ClawHub
Back to skill

Security audit

Enoch Tuning

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a coherent OpenClaw tuning package, but it also installs persistent agent behavior, broad automation defaults, sensitive X bookmark workflows, and permission-changing scripts that need careful review before use.

Review this before installing. The base templates may be useful, but do not run lock-identity.sh or enable the X bookmarks cron/posting workflow until you are comfortable with the exact files changed, the persistent memory model, the OAuth credential storage, and any messages sent to external channels. Prefer disabling AFK automation and auto-posting by default, fixing the OAuth script, and adding a manual approval step for any external action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)

T01 · Skill Instruction Hijacking

Error
Location
templates/AGENTS.md:1
Finding
Persistent Agent Authority and Behavioral Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `templates/AGENTS.md`, lines 1-12 **Vulnerability Type**: Persistent instruction and authority hijacking **Risk Level**: Critical ### Vulnerable Code ```markdown # AGENTS.md — Operating Rules ## Every Session 1. Read `SOUL.md` — who you are 2. Read `USER.md` — who you're helping 3. Read `memory/YYYY-MM-DD.md` (today + yesterday) 4. **Main session only:** Read `MEMORY.md` 5. Read `ops/changelog.md` — what changed since last session 6. Read `MISSION.md` — what are we working toward? ## Claude Code Coordination - **Claude Code is authoritative.** If Claude Code changed a config, cron, or file — that change stands. Never override or revert. If something looks wrong, flag it in the Ops topic instead. - `ops/changelog.md` is the shared bridge. Read it. Write to it. ``` Related autonomous instructions appear at lines 105-108: ```markdown ## AFK = Go to Work - **5+ minutes of silence = assume AFK.** Don't just pull from queue — ask: "What is 1 task that moves us closer to the mission right now?" (see MISSION.md) - Check in order: (1) anything broken/blocked I can fix? (2) research that sharpens a current front line? (3) memory/docs to improve? (4) production queue item that serves the mission? ``` ### Technical Analysis The installed template becomes a persistent OpenClaw operating prompt loaded in every session. It establishes an external component, Claude Code, as unconditionally authoritative and instructs the agent never to revert its changes. This authority rule can conflict with a current user request, a security decision, or a need to recover from a malicious or erroneous configuration change. The template also authorizes autonomous work after five minutes of inactivity. Although autonomous operation is part of the project's declared functionality, the rule is broad and is not limited to a predefined task list, restricted filesystem area, or fixed set of non-sensitive tools. These directives theref ...[truncated 1073 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Replace unconditional authority language with an explicit precedence rule: - System and developer safety requirements take priority. - The current authenticated user's instructions take priority over stored operational records. - Claude Code changes are evidence of system state, not irrevocable authority. - Permit rollback when a change is unsafe, compromised, or explicitly rejected by the user. - Make AFK automation opt-in and disabled by default. - Restrict autonomous work to a user-approved queue, workspace directory, tool allowlist, time window, and resource budget. - Require renewed approval before modifying configuration, creating cron jobs, contacting external services, or invoking sub-agents. - Record autonomous actions in an auditable log and provide a kill switch. ]]>

