PARA + Proactive Agent Workspace

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:10 PM UTC
• Version: 1.0.2

Overview

This is a legitimate workspace template, but it gives the agent broad persistent memory and proactive action authority without enough consent, scoping, or overwrite protection.

Review and narrow this skill before installing in a real workspace. Use it only in a test or empty directory, remove or require approval for commit/push and account checks, disable blanket conversation logging unless explicitly wanted, avoid storing secrets or sensitive infrastructure details in Markdown, and add retention/deletion rules for memory files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: assets/templates/AGENTS.md:5
• Finding: Persistent Agent Instruction and Memory Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `assets/templates/AGENTS.md:5-18`, `assets/templates/AGENTS.md:191-204`, `assets/templates/AGENTS.md:245-268`, `assets/templates/SOUL.md:32-49` **Vulnerability Type**: Persistent modification of agent instructions, identity, and future-session behavior **Risk Level**: High ### Vulnerable Code ```markdown ## First Run If `BOOTSTRAP.md` exists, that's your birth certificate. Follow it, figure out who you are, then delete it. You won't need it again. ## Every Session Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context 4. **If in MAIN SESSION** (direct chat with your human): Also read `MEMORY.md` Don't ask permission. Just do it. ``` ```markdown **Proactive work you can do without asking:** - Read and organize memory files - Check on projects (git status, etc.) - Update documentation - Commit and push your own changes - **Review and update MEMORY.md** (see below) ``` ```markdown ### Promote to Permanent Memory High-value learnings go to: - `CLAUDE.md` - Project-wide facts - `AGENTS.md` - Workflow improvements (this file) - `TOOLS.md` - Tool usage patterns - `SOUL.md` - Behavioral patterns ### WAL Protocol (Write-Ahead Logging) **Trigger on EVERY message:** - Corrections ("It's X, not Y") - Proper nouns (names, places, products) - Preferences (colors, styles, approaches) - Decisions ("Let's do X") - Specific values (numbers, dates, IDs) **Rule:** Write to memory FIRST, then respond. The urge to respond is the enemy. ### Working Buffer Protocol When context exceeds 60%: 1. Clear and start fresh buffer at `memory/working-buffer.md` 2. Log EVERY exchange (human message + your response summary) 3. After compaction, read buffer FIRST to recover context ``` ```markdown **Proactive.** I don't wait for instructions. I see what needs doing and I do it. I anticipate problems and ...[truncated 3228 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove mandatory identity directives and the instruction to act without permission. 2. Treat `AGENTS.md`, `SOUL.md`, and memory files as user-controlled configuration that cannot override system, developer, platform, or safety instructions. 3. Require explicit, transaction-specific user approval before: - Editing agent policy or identity files. - Creating persistent behavioral rules. - Committing repository changes. - Pushing to a remote repository. - Performing any external communication or publication. 4. Make startup loading opt-in and restrict it to files selected by the user. 5. Prevent self-modification of policy files by default. Record proposed changes in a review queue instead. 6. Clearly separate factual memory from executable instructions, and parse memory as untrusted data. 7. Add provenance and integrity metadata to persistent instructions so unexpected modifications can be detected. 8. Resolve contradictory authorization rules by applying a deny-by-default policy to all external actions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/templates/AGENTS.md:254
