "next steps", "what should I do", "suggestions", "what now", (3) user wants to customize settings, (4) user says "disable next steps" or "enable next steps".

SKILL.md:15-18:

markdown

1. Check `.nextsteps/PREFERENCES.md` for user config — if `enabled: false`, stop (show nothing)
2. If `.nextsteps/` does not exist, run the cold-start protocol (see [COLD-START.md](references/COLD-START.md))
3. Generate next steps following the pipeline below
4. Append to your response in the correct format

SKILL.md:62-86:

markdown

### Step 6 — Format and Present

Show exactly `display-count` items. Never more, never fewer.

**Standard format** (default for rich-text channels):

⚡ Next Steps

1. 🔧 [Bold title] — [Brief context explaining relevance]
2. 🔍 [Bold title] — [Brief context]
3. 📋 Resume: [task from backlog] — [When it was started]
4. 💡 Consider: [creative lateral idea] — [Why it matters]
5. ✅ Quick win: [small action] — [Time estimate]

Your selections help me learn what matters to you.

text

**Compact format** (for TUI, character-limited channels):

⚡ Next: [1] Title | [2] Title | [3] Title

text

**Token-budget rule**: If your response is approaching the output token limit, switch to compact format with `min-count` items (default: 1). Reserve ~100 tokens for next steps when planning long
...[truncated 2524 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the default to enabled=false.
2. Activate the skill only after an explicit user request such as /nextsteps; do not activate it for every response.
3. Remove the reliability instruction that requires responses to end with generated suggestions.
4. Remove mandatory token reservation and exact-count requirements when they conflict with the primary task.
5. Detect strict-output requests such as JSON, XML, patches, code-only responses, or other machine-consumed formats and never append additional content.
6. Treat next-step suggestions as a separately requested response rather than an automatic suffix.
7. Ensure higher-priority user and platform requirements always take precedence over the skill's formatting preferences.

T02 · Agent Memory Poisoning

Warning

• Location: references/CUSTOMIZATION.md:75

Finding

Cross-Channel Behavioral Profiling and Persistent Collection After Disablement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:103-118, SKILL.md:120-129, references/CUSTOMIZATION.md:75-85, and references/SELF-IMPROVE.md:97-105
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Code

SKILL.md:103-118:

markdown

## Selection Tracking

After presenting next steps, detect what the user does on their NEXT message:

- **User references a suggestion by number or content** → log `[SELECTED] #N category` in HISTORY.md. Promote that category tier if MODERATE→consider STRONG.
- **User asks something unrelated to any suggestion** → log `[IGNORED] all` in HISTORY.md
- **User gives negative feedback** ("too many", "not helpful", "stop suggesting X") → log `[FEEDBACK]` and adjust per [CUSTOMIZATION.md](references/CUSTOMIZATION.md)

## Self-Improvement

Every 10th activation, run one learning experiment. Every 20 HISTORY.md entries, run a self-diagnostic. See [SELF-IMPROVE.md](references/SELF-IMPROVE.md) for the full observe/hypothesize/experiment/validate cycle.

Key self-learning behaviors:
- If user only selects from top 2 items over 10 interactions → hypothesize lower count preference → experiment → validate
- If user ignores all suggestions 5+ times → trigger diagnostic, reset category weights
- After 5 validated experiments on count → set confidence HIGH, stop experimenting

SKILL.md:120-129:

markdown

## Channel Adaptation

Detect the channel and adapt format:

- **OpenClaw**: Read channel from conversation metadata → adapt format per channel type
- **VS Code / Rich text**: Use standard format with icons and bold
- **Terminal / TUI**: Use compact format, no icons
- **WhatsApp / Signal / iMessage**: Use shortest compact form

All channels share the same `.nextsteps/` state. Preferences learned on one channel apply everywhere.

references/CUSTOMIZATION.md:75-85:

markdown

These adjustments happen silently. They a
...[truncated 3390 chars]

Remediation

View remediation

Remediation Suggestions

1. Stop every form of collection and mutation when enabled=false, including backlog maintenance, history logging, experiments, and affinity updates.
2. Require explicit opt-in before creating persistent files or enabling behavioral learning.
3. Store a task in BACKLOG.md only after the user explicitly asks to remember or track it.
4. Do not classify unrelated responses as behavioral signals unless the user has consented to analytics.
5. Isolate state by project, user, workspace, and channel instead of sharing one state directory everywhere.
6. Add provenance to each stored item, including its source channel and whether it was explicitly approved.
7. Require confirmation before inferred preferences materially alter future output.
8. Provide commands to inspect, delete, export, and completely reset all persisted state.
9. Add retention periods and automatic expiration for history, inferred preferences, and backlog entries.
10. Treat content from retrieved documents, tool output, and third parties as untrusted; never convert it into persistent memory without direct user confirmation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/SECURITY.md (reported line 32)May include surrounding context.

md

When suggesting file operations, never recommend:
- Writing to system directories without confirmation
- Recursive deletion without safeguards
- File permissions that are world-writable (e.g., `chmod 777`)

Reframe as safe alternatives:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/SECURITY.md (reported line 33)May include surrounding context.

md

When suggesting file operations, never recommend:
- Writing to system directories without confirmation
- Recursive deletion without safeguards
- File permissions that are world-writable (e.g., `chmod 777`)

Reframe as safe alternatives:
- "Clean up build artifacts with `rm -rf dist/`" → "Clean up build artifacts (review contents of `dist/` first)"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/SECURITY.md (reported line 36)May include surrounding context.

md

- File permissions that are world-writable (e.g., `chmod 777`)