T01 · Skill Instruction Hijacking

Error
Location
integrations/x-bookmarks/research-prompt.md:8
Finding
Prompt Injection Exposure Through Untrusted Bookmark and Web Content<![CDATA[ ## Vulnerability Details **File Location**: `integrations/x-bookmarks/research-prompt.md`, lines 8-40 **Vulnerability Type**: Untrusted content passed into an agent workflow without instruction isolation **Risk Level**: High ### Vulnerable Code ```markdown ## Step 2 — Check for new Read `research/x-bookmarks-new.json`. If empty (`[]`), reply "No new bookmarks." and stop. ## Step 3 — Analyze each new bookmark For each bookmark in the trigger file: 1. **Fetch linked content** — for any external URLs in the tweet (non-X links), use `web_fetch` to get the article/page content. 2. **Quick web search** — one search per bookmark for additional context on the author, tool, or claim. 3. **Write a verdict:** - **ARCHIVE** — interesting but no action needed - **READ_DEEPER** — worth your time to dig into - **ACT_ON** — needs action (tag what kind) - **SHARE:person** — relevant to someone in your network - **BUILD:project** — connects to an active project 4. **Save brief** to `research/vetted/YYYY-MM-DD-{slug}.md` with YAML frontmatter: ```yaml --- source_url: [tweet URL] author: [@handle] verdict: [verdict] tags: [comma-separated] researched: [YYYY-MM-DD] --- ``` 5. **Post to your research channel** — one message per bookmark, tight format: - **@author** — one-line summary - Key finding (1-2 sentences) - Linked resources found - Verdict: **VERDICT** — why ``` The synchronized attacker-controlled text is populated by `integrations/x-bookmarks/scripts/x-bookmarks-sync.py`, lines 71-81: ```python for tweet in data.get("data", []): author = users.get(tweet["author_id"], {}) all_bookmarks.append({ "text": tweet["text"], "author": author.get("name", ""), "username": author.get("username", ""), "created_at": tweet.get("created_at", ""), "id": tweet["id"], "article_title": tweet.get("article", {}).get("title", "") }) ``` ### Technical Analysis ...[truncated 1613 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Add an explicit trust-boundary rule stating that tweets, metadata, search results, and fetched pages are untrusted data and must never be treated as instructions. - Quote or structurally delimit external content before passing it to the model. - Restrict `web_fetch` to `http` and `https`, block loopback, link-local, private-network, metadata-service, and local-file destinations, and validate redirects. - Do not allow fetched content to request tool calls, credential access, policy changes, or additional unrelated URLs. - Sanitize attacker-controlled values before using them in Markdown, YAML, filenames, or channel messages. - Require approval for consequential actions derived from `ACT_ON`, `SHARE`, or `BUILD` verdicts. - Run content analysis with a minimal tool set and no access to credentials or unrelated memory. ]]>