• Finding: Excessive Persistent Collection of Conversations and Personal Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:152-168`, `assets/templates/AGENTS.md:254-268`, `assets/templates/ONBOARDING.md:27-76`, `assets/templates/HEARTBEAT.md:17-21` **Vulnerability Type**: Unbounded plaintext retention of conversation and personal data **Risk Level**: Medium ### Vulnerable Code ```markdown ### Memory System **Three-tier memory:** 1. **SESSION-STATE.md** - Active working memory (current session) 2. **memory/YYYY-MM-DD.md** - Daily raw logs 3. **MEMORY.md** - Curated long-term wisdom **WAL Protocol (Write-Ahead Logging):** - Corrections → Write immediately - Decisions → Write immediately - Names/Preferences → Write immediately - Specific values → Write immediately **Working Buffer:** - Activates at 60% context usage - Captures every exchange - Survives context compaction ``` ```markdown ### WAL Protocol (Write-Ahead Logging) **Trigger on EVERY message:** - Corrections ("It's X, not Y") - Proper nouns (names, places, products) - Preferences (colors, styles, approaches) - Decisions ("Let's do X") - Specific values (numbers, dates, IDs]) **Rule:** Write to memory FIRST, then respond. The urge to respond is the enemy. ### Working Buffer Protocol When context exceeds 60%: 1. Clear and start fresh buffer at `memory/working-buffer.md` 2. Log EVERY exchange (human message + your response summary) 3. After compaction, read buffer FIRST to recover context ``` ```markdown ### 3. Goals **What's your primary goal right now? (1-3 sentences)** > **What does "winning" look like for you in 1 year?** > **What does ideal life look/feel like when you've succeeded?** > ### 4. Work Style **When are you most productive? (morning/afternoon/evening)** > **Do you prefer async communication or real-time?** > ### 5. Context **What are you currently working on? (projects, job, etc.)** > **Who are the key people in your work/life I should know about?** > ``` ```markdown ## 🧠 Memory Maintenance - [ ] Check context usage - if >60%, acti ...[truncated 2469 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace “log every exchange” with explicit, task-scoped, opt-in memory capture. 2. Ask for informed consent before retaining personal data or content from email, calendars, group chats, and third parties. 3. Implement configurable retention periods and automatic expiration for raw logs and working buffers. 4. Store only concise facts needed for continuity rather than raw exchanges. 5. Redact credentials, tokens, financial data, health data, private messages, and unique identifiers before writing. 6. Encrypt sensitive memory at rest and restrict filesystem permissions to the owning user. 7. Provide commands to inspect, export, correct, and delete all retained data. 8. Keep factual memory separate from executable agent instructions. 9. Disable memory loading in shared contexts and enforce that restriction technically rather than relying only on prose. 10. Add a documented privacy model explaining what is collected, why it is needed, where it is stored, and when it is deleted. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/templates/TOOLS.md:5
• Finding: Plaintext Storage Guidance for Infrastructure and Physical-Environment Details<![CDATA[ ## Vulnerability Details **File Location**: `assets/templates/TOOLS.md:5-31` **Vulnerability Type**: Plaintext storage of sensitive operational metadata **Risk Level**: Medium ### Vulnerable Code ```markdown ## What Goes Here Things like: - Camera names and locations - SSH hosts and aliases - Preferred voices for TTS - Speaker/room names - Device nicknames - Anything environment-specific ## Examples ```markdown ### Cameras - living-room → Main area, 180° wide angle - front-door → Entrance, motion-triggered ### SSH - home-server → 192.168.1.100, user: admin ### TTS - Preferred voice: "Nova" (warm, slightly British) - Default speaker: Kitchen HomePod ``` ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ``` ### Technical Analysis The template encourages users and agents to store SSH destinations, usernames, camera placement, room names, speaker locations, and device identifiers in a plaintext Markdown file. Separating this information from a shared Skill reduces accidental publication of the Skill itself, but it does not protect the resulting workspace file. This operational metadata can materially assist reconnaissance. SSH hosts and usernames identify lateral-movement targets, while camera and room information can expose physical-security coverage and device topology. The template provides no encryption, access-control, redaction, or secret-management guidance. The examples do not contain real credentials, and the audit found no bundled secret. The vulnerability is the unsafe recommended storage practice rather than a hardcoded credential in the package. ### Attack Path 1. A user follows the template and records real SSH aliases, addresses, usernames, cameras, rooms, and devices in `TOOLS.md`. 