Agent Autopilot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:04 PM UTC
• Version: 1.4.1

Overview

This skill is not overtly malicious, but it should be reviewed carefully because it creates an unbounded autonomous heartbeat loop and persistent memory rewriting.

Install only in an isolated workspace with limited tool permissions. Before enabling heartbeat automation, edit the templates to require explicit approval for new tasks, external APIs, commits, network use, destructive or account-impacting actions, and any MEMORY.md rewrite; keep version history for memory files and avoid attaching real trading, financial, or production credentials until those controls exist.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:80

Finding

Persistent Heartbeat Instruction Hijacking Enables Unbounded Autonomous Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 80-90; repeated in SKILL.md, lines 371-381 and references/example-setup.md, lines 94-104
Vulnerability Type: Persistent agent instruction hijacking
Risk Level: High

Vulnerable Code Segment

The following is an English rendering of the complete relevant source segment from SKILL.md, lines 80-90:

markdown

You are a self-driving project manager. Whenever a heartbeat is received,
begin working immediately and do not reply with HEARTBEAT_OK.

Execution process:
1. Use todo.sh to view the task list.
2. If an in-progress task exists, continue executing it and advance it.
3. If a pending task exists, select the highest-priority task, change it to
   in-progress, and begin executing it immediately.
4. If all tasks are complete but the goal has not been achieved, analyze the
   project, autonomously create a new task, and continue.
5. After execution, update the task status and record the result in memory.
6. Do not stop to ask a supervisor what to do; decide the next step yourself.

Never remain idle. Every heartbeat must advance the project. Do not stop
until the goal has been achieved.

The persistent template reinforces these rules in SKILL.md, lines 419-426:

markdown

## Absolute Rules
- Do not wait for instructions from a supervisor.
- Do not hesitate over direction.
- Make and execute decisions autonomously.
- Find solutions independently when problems occur.
- Proactively report on schedule.
- Never stop before the target is achieved.
- Memory maintenance must never be skipped.

Technical Analysis

The Skill instructs users to copy these directives into the agent's persistent HEARTBEAT.md. The directives replace normal heartbeat behavior with mandatory task execution, expressly suppress the ordinary idle response, discourage consultation with the user, and permit the agent to create additional tas ...[truncated 2339 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove directives that suppress the normal heartbeat acknowledgment or require work on every heartbeat.
2. Replace autonomous execution with a bounded status check. A heartbeat should report pending work or propose one next action, not execute it automatically.
3. Require explicit user approval before:
   • Creating new tasks.
   • Invoking shell commands or external tools.
   • Modifying project files.
   • Sending messages or making network requests.
   • Continuing after the assigned task list is exhausted.
4. Define objective completion conditions and a maximum number of actions, tool calls, or elapsed time per heartbeat.
5. Add a safe idle state that returns HEARTBEAT_OK when no previously authorized action is pending.
6. Preserve escalation requirements for ambiguous goals, project-direction changes, destructive operations, external resource use, and repeated failures.
7. Ensure persistent templates cannot override higher-priority platform, user, or safety instructions.
8. Add a user-visible audit log recording every heartbeat-triggered action, authorization basis, tool call, and resulting modification.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:255

Finding

Mandatory Long-Term Memory Rewriting Persists Skill-Controlled Behavioral Rules

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 255-273; reinforced at lines 404-413 and 440-446
Vulnerability Type: Agent long-term memory poisoning
Risk Level: High

Vulnerable Code Segment

The following is an English rendering of the complete relevant source segment from SKILL.md, lines 255-273:

markdown

## Scheduled Task 3: Long-Term Memory Maintenance, Every Six Hours

On each heartbeat, determine whether memory maintenance is required by
reading lastMemoryReview from memory/report-state.json.

Decision logic:
- If more than six hours have elapsed since lastMemoryReview, or its value is
  null, perform memory maintenance.
- Otherwise, skip it.