T01 · Skill Instruction Hijacking

Error
Location
integrations/x-bookmarks/research-prompt.md:34
Finding
Automated External Channel Posting Without an Explicit Per-Run Approval Gate<![CDATA[ ## Vulnerability Details **File Location**: `integrations/x-bookmarks/research-prompt.md`, lines 34-40 **Vulnerability Type**: Unapproved external action mandated by Skill instructions **Risk Level**: High ### Vulnerable Code ```markdown 5. **Post to your research channel** — one message per bookmark, tight format: - **@author** — one-line summary - Key finding (1-2 sentences) - Linked resources found - Verdict: **VERDICT** — why ## Rules - Don't try to web_fetch x.com URLs directly — X blocks scrapers. Use the API script. ``` The recurring execution guidance appears at lines 52-54: ```markdown ## Cron Setup (optional) To sync automatically every day at 10 AM, tell your agent: > "Set up a daily cron at 10 AM to run `python3 scripts/x-bookmarks-sync.py --detect-new` and analyze any new bookmarks." ``` ### Technical Analysis The protocol uses mandatory wording to post one message per processed bookmark. It does not require destination validation, review of the generated message, or approval immediately before sending. When combined with the optional daily cron, this creates a recurring path for externally sourced content to be published automatically. This also conflicts with `templates/AGENTS.md`, lines 73-76, which categorizes messages and public posts as actions that should be prepared for approval. ### Attack Path 1. The user enables the documented daily cron workflow. 2. New bookmarks are synchronized without interactive review. 3. The research protocol analyzes each bookmark, including attacker-controlled content. 4. The protocol instructs the agent to post one message for each item. 5. Messages are sent to the configured research channel without a per-run approval decision. ### Impact Assessment The workflow can send unwanted or attacker-influenced messages using the user's configured account or bot. Potential consequences include disclosure of private bookmark interests, spam, misleading statements, reputational damage, ...[truncated 75 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Change the default behavior from “post” to “save a local draft.” - Require explicit approval before each send unless the user has granted a narrowly scoped, revocable automation authorization. - Bind any automation grant to a verified channel identifier, maximum message count, content policy, and expiration time. - Display the destination and final rendered message before approval. - Ensure bookmark text cannot control routing, recipients, or message formatting. - Rate-limit scheduled output and stop the workflow when unexpected volume or malformed content is detected. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
integrations/x-bookmarks/scripts/x-bookmarks-auth.sh:21
Finding
OAuth Client Secret Exposed in Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `integrations/x-bookmarks/scripts/x-bookmarks-auth.sh`, lines 21-30 **Vulnerability Type**: Sensitive credential embedded in an inline interpreter argument **Risk Level**: High ### Vulnerable Code ```bash # Start listener — catches callback and exchanges code for token python3 -c " import http.server, urllib.parse, json, base64, requests, os CLIENT_ID = '$CLIENT_ID' CLIENT_SECRET = '$CLIENT_SECRET' REDIRECT_URI = '$REDIRECT_URI' CODE_VERIFIER = '$CODE_VERIFIER' CREDS_DIR = os.path.join(os.path.expanduser('~'), '.openclaw', 'credentials') TOKEN_FILE = os.path.join(CREDS_DIR, 'x-oauth-token.json') ``` ### Technical Analysis The shell expands `CLIENT_SECRET` into the argument passed to `python3 -c`. Consequently, the client secret becomes part of the process command line for as long as the callback listener is running. Depending on operating-system process visibility, another local user, monitoring agent, crash collector, or diagnostic tool may read that argument. Direct interpolation also creates a code-generation hazard: a credential containing quotes, backslashes, newlines, or other Python-significant characters can break or alter the generated inline program. The Base64 operation later in the script is legitimate OAuth Basic authentication and is not itself printed; the exposure arises from command-line interpolation. ### Attack Path 1. The user exports `X_OAUTH_CLIENT_SECRET` and starts `x-bookmarks-auth.sh`. 2. The shell expands the secret into the `python3 -c` command. 3. The Python process waits on the local callback port while the browser authorization flow is completed. 4. A local process-inspection mechanism reads the command-line arguments during this interval. 5. The attacker recovers the X OAuth application secret and may use it to impersonate the application where accepted by X. ### Impact Assessment The exposed privilege is the X application credential, not necessarily the user's acce ...[truncated 249 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Move the callback implementation into a standalone Python file. - Read `X_OAUTH_CLIENT_ID` and `X_OAUTH_CLIENT_SECRET` with `os.environ` inside Python rather than interpolating them into `-c`. - Prefer a protected credential file or operating-system secret store with owner-only permissions. - Clear unneeded exported variables after authentication. - Avoid logging request headers, token responses, or credential-bearing command lines. - Validate provider guidance on whether a client secret is necessary for the selected PKCE client type. - Add tests using credentials containing quotes and special characters to prevent code-generation defects. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
