T01 · Skill Instruction Hijacking
Error
- Location
assets/templates/AGENTS.md:5- Finding
Persistent Agent Instruction and Memory Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
PARA + Proactive Agent Workspace
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate workspace template, but it gives the agent broad persistent memory and proactive action authority without enough consent, scoping, or overwrite protection.
Review and narrow this skill before installing in a real workspace. Use it only in a test or empty directory, remove or require approval for commit/push and account checks, disable blanket conversation logging unless explicitly wanted, avoid storing secrets or sensitive infrastructure details in Markdown, and add retention/deletion rules for memory files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
assets/templates/AGENTS.md:254- Finding
Excessive Persistent Collection of Conversations and Personal Context
- Content
View full analysis
**What does "winning" look like for you in 1 year?** > **What does ideal life look/feel like when you've succeeded?** > ### 4. Work Style **When are you most productive? (morning/afternoon/evening)** > **Do you prefer async communication or real-time?** > ### 5. Context **What are you currently working on? (projects, job, etc.)** > **Who are the key people in your work/life I should know about?** > ``` ```markdown ## 🧠 Memory Maintenance - [ ] Check context usage - if >60%, acti ...[truncated 2469 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
assets/templates/TOOLS.md:5- Finding
Plaintext Storage Guidance for Infrastructure and Physical-Environment Details
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup-workspace.sh:27- Finding
Installer Overwrites Existing Workspace Files and Fails After Partial Modification
- Content
View full analysis
/dev/null; then echo "⚠️ This directory appears to already have a workspace structure." read -p "Overwrite? (y/N): " confirm if [[ ! $confirm =~ ^[Yy]$ ]]; then echo "Setup cancelled." exit 0 fi fi # Copy template files echo "📁 Creating directory structure..." # PARA directories mkdir -p 1-projects 2-areas 3-resources 4-archives "+inbox" "+temp" # Agent directories mkdir -p .agents .learnings memory # Copy files cp "$TEMPLATE_DIR/README.md" . cp "$TEMPLATE_DIR/AGENTS.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/SOUL.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/USER.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/HEARTBEAT.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/MEMORY.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/ONBOARDING.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/SESSION-STATE.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/TOOLS.md" . 2>/dev/null || true cp "$TEMPLATE_DIR/.gitignore" . 2>/dev/null || true # Copy PARA READMEs cp "$TEMPLATE_DIR/1-projects/README.md" 1-projects/ cp "$TEMPLATE_DIR/2-areas/README.md" 2-areas/ cp "$TEMPLATE_DIR/3-resources/README.md" 3-resources/ cp "$TEMPLATE_DIR/4-archives/README.md" 4-archives/ cp "$TEMPLATE_DIR/+inbox/README.md" "+inbox/" cp "$TEMPLATE_DIR/+temp/README.md" "+temp/" # Copy agent files cp "$TEMPLATE_DIR/.agents/README.md" .agents/ cp "$TEMPLATE_DIR/.learnings/LEARNINGS.md" .learnings/ 2>/dev/null || touch .learnings/LEARNINGS.md cp "$TEMPLATE_DIR/memory/working-buffer.md" memory/ 2>/dev/null || touch memory/working-buffer.md ``` ### Technical Analysis The overwrite prompt is activated only when the target already contains a `README.md` with the exact text `PARA + Proac ...[truncated 2207 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
Findings (28)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ## Why Separate? Skills are shared. Your setup is yours. Keeping them apart means you can update skills without losing your notes, and share skills without leaking your infrastructure. ---
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README instructs users to run
npx clawhub install ...without pinning a specific package version. Becausenpxresolves and executes the current published package, a compromised upstream package, dependency, or future malicious update could execute arbitrary code on the user's machine at install time. In a skill intended for agent/workspace bootstrapping, this is more dangerous because users are encouraged to run the command directly in a trusted setup flow.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly sets up persistent on-disk storage for agent memory, user profiles, session state, and daily logs, but the installation and feature description do not clearly warn users about the privacy and retention implications. This can cause users to unknowingly store sensitive personal data or conversation history in local files that may later be synced, backed up, or exposed to other tools.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Installation
bash # Create workspace directory mkdir -p ~/workspace cd ~/workspace
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to capture every exchange and immediately persist names, preferences, decisions, corrections, and specific values into memory files. Persistently logging broad conversation content creates a real privacy and data-minimization risk, especially because sensitive information may be recorded without explicit consent or filtering.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation phrases are very broad generic productivity and organization terms such as 'create workspace', 'productivity', and 'knowledge management'. This can cause the skill to trigger in many unrelated user contexts, increasing the chance it influences conversations or file operations when the user did not specifically intend to invoke this workspace template.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to create and update daily and long-term memory files containing user context, decisions, and other remembered information, but does not present a clear user-facing privacy warning or consent flow. This creates persistent retention of potentially sensitive personal data that could later be exposed in shared contexts, backups, or compromise of the workspace.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Safety - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. - `trash` > `rm` (recoverable beats gone forever) - When in doubt, ask.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guidance allows the agent to search the web, check calendars, and otherwise access external services with minimal friction, while only partially distinguishing what requires approval. Without a clear user-facing warning about monitoring and external access, users may not realize the agent is authorized to inspect personal accounts or retrieve outside data on its own.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The heartbeat section encourages broad, recurring autonomous activity and references a configurable heartbeat prompt plus optional HEARTBEAT.md instructions. In a workspace skill, this can lead to overly permissive invocation and repeated background actions without clear scoping, increasing the chance of unintended monitoring, data access, or noisy proactive behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The heartbeat instructions authorize periodic checks, persistent writes to heartbeat-state.json, and proactive outreach based on what the agent finds, yet the skill description does not clearly warn that this behavior includes ongoing monitoring and stateful background operation. That combination can surprise users and normalize silent collection of behavioral and account-related metadata.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 84% confidence
- Finding
The skill explicitly authorizes proactive work 'without asking,' including reading and organizing memory files and checking projects, in a persistent workspace context. Even though intended for productivity, this delegates autonomous decisions over potentially sensitive local data and project state, which can lead to privacy issues, unintended modifications, or user surprise.