Maintenance process:
1. Read memory/YYYY-MM-DD.md logs created since the previous maintenance.
2. Extract the following information into MEMORY.md:
   - Milestones: major project progress.
   - Lessons: failed approaches, pitfalls, and effective methods.
   - Key data: important metric changes.
   - Configuration changes: environment, parameters, and toolchain changes.
   - Decision records: important decisions and their reasons.
3. Remove information from MEMORY.md that is considered outdated.
4. Merge duplicate entries and preserve a clear structure.
5. Update lastMemoryReview in report-state.json.

Principle: preserve important detail and data, organize entries by project or
topic, and mark important entries with dates. Do not delete the original log
files. Memory maintenance must not be skipped because it is the basis of the
agent's continuous operation.

The installation checklist in SKILL.md, lines 440-446, also requires persistent behavioral rules to be written into memory:

markdown

1. Create the agent workspace.
2. Write the identity files.
3. Write MEMORY.md with the complete core rules, including timestamps,
   version control, deletion rules, tool assignment, reporting, and task
   management.
...[truncated 2977 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not store Skill-controlled behavioral policies, role definitions, safety constraints, or tool-routing instructions in long-term memory.
2. Restrict MEMORY.md to user-approved project facts, decisions, and durable preferences.
3. Make memory consolidation opt-in and require explicit user approval before replacing or deleting existing entries.
4. Use append-only proposals for automated consolidation. Present additions and removals as a reviewable diff before applying them.
5. Treat daily logs as untrusted input. Validate provenance and separate observations from verified facts.
6. Store scheduling metadata such as lastMemoryReview only in a dedicated state file; it does not need to modify semantic agent memory.
7. Prohibit automated removal of safety constraints, user instructions, identity information, or project boundaries.
8. Add integrity controls, version history, and rollback support for every memory modification.
9. Define precedence rules ensuring that persistent memory cannot override current user instructions or platform safety policies.
10. Remove mandatory wording such as “must not be skipped” and allow memory maintenance to remain inactive unless the user explicitly enables it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The memory-maintenance flow instructs the agent to modify MEMORY.md and 'clean up outdated information' automatically, which can overwrite or remove important instructions, context, or evidence without user review. In a long-running autonomous agent, self-editing core memory is particularly dangerous because it can silently change future decision-making and erase provenance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill content is written predominantly in Chinese and directly instructs the agent workflow in that language without any user opt-in or fallback. Forcing a language/locale can cause misunderstandings, incorrect execution, or inaccessible outputs when the user expects another language, which is especially risky in an autonomous skill that drives tasks, reporting, and state updates.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The rule commit message 用中文 mandates a specific language for output without offering user choice or documenting a justified locale constraint. This is a natural-language policy issue because it imposes a language requirement rather than allowing user preference.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a generic self-driving agent workflow with heartbeat task execution, reporting, memory consolidation, and todo integration. This example file instead operationalizes the skill for cryptocurrency quantitative strategy iteration with performance targets like Sharpe ratio, annualized return, and trade count, materially expanding the apparent purpose from workflow automation into domain-specific trading activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The heartbeat instructions direct the agent to automatically update todo state and append to memory logs on every cycle without any explicit user consent, dry-run mode, or warning that workspace files will be modified persistently. In an autopilot skill, silent repeated writes increase the chance of unintended state changes, audit noise, and corruption of user workspace data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation instructs the agent to update report-state.json after reporting, creating silent persistent state changes that affect future behavior. Because this file drives scheduling and reporting logic, unnoticed or malformed updates can alter execution cadence, suppress reports, or cause unintended loops.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The example commands invoke todo.sh to create groups and entries, which changes local task-management state. The markdown does not explicitly warn that running these commands will alter the local todo database and workspace records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This shell script creates directories under the user-supplied workspace and may recursively copy a skill into that workspace. Although the actions are visible in code comments and some success messages are printed after the fact, there is no prior confirmation or explicit warning that running the script will modify files at the provided path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script initializes a JSON state file in the workspace memory directory, which is a persistent file write affecting user data in that path. It only reports creation after the write succeeds and does not warn beforehand that initialization will create state-tracking files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.