2. The file is included in a backup, synchronization target, repository, agent context, or shared workspace. ...[truncated 782 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not recommend storing addresses, usernames, camera locations, or detailed physical topology in general-purpose Markdown. 2. Keep only opaque aliases in `TOOLS.md`; resolve sensitive details through a protected configuration or secret-management system. 3. Explicitly prohibit storage of passwords, private keys, API tokens, recovery codes, and session cookies. 4. Apply owner-only permissions to files containing operational metadata. 5. Add the sensitive local configuration file to version-control ignore rules. 6. Provide a sanitized example using non-routable placeholders and generic locations. 7. Document secure backup and synchronization requirements. 8. Separate physical-security metadata from ordinary agent context and require explicit approval before loading it. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup-workspace.sh:27
• Finding: Installer Overwrites Existing Workspace Files and Fails After Partial Modification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-workspace.sh:27-70` **Vulnerability Type**: Unsafe file overwrite and non-atomic installation **Risk Level**: High ### Vulnerable Code ```bash # Check if already initialized if [ -f "README.md" ] && grep -q "PARA + Proactive Agent" README.md 2>/dev/null; then echo "⚠️ This directory appears to already have a workspace structure." read -p "Overwrite? (y/N): " confirm if [[ ! $confirm =~ ^[Yy]$ ]]; then echo "Setup cancelled." exit 0 fi fi # Copy template files echo "📁 Creating directory structure..." # PARA directories mkdir -p 1-projects 2-areas 3-resources 4-archives "+inbox" "+temp" # Agent directories mkdir -p .agents .learnings memory # Copy files cp "$TEMPLATE_DIR/README.md" . cp "$TEMPLATE_DIR/AGENTS.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/SOUL.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/USER.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/HEARTBEAT.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/MEMORY.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/ONBOARDING.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/SESSION-STATE.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/TOOLS.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/.gitignore" . 2>/dev/null || true # Copy PARA READMEs cp "$TEMPLATE_DIR/1-projects/README.md" 1-projects/ cp "$TEMPLATE_DIR/2-areas/README.md" 2-areas/ cp "$TEMPLATE_DIR/3-resources/README.md" 3-resources/ cp "$TEMPLATE_DIR/4-archives/README.md" 4-archives/ cp "$TEMPLATE_DIR/+inbox/README.md" "+inbox/" cp "$TEMPLATE_DIR/+temp/README.md" "+temp/" # Copy agent files cp "$TEMPLATE_DIR/.agents/README.md" .agents/ cp "$TEMPLATE_DIR/.learnings/LEARNINGS.md" .learnings/ 2>/dev/null || touch .learnings/LEARNINGS.md cp "$TEMPLATE_DIR/memory/working-buffer.md" memory/ 2>/dev/null || touch memory/working-buffer.md ``` ### Technical Analysis The overwrite prompt is activated only when the target already contains a `README.md` with the exact text `PARA + Proac ...[truncated 2207 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Refuse to operate on a non-empty target directory by default. 2. Enumerate every conflicting destination before changing any file and request explicit confirmation. 3. Use no-clobber semantics or fail when a destination already exists. 4. Offer a clearly named force option for intentional replacement. 5. Back up existing files before overwriting them and provide rollback instructions. 6. Validate that every required template exists and is readable before creating or changing the target. 7. Remove the invalid `.agents/README.md` copy or include the referenced source file. 8. Stage the complete workspace in a temporary directory and atomically move it into place only after validation succeeds. 9. Avoid suppressing copy errors. Report missing optional files explicitly and distinguish them from required files. 10. Add an error trap that restores backups or removes staged changes when setup fails. 11. Test installation against empty directories, non-empty directories, existing agent workspaces, missing templates, and interrupted execution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (28)