Reframe as safe alternatives:
- "Clean up build artifacts with `rm -rf dist/`" → "Clean up build artifacts (review contents of `dist/` first)"
- "Set permissions to 777" → "Set appropriate file permissions (consider 644 for files, 755 for directories)"

## Rule 4 — Dependency Security

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/SECURITY.md (reported line 58)May include surrounding context.

md

- If `node_modules/` exists and not in .gitignore → suggest adding
- If common secret files detected (*.pem, *.key) and not in .gitignore → suggest adding

## Rule 6 — No Suggestion Should Bypass Security

Self-review gate: before presenting any suggestion, verify it does not:
1. Encourage disabling security features (e.g., "disable CORS", "set --no-verify")

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/SECURITY.md (reported line 77)May include surrounding context.

md

- Security violations are a hard fail — the suggestion is discarded, not softened
- Maximum 3 regeneration attempts per suggestion before falling back to a safe alternative
- Security rules take precedence over all other generation rules (including user customization)
- Users CANNOT disable security rules through customization — they are not configurable

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill describes persistent logging of selections, ignored suggestions, user topics, configuration changes, and disable events, but does not specify a clear user warning or consent flow. This is especially dangerous because the stored data supports behavioral profiling and longitudinal inference, while users may believe they are only receiving lightweight next-step suggestions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation phrases are broad enough to match ordinary conversation like 'what should I do' or 'suggestions', causing the skill to run unexpectedly and append output or initiate stateful behavior. In this skill, accidental activation is more dangerous because it can lead to file reads/writes, preference changes, and cross-session learning without a deliberate, explicit invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to update persistent local files immediately (for example, PREFERENCES.md and HISTORY.md) in response to conversational cues, but does not require a clear user-facing consent prompt before modifying local state. This creates a risk of silent state changes, preference poisoning, and unintended persistence of user-derived data, especially given the broad triggers and automatic learning behaviors elsewhere in the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The cold-start instructions direct the agent to scan README.md, manifest files, recent files, and git log to infer project context, but there is no explicit privacy disclosure or consent gate for inspecting recent work patterns and commit history. This creates a privacy risk because the agent may collect behavioral and project metadata beyond what the user expected for a 'next steps' feature, especially when combined with persistent preference/history files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to create and modify multiple files under .nextsteps/ during cold start without requiring a clear user-facing notice or confirmation before writing to disk. In an agent context, silent persistence can surprise users, alter repositories unintentionally, and cause sensitive preference/history data to be stored or committed without informed consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The 'No Confirmation Needed' section authorizes autonomous preference updates from inferred behavior. In this skill context, the autonomy is not executing external side effects, but it still changes persistent user state without explicit approval, which can lead to unwanted configuration drift and privacy concerns.

Content

Scanner excerpt · references/CUSTOMIZATION.md (reported line 58)May include surrounding context.

md

### Step 5 — Immediate Effect
Apply the change to the very next set of suggestions (same response if possible, otherwise next response).

## Implicit Learning (No Confirmation Needed)

### Count Learning
Three signals indicate implicit count preference:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The implicit learning rules silently adjust preferences and log user behavior without prior notice or confirmation. This is dangerous because it enables behavioral profiling and persistent modification of user-related state based on inferred signals, which may be inaccurate and non-transparent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The protocol explicitly says the system should continue maintaining BACKLOG.md even after the user disables NextSteps. That creates ongoing collection and retention of user-related context beyond the feature's visible behavior, which can violate user expectations and expand the data footprint without clear consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/SECURITY.md (reported line 31)May include surrounding context.

md

## Rule 3 — Safe File Operations

When suggesting file operations, never recommend:
- Writing to system directories without confirmation
- Recursive deletion without safeguards
- File permissions that are world-writable (e.g., `chmod 777`)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/SECURITY.md (reported line 33)May include surrounding context.

md

When suggesting file operations, never recommend:
- Writing to system directories without confirmation
- Recursive deletion without safeguards
- File permissions that are world-writable (e.g., `chmod 777`)

Reframe as safe alternatives:
- "Clean up build artifacts with `rm -rf dist/`" → "Clean up build artifacts (review contents of `dist/` first)"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/SECURITY.md (reported line 33)May include surrounding context.

md

When suggesting file operations, never recommend:
- Writing to system directories without confirmation
- Recursive deletion without safeguards
- File permissions that are world-writable (e.g., `chmod 777`)

Reframe as safe alternatives:
- "Clean up build artifacts with `rm -rf dist/`" → "Clean up build artifacts (review contents of `dist/` first)"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The design persistently logs detailed user behavioral signals, topic data, and inferred preferences in HISTORY.md without any explicit consent or clear retention limits tied to a narrowly necessary function. For a next-step suggestion skill, this exceeds reasonable operational scope and creates a profiling surface that can expose sensitive habits, interests, and interaction patterns over time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The self-learning model performs autonomous hypothesis generation, experimentation, and permanent preference changes, which materially broadens behavior beyond simple preference tuning. Even if framed as optimization, this creates unreviewed adaptation that can alter outputs based on inferred behavior without clear user awareness, consent, or bounded safeguards.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Creating and maintaining a persistent backlog from ordinary conversation content expands the skill from suggestion generation into ongoing task surveillance and memory retention. This can capture sensitive plans, obligations, or personal matters the user did not intend to have stored, especially because the trigger is broad and defaults to inclusion in future outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger 'when a topic is mentioned in conversation but not acted on' is overly broad and can treat casual discussion as a task to persist. In context, this makes inadvertent collection likely and increases the chance that sensitive or hypothetical topics are stored and resurfaced later without the user's intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.