T06 · System Persistence
Error
- Location
HEARTBEAT.md:26- Finding
Persistent Autonomous Agent Execution Through Cron
- Content
View full analysis
- Remediation
View remediation
Security audit
Autonomous Agent CEO Architecture by Emergence
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed autonomous CEO-agent setup, but its server, credential, GitHub-write, root-shell, global-install, and cron guidance is too broad for unsupervised use without review.
Review this carefully before installing. Run it only as a dedicated non-root user in a test or tightly scoped repository, use least-privilege GitHub tokens, avoid plaintext .env secrets where possible, pin and verify the OpenClaw runtime, and leave cron disabled until every scheduled skill and approval boundary has been reviewed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
docs/quickstart.md:31- Finding
Unpinned Global Installation of a Privileged Third-Party Runtime
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
docs/two-tier-setup.md:28- Finding
Agent Setup and Runtime Installation Are Performed from a Root Shell
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (28)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## Topic <!-- What should the content be about? --> ## Target Audience
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## Format <!-- Blog post (2-3k words)? Social thread? Technical deep-dive? --> ## Key Points
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## What Happened <!-- Describe the failure or anomaly --> ## Severity
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## Background <!-- What prompted this directive? A news item? A competitor move? A strategic gap? --> ## Objective
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## Expected Output <!-- Blog post? Social campaign? Research report? Infrastructure change? -->
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ./scripts/scaffold.sh /path/to/your/workspace # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ./scripts/scaffold.sh /path/to/your/workspace # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime) # openclaw gateway start # OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime) # openclaw gateway start # OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime) # openclaw gateway start # OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime) # openclaw gateway start # OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime) # openclaw gateway start # OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime) # openclaw gateway start # OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # 3. Configure your environment cp .env.example .env # Edit .env with your LLM API key and GitHub repo info # 4. Start the agent (choose your runtime) # openclaw gateway start # OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The setup directs users to store LLM API keys and GitHub information in a .env file, which is a direct credential-handling pattern. Because the same environment is used by autonomous agents with repo access, compromise of that file could expose both billing-sensitive model credentials and code-hosting permissions, enabling downstream abuse.
- Content
4. Configure Environment
bash cp .env.example .env # Edit with your LLM API keys and GitHub info
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The schedule lists triggers such as "CEO Heartbeat," "Pulse Signal," "Performance Review," and "Competitor Scan" without defining the exact activation phrases, scope boundaries, or exclusion conditions. Several of these labels are broad natural-language phrases that could overlap with ordinary operational language, making unintended invocation or misconfiguration more likely.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # Edit crontab crontab -e # CEO heartbeat: every hour during business hours 0 9-18 * * 1-5 cd /path/to/emergence-agent-ceo && openclaw run --skill ceo-heartbeat
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly promotes a 24/7 autonomous agent that performs proactive tasks and produces output through GitHub coordination, but it does not warn users about the risks of unsupervised actions, over-permissioned tokens, unintended issue/PR activity, or harmful automation. In the context of a deployable multi-agent system, this omission can lead operators to run the system with insufficient human review and overly broad access, increasing the chance of real-world damage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description promotes continuous server-side autonomous operation and mentions use of external credentials, but it does not prominently warn users about the risks of unattended execution, GitHub write actions, or API key exposure. That omission increases the chance users deploy the system with excessive privileges or without understanding that agents may act continuously and create or modify artifacts autonomously.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill allows strategic intent to arrive via 'GitHub Issue or IM message' without defining a trusted source, authorization checks, or how such messages trigger agent actions. In a 24/7 autonomous multi-agent system with delegation and GitHub write capabilities, ambiguous activation channels can let untrusted or spoofed inputs cause unauthorized task creation, research actions, or downstream PR generation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill defines an earlier safety boundary that strategic decisions must be escalated to a human, but later states 'I handle the execution' and frames the human as not a 'taste gate,' which weakens the approval and oversight model. In an autonomous multi-agent system with GitHub task delegation and continuous operation, this ambiguity can be interpreted by the agent as authority to act on strategic or operational decisions without meaningful human review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide instructs users to copy and edit a .env file with LLM API keys and GitHub repository credentials but does not warn about secret handling, least privilege, or accidental exposure. In an autonomous multi-agent setup running on a VM, stored secrets are especially sensitive because multiple components may access them and users may be more likely to leave them in plaintext or commit them accidentally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The quickstart tells users that sub-agents will commit drafts and open PRs automatically, but it does not clearly warn that enabling the system grants autonomous write activity against the repository. In this skill context, the agent is explicitly designed to run continuously and act as a CEO delegating to sub-agents, which increases the risk of unintended code, content, or workflow changes if users do not understand the level of autonomy.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide instructs operators to copy and populate a .env file with LLM API keys and GitHub credentials but gives no guidance on secret storage, file permissions, exclusion from version control, or use of least-privilege tokens. In a repo-centered autonomous agent setup, this increases the chance of accidental disclosure through commits, logs, backups, or broad host access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document schedules unattended cron execution of autonomous agent skills that can act on a shared GitHub repository and local VPS workspace, but it does not warn users about continuous autonomous actions, review boundaries, or failure modes. In this skill's context, the agent is explicitly designed to operate as a CEO delegating tasks 24/7, which makes unreviewed persistence materially more dangerous than ordinary automation.
- Content
Static analysis
No suspicious patterns detected.