- Content
md - Nothing new since last check - You just checked <30 minutes ago **Proactive work you can do without asking:** - Read and organize memory files - Check on projects (git status, etc.)
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These protocols mandate pervasive logging of corrections, proper nouns, preferences, decisions, dates, IDs, and even every exchange into memory files before responding. This creates a strong data retention and context-leakage risk because highly sensitive personal or operational details may be persistently stored in natural language, duplicated across files, and later surfaced to other tools, users, or compromised processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The heartbeat checklist directs proactive review of daily notes, emails, calendar, and projects, which are likely to contain sensitive personal or business information, yet it does not instruct the agent to obtain fresh permission, limit scope, or avoid sensitive content. Because this skill is designed for autonomous proactive behavior, the missing warning and access constraints make inadvertent over-collection and privacy violations more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The template explicitly instructs the agent to update a persistent MEMORY.md file with distilled insights, but it provides no consent boundary, data minimization rule, or warning that user-related or sensitive information could be stored long-term. In a proactive workspace/memory skill, this increases the chance of retaining personal, confidential, or unnecessary data beyond the user's expectations.
- Content
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Bottleneck to eliminate? - Something they mentioned once? ## 🔄 Reverse Prompting (Weekly) Once a week, ask: 1. "What interesting things could I do that you haven't thought of?"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template explicitly prompts users to record personal background, preferences, important dates, relationships, and other ongoing context, which can include sensitive personal data. Because it provides no warning, minimization guidance, or handling restrictions, it normalizes persistent storage of potentially sensitive information in long-term memory files that may be broadly accessible to tools, sync services, or agents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The onboarding trigger is defined by broad file state checks and natural-language prompts, which can cause the agent to initiate onboarding without a clear, fresh user consent event. In a workspace skill that persists memory and updates profile files, unintended activation can lead to unnecessary collection of personal information and profile shaping based on incidental conversation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template asks for sensitive personal and professional context and later states that the agent will update USER.md and SOUL.md, but it does not clearly warn users that these details will be stored persistently and used to build a profile. In a memory-oriented workspace skill, that omission increases privacy risk because users may disclose data without understanding retention, propagation, or future reuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly instructs the agent to write daily notes to persistent memory and promote distilled content into long-term memory, but it provides no warning, consent mechanism, retention limits, or guidance on handling sensitive data. In a workspace template centered on agent memory persistence and personal knowledge management, this can cause users to unknowingly retain private or regulated information indefinitely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template explicitly encourages recording 'specific details' and says this is the 'ONLY place' such details are safe, but it provides no guardrails against storing secrets, personal data, credentials, tokens, or other sensitive session information. In a workspace and agent-memory context, this increases the likelihood that sensitive data will be persisted into a markdown file, retained longer than necessary, and exposed through syncing, version control, logs, or later prompt reuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file instructs the agent to treat workspace files as persistent memory and to read/update them every session, but it does not require explicit user consent, scope limits, or safeguards around what can be modified. In a workspace template built for agent memory persistence and file organization, this can lead to unauthorized or surprising changes to user data, accidental propagation of stale or sensitive information, and erosion of auditability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template explicitly encourages storing environment-specific details such as SSH hosts, camera locations, and device information, but it never warns against including secrets or sensitive operational data. In a productivity/agent-memory workspace, users may treat this file as a catch-all cheat sheet and accidentally record credentials, internal network details, or other sensitive data that could later be exposed through syncing, sharing, backups, or agent access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template explicitly states that it 'captures EVERY exchange' and 'survives compaction,' which implies persistent retention of potentially sensitive user and system content. Because there is no accompanying notice, consent mechanism, retention limit, or guidance to exclude secrets/PII, this creates a real privacy and data-retention risk rather than a purely theoretical issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manual setup instructions clone the repository and run a setup script, and the copy instructions recursively copy template files into a user workspace, but the README does not warn that these actions may overwrite files or modify existing workspace contents. This can lead to accidental data loss, state corruption, or unintended changes, especially because the skill is designed to initialize persistent agent memory and workspace structure.
- Content