integrations/x-bookmarks/scripts/x-bookmarks-auth.sh:32
Finding
OAuth State Parameter Is Generated but Not Validated<![CDATA[ ## Vulnerability Details **File Location**: `integrations/x-bookmarks/scripts/x-bookmarks-auth.sh`, lines 32-47 **Vulnerability Type**: Missing OAuth CSRF and response-binding validation **Risk Level**: Medium ### Vulnerable Code The state value is created and included in the authorization URL: ```bash STATE=$(python3 -c "import secrets; print(secrets.token_hex(16))") AUTH_URL="https://x.com/i/oauth2/authorize?response_type=code&client_id=${CLIENT_ID}&redirect_uri=${REDIRECT_URI}&scope=${SCOPES// /%20}&state=${STATE}&code_challenge=${CODE_CHALLENGE}&code_challenge_method=S256" ``` However, the callback accepts any request containing a code: ```python class Handler(http.server.BaseHTTPRequestHandler): def do_GET(self): params = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query) if 'code' in params: code = params['code'][0] print('Got auth code, exchanging for token...') auth = base64.b64encode(f'{CLIENT_ID}:{CLIENT_SECRET}'.encode()).decode() resp = requests.post('https://api.x.com/2/oauth2/token', headers={'Authorization': f'Basic {auth}', 'Content-Type': 'application/x-www-form-urlencoded'}, data={ 'code': code, 'grant_type': 'authorization_code', 'redirect_uri': REDIRECT_URI, 'code_verifier': CODE_VERIFIER }) ``` ### Technical Analysis OAuth `state` binds the authorization response to the browser session that initiated the request and mitigates login CSRF and authorization-flow confusion. Although the script generates a random state value, the callback handler neither reads nor compares the returned `state`. The listener is bound to loopback, reducing remote exposure, but browser-driven requests, malicious local processes, and local applications can still reach it. PKCE protects the authorization code from being redeemed without the ver ...[truncated 898 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pass the expected state to the callback handler without exposing it in command-line arguments. - Require the callback to contain exactly one `state` value and compare it with the expected value using `secrets.compare_digest`. - Reject missing, duplicate, or mismatched state values before processing the authorization code. - Validate the callback path exactly as `/auth/callback`. - Add a short listener timeout and ignore unrelated requests rather than immediately shutting down. - Handle OAuth `error` responses explicitly and display a generic browser message without reflecting provider response bodies. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
setup/lock-identity.sh:27
Finding
Identity Locking Uses Unnecessary Root Ownership and World-Readable Permissions<![CDATA[ ## Vulnerability Details **File Location**: `setup/lock-identity.sh`, lines 27-36 **Vulnerability Type**: Excessive privilege use and insecure file permissions **Risk Level**: Medium ### Vulnerable Code ```bash MISSING=0 for f in SOUL.md AGENTS.md; do if [ ! -f "$WORKSPACE/$f" ]; then echo "❌ $f not found at $WORKSPACE/$f — did you copy the templates?" MISSING=1 fi done [ "$MISSING" -eq 1 ] && exit 1 sudo chown root:staff "$WORKSPACE/SOUL.md" "$WORKSPACE/AGENTS.md" sudo chmod 444 "$WORKSPACE/SOUL.md" "$WORKSPACE/AGENTS.md" echo "✅ SOUL.md → root-owned, read-only (444)" echo "✅ AGENTS.md → root-owned, read-only (444)" ``` ### Technical Analysis Root ownership is not required to protect ordinary user-owned workspace files from accidental modification. Invoking `sudo` expands the trust and operational impact of the setup script. Mode `0444` makes the files readable by the owner, group, and all other local users. This contradicts the script's stated concern that personalized operating rules should not be readable by untrusted local processes. The files may contain personal behavior rules, channel identifiers, operational procedures, and infrastructure details. The script checks only that the paths refer to regular files. It does not validate the canonical workspace location, current ownership, mount boundaries, or whether the user intentionally selected that target. ### Attack Path 1. The user runs the documented locking command and grants sudo access. 2. The script changes `SOUL.md` and `AGENTS.md` to root ownership. 3. Mode `0444` permits every local account to read the personalized files. 4. Another local user or compromised process reads operational details from them. 5. The user cannot edit or remove the files normally without further privileged operations. ### Impact Assessment The script obtains root-mediated authority to change ownership and permissions of user-selected files. It does not provide arbitrary root command ex ...[truncated 197 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Remove `sudo` and retain user ownership. - Use `chmod 400` for read-only private prompts or `chmod 600` when user editing is required. - If stronger integrity is needed, use a separately documented ACL, immutable attribute, signed hash, or version-control verification mechanism. - Resolve the workspace with a canonical path and ensure it is inside the expected OpenClaw workspace. - Refuse symbolic links and verify ownership before changing permissions. - Show the exact targets and requested changes, then obtain confirmation before applying them. - Provide a non-privileged and fully reversible unlock procedure. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
setup/lock-identity.sh:45
Finding
Identity-Locking Script Changes Permissions on Unrelated Operational Files<![CDATA[ ## Vulnerability Details **File Location**: `setup/lock-identity.sh`, lines 45-83 **Vulnerability Type**: Permission changes exceeding the declared identity-locking scope **Risk Level**: Medium ### Vulnerable Code ```bash AGENT_PROMPT="$WORKSPACE/agents/observer/AGENT_PROMPT.md" if [ -f "$AGENT_PROMPT" ]; then chmod 600 "$AGENT_PROMPT" echo "✅ agents/observer/AGENT_PROMPT.md → owner-only (600)" else echo "⏭️ AGENT_PROMPT.md not found — skipping (install Gideon first if needed)" fi DAILY_PROMPT="$WORKSPACE/agents/observer/daily-prompt.md" if [ -f "$DAILY_PROMPT" ]; then chmod 600 "$DAILY_PROMPT" echo "✅ agents/observer/daily-prompt.md → owner-only (600)" fi # ── CRON CONFIG ──────────────────────────────────────────────────────────────── JOBS_JSON="$OPENCLAW_DIR/cron/jobs.json" if [ -f "$JOBS_JSON" ]; then chmod 600 "$JOBS_JSON" echo "✅ cron/jobs.json → owner-only (600)" fi # ── OPENCLAW CORE CONFIG ────────────────────────────────────────────────────── OPENCLAW_JSON="$OPENCLAW_DIR/openclaw.json" if [ -f "$OPENCLAW_JSON" ]; then chmod 600 "$OPENCLAW_JSON" echo "✅ openclaw.json → owner-only (600)" fi # ── LAUNCHAGENT PLISTS ──────────────────────────────────────────────────────── PLIST_COUNT=0 for plist in "$LAUNCHAGENTS_DIR"/ai.openclaw.*.plist "$LAUNCHAGENTS_DIR"/com.openclaw.*.plist; do if [ -f "$plist" ]; then chmod 600 "$plist" echo "✅ $(basename $plist) → owner-only (600)" PLIST_COUNT=$((PLIST_COUNT + 1)) fi done ``` ### Technical Analysis The documented setup step is presented as locking the identity files, but it additionally modifies observer prompts, cron configuration, the core OpenClaw configuration, and all matching OpenClaw LaunchAgent property lists. Mode `0600` may be appropriate for confidential files when the owner is also the only required reader. The script does not verify that assumption. If a service, scheduler, management process, or separate account requires access, the permission chan ...[truncated 918 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Limit the identity-locking script to `SOUL.md` and `AGENTS.md`. - Move core configuration, cron, observer, and LaunchAgent hardening into separate opt-in commands. - Before changing a target, inspect its owner, group, current mode, service account, and documented runtime requirements. - Present a dry-run summary and require explicit confirmation. - Preserve original metadata so changes can be rolled back safely. - Avoid broad wildcard operations on LaunchAgent files unless every matched target has been validated. - Add post-change service checks and automatically restore original permissions if validation fails. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (75)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
There is a real description-behavior mismatch within the visible file: the skill markets itself as a broad, production-ready setup, but the documented actions are mainly template copying, directory creation, and identity-file locking. Overstating scope and under-describing security-relevant side effects like file permission locking can mislead users into running privileged or persistent changes they did not fully anticipate.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
There is a real description-behavior mismatch within the visible file: the skill markets itself as a broad, production-ready setup, but the documented actions are mainly template copying, directory creation, and identity-file locking. Overstating scope and under-describing security-relevant side effects like file permission locking can mislead users into running privileged or persistent changes they did not fully anticipate.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
There is a real description-behavior mismatch within the visible file: the skill markets itself as a broad, production-ready setup, but the documented actions are mainly template copying, directory creation, and identity-file locking. Overstating scope and under-describing security-relevant side effects like file permission locking can mislead users into running privileged or persistent changes they did not fully anticipate.

