T06 · System Persistence
Error
- Location
references/cron-patterns.md:3- Finding
Recurring OpenClaw Jobs Establish Persistent Autonomous Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Autonomous Agent Toolkit
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly for building autonomous agents, but its cron examples and generator script can persistently change files or trigger external actions with weak scoping.
Install only if you are comfortable reviewing and tightening the generated agent rules yourself. Before enabling any cron job, restrict what it may read and write, avoid prompts that execute arbitrary pending tasks, require approval for posting or external actions, keep the agent workspace under version control, and patch or avoid the generator's unsafe name/path handling.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_agent.py:8- Finding
Unsanitized Agent Name Permits Output-Path Traversal and File Overwrite
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises operational patterns that write files and configure cron-driven behavior, but it does not declare any explicit tool or permission scope. That mismatch can cause users or host systems to underestimate what the skill may do, increasing the chance of unintended file modification or networked actions without informed review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad enough to match common requests about agents, bots, or orchestration, which increases the likelihood of accidental invocation in contexts the user did not intend. Because this skill promotes autonomous setup and persistent behaviors, unintended activation could lead to risky guidance being surfaced in unrelated conversations.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The template explicitly instructs authors to define actions an agent may perform 'without asking,' which normalizes autonomous decision-making. Although framed as configuration guidance, this is risky in the context of agent orchestration because it can lead to overbroad authority, especially when combined with scheduled execution and persistent memory updates.
- Content
md - Ordered priority stack (what to do first, second, etc.) # Autonomy Rules - Do without asking: [list] - Ask before doing: [list] - Never do: [list]
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cron sections encourage autonomous scheduled execution and file updates, including MEMORY.md changes, without prominently warning that these runs may modify workspace state without real-time human review. In an automation-focused skill, that omission materially raises the risk of unattended actions, drift, and unsafe persistence of incorrect or harmful changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The nightly memory review example directs the agent to update MEMORY.md and remove outdated entries, which is a persistent record modification and deletion-like operation. Without a clear warning or stronger guardrails, operators may deploy a cron that silently rewrites or prunes memory, risking data loss, corruption of historical records, or drift in future agent behavior based on altered memory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This documentation explicitly instructs an autonomous cron to write and schedule content, which can cause external side effects without any embedded warning, approval gate, or operator confirmation step. In an agent-toolkit context, users may copy these patterns directly into production, so the absence of cautions around autonomous posting and file/state modification increases the risk of unintended actions, spam, policy violations, or changes to persistent data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
In this markdown template, the instruction "Is this irrelevant to 1-3? → Kill it." encourages irreversible action in natural language but provides no warning, confirmation requirement, or clarification of scope. As a reusable skill template, this could normalize destructive behavior without alerting users to the risk.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 87% confidence
- Finding
The template explicitly encourages authors to define actions an autonomous agent may perform 'without asking' but provides no built-in safety constraints, approval thresholds, or prohibition on irreversible operations. In a skill for creating autonomous agents, this can normalize unsafe autonomy and lead users to grant self-directed permissions for impactful actions such as deletion, spending, messaging, or system changes.
- Content
md 4. Is this irrelevant to 1-3? → Kill it. ## Autonomy Rules ### Do without asking: - [List specific actions] ### Ask before doing: - [List actions requiring approval]
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The generated SOUL.md explicitly authorizes the agent to 'Do without asking' for reading files, exploring, organizing, executing tasks within scope, and fixing broken things. In an autonomous-agent toolkit, this materially increases the chance of unsafe actions because 'defined scope' is not technically enforced and downstream agents may interpret it broadly, leading to unauthorized file access or actions without human approval.
- Content
python ## Autonomy Rules ### Do without asking: - Read files, explore, organize - Execute tasks within defined scope - Update memory and logs
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python ### Never do: - Modify own safety rules - Exfiltrate private data - Run destructive commands without confirmation - Ignore operator override requests ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python ## Red Lines - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. - `trash` > `rm` (recoverable beats gone forever) - When in doubt, ask. """)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Several cron examples force the timezone to America/Denver, which is a locale-specific setting presented as the default pattern. Because the document does not offer an opt-in choice or explain that the examples are region-specific, it may conflict with language/locale policy expectations.
- Content
Static analysis
No suspicious patterns detected.