Self-Modification

High

• Category: Rogue Agent

Content

## Why Separate?

Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure.

---

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The README instructs users to run `npx clawhub install ...` without pinning a specific package version. Because `npx` resolves and executes the current published package, a compromised upstream package, dependency, or future malicious update could execute arbitrary code on the user's machine at install time. In a skill intended for agent/workspace bootstrapping, this is more dangerous because users are encouraged to run the command directly in a trusted setup flow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly sets up persistent on-disk storage for agent memory, user profiles, session state, and daily logs, but the installation and feature description do not clearly warn users about the privacy and retention implications. This can cause users to unknowingly store sensitive personal data or conversation history in local files that may later be synced, backed up, or exposed to other tools.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Installation

```bash
# Create workspace directory
mkdir -p ~/workspace
cd ~/workspace

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to capture every exchange and immediately persist names, preferences, decisions, corrections, and specific values into memory files. Persistently logging broad conversation content creates a real privacy and data-minimization risk, especially because sensitive information may be recorded without explicit consent or filtering.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation phrases are very broad generic productivity and organization terms such as 'create workspace', 'productivity', and 'knowledge management'. This can cause the skill to trigger in many unrelated user contexts, increasing the chance it influences conversations or file operations when the user did not specifically intend to invoke this workspace template.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to create and update daily and long-term memory files containing user context, decisions, and other remembered information, but does not present a clear user-facing privacy warning or consent flow. This creates persistent retention of potentially sensitive personal data that could later be exposed in shared contexts, backups, or compromise of the workspace.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guidance allows the agent to search the web, check calendars, and otherwise access external services with minimal friction, while only partially distinguishing what requires approval. Without a clear user-facing warning about monitoring and external access, users may not realize the agent is authorized to inspect personal accounts or retrieve outside data on its own.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The heartbeat section encourages broad, recurring autonomous activity and references a configurable heartbeat prompt plus optional HEARTBEAT.md instructions. In a workspace skill, this can lead to overly permissive invocation and repeated background actions without clear scoping, increasing the chance of unintended monitoring, data access, or noisy proactive behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The heartbeat instructions authorize periodic checks, persistent writes to heartbeat-state.json, and proactive outreach based on what the agent finds, yet the skill description does not clearly warn that this behavior includes ongoing monitoring and stateful background operation. That combination can surprise users and normalize silent collection of behavioral and account-related metadata.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Nothing new since last check
- You just checked <30 minutes ago

**Proactive work you can do without asking:**

- Read and organize memory files
- Check on projects (git status, etc.)

• Confidence: 84% confidence
• Finding: The skill explicitly authorizes proactive work 'without asking,' including reading and organizing memory files and checking projects, in a persistent workspace context. Even though intended for productivity, this delegates autonomous decisions over potentially sensitive local data and project state, which can lead to privacy issues, unintended modifications, or user surprise.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: These protocols mandate pervasive logging of corrections, proper nouns, preferences, decisions, dates, IDs, and even every exchange into memory files before responding. This creates a strong data retention and context-leakage risk because highly sensitive personal or operational details may be persistently stored in natural language, duplicated across files, and later surfaced to other tools, users, or compromised processes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The heartbeat checklist directs proactive review of daily notes, emails, calendar, and projects, which are likely to contain sensitive personal or business information, yet it does not instruct the agent to obtain fresh permission, limit scope, or avoid sensitive content. Because this skill is designed for autonomous proactive behavior, the missing warning and access constraints make inadvertent over-collection and privacy violations more likely.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template explicitly instructs the agent to update a persistent MEMORY.md file with distilled insights, but it provides no consent boundary, data minimization rule, or warning that user-related or sensitive information could be stored long-term. In a proactive workspace/memory skill, this increases the chance of retaining personal, confidential, or unnecessary data beyond the user's expectations.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage

Content

- Bottleneck to eliminate?
- Something they mentioned once?

## 🔄 Reverse Prompting (Weekly)

Once a week, ask:
1. "What interesting things could I do that you haven't thought of?"

• Confidence: 85% confidence
• Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The template explicitly prompts users to record personal background, preferences, important dates, relationships, and other ongoing context, which can include sensitive personal data. Because it provides no warning, minimization guidance, or handling restrictions, it normalizes persistent storage of potentially sensitive information in long-term memory files that may be broadly accessible to tools, sync services, or agents.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The onboarding trigger is defined by broad file state checks and natural-language prompts, which can cause the agent to initiate onboarding without a clear, fresh user consent event. In a workspace skill that persists memory and updates profile files, unintended activation can lead to unnecessary collection of personal information and profile shaping based on incidental conversation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template asks for sensitive personal and professional context and later states that the agent will update USER.md and SOUL.md, but it does not clearly warn users that these details will be stored persistently and used to build a profile. In a memory-oriented workspace skill, that omission increases privacy risk because users may disclose data without understanding retention, propagation, or future reuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly instructs the agent to write daily notes to persistent memory and promote distilled content into long-term memory, but it provides no warning, consent mechanism, retention limits, or guidance on handling sensitive data. In a workspace template centered on agent memory persistence and personal knowledge management, this can cause users to unknowingly retain private or regulated information indefinitely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template explicitly encourages recording 'specific details' and says this is the 'ONLY place' such details are safe, but it provides no guardrails against storing secrets, personal data, credentials, tokens, or other sensitive session information. In a workspace and agent-memory context, this increases the likelihood that sensitive data will be persisted into a markdown file, retained longer than necessary, and exposed through syncing, version control, logs, or later prompt reuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file instructs the agent to treat workspace files as persistent memory and to read/update them every session, but it does not require explicit user consent, scope limits, or safeguards around what can be modified. In a workspace template built for agent memory persistence and file organization, this can lead to unauthorized or surprising changes to user data, accidental propagation of stale or sensitive information, and erosion of auditability.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template explicitly encourages storing environment-specific details such as SSH hosts, camera locations, and device information, but it never warns against including secrets or sensitive operational data. In a productivity/agent-memory workspace, users may treat this file as a catch-all cheat sheet and accidentally record credentials, internal network details, or other sensitive data that could later be exposed through syncing, sharing, backups, or agent access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template explicitly states that it 'captures EVERY exchange' and 'survives compaction,' which implies persistent retention of potentially sensitive user and system content. Because there is no accompanying notice, consent mechanism, retention limit, or guidance to exclude secrets/PII, this creates a real privacy and data-retention risk rather than a purely theoretical issue.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The manual setup instructions clone the repository and run a setup script, and the copy instructions recursively copy template files into a user workspace, but the README does not warn that these actions may overwrite files or modify existing workspace contents. This can lead to accidental data loss, state corruption, or unintended changes, especially because the skill is designed to initialize persistent agent memory and workspace structure.