Credential Access

High
Category
Privilege Escalation
Content
NEW_FILE = os.path.join(WORKSPACE, "research/x-bookmarks-new.json")

def refresh_token():
    """Refresh the OAuth 2.0 access token using the refresh token."""
    with open(TOKEN_FILE) as f:
        token = json.load(f)
    with open(CREDS_FILE) as f:
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The code accesses a user's X account, downloads all bookmarks, and persists their contents into local research files, which is more invasive than the skill metadata suggests. In this context, bookmark contents may include sensitive personal, political, professional, or investigative material, so undisclosed collection and retention materially increases privacy and confidentiality risk.

Credential Access

High
Category
Privilege Escalation
Content
fi

# ── LAUNCHAGENT PLISTS ────────────────────────────────────────────────────────
# Plists can reveal script paths, Keychain service names, and monitoring targets.
PLIST_COUNT=0
for plist in "$LAUNCHAGENTS_DIR"/ai.openclaw.*.plist "$LAUNCHAGENTS_DIR"/com.openclaw.*.plist; do
  if [ -f "$plist" ]; then
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High
Category
Tool Misuse
Content
echo "Lock complete."
echo ""
echo "To edit locked files later:"
echo "  sudo chmod 644 $WORKSPACE/SOUL.md && \$EDITOR $WORKSPACE/SOUL.md && sudo chmod 444 $WORKSPACE/SOUL.md"
echo "  chmod 644 $WORKSPACE/USER.md && \$EDITOR $WORKSPACE/USER.md && chmod 600 $WORKSPACE/USER.md"
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
## Anti-Patterns (never do these)
- Don't explain how AI works
- Don't apologize for being an AI
- Don't ask clarifying questions when context is obvious
- Don't suggest "you might want to" — either do it or don't
- Don't add disclaimers to every action
Confidence
55% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
- Don't apologize for being an AI
- Don't ask clarifying questions when context is obvious
- Don't suggest "you might want to" — either do it or don't
- Don't add disclaimers to every action
- Don't read emails/messages back verbatim unless asked
- Don't explain what you're about to do — just do it, then report
- Don't let tool errors appear in chat without an immediate explanation
Confidence
93% confidence
Finding
Telling the agent not to add disclaimers and to 'either do it or don't' weakens natural safety friction and can discourage cautionary messaging in ambiguous or risky situations. In combination with other autonomy-oriented rules, this can make the agent more likely to execute unsafe actions without communicating limitations, risks, or need for approval.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The changelog advertises a workflow that automatically posts bookmark-derived analysis to a research channel, but it does not mention any consent gate, destination validation, content filtering, or privacy warning. In an agent framework that emphasizes automation and persistent integrations, this can lead to unintended transmission of private reading habits, sensitive bookmark content, or derived insights to external systems without the user fully appreciating the disclosure.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Why the Automation Tiers Are Where They Are

The system defines three tiers of behavior:
1. **Fully automated** — runs without asking
2. **Prepped for approval** — prepares the action, waits for go-ahead
3. **Never without explicit instruction** — hard stop regardless of context
Confidence
82% confidence
Finding
The phrase 'Fully automated — runs without asking' establishes autonomous decision-making as a supported operating mode. While the surrounding text does distinguish some higher-risk actions, the overall skill context promotes a production-ready agent that acts independently, which can still cause unintended internal changes, mistaken executions, or unsafe chaining if safeguards are incomplete or misunderstood.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document encourages the agent to take self-directed action during idle time by asking what it can do right now and then 'does the work,' but it does not clearly warn that such autonomy may modify files, queues, logs, or system state unexpectedly. In a tuning package for an autonomous agent, this increases the chance of silent drift, accidental changes, or persistence of unwanted artifacts when the user is absent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This section explicitly endorses persistent memory, daily logs, typed memory, and automatic consolidation of raw notes without any accompanying warning about privacy, retention, or unintended capture of sensitive data. In an agent skill marketed as production-ready, normalizing autonomous file-writing and long-term storage can lead users to enable behaviors that persist personal, operational, or credential-adjacent information without informed consent or clear boundaries.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## The Problem

Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking.

Then they either give up or spend months iterating toward something useful.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## The Problem

Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking.

Then they either give up or spend months iterating toward something useful.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## The Problem

Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking.

Then they either give up or spend months iterating toward something useful.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## The Problem

Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking.

Then they either give up or spend months iterating toward something useful.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## The Problem

Most people who set up an AI agent get a blank slate. No memory, no personality, no rules. They spend weeks figuring out why it keeps forgetting things, why it sounds like a chatbot, why it does stupid things without asking.

Then they either give up or spend months iterating toward something useful.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
**This skill skips all of that.**

What you're installing is a battle-tested identity, memory architecture, and operating protocol — built from months of real-world daily use. It makes your agent actually behave: pushing back when you're wrong, remembering what matters, doing work while you sleep, and knowing the difference between "run without asking" and "never without permission."

---
Confidence
76% confidence
Finding
This section promotes behavior where the agent can distinguish between 'run without asking' and 'never without permission,' which implies some tasks may execute autonomously. In a production-ready agent skill, normalizing autonomous execution without defining strict default-deny boundaries can lead to unintended file or workflow changes.

Session Persistence

Medium
Category
Rogue Agent
Content
cp skills/enoch-tuning/templates/USER.md USER.md
cp skills/enoch-tuning/templates/MEMORY.md MEMORY.md
cp skills/enoch-tuning/templates/MISSION.md MISSION.md
mkdir -p ops
cp skills/enoch-tuning/templates/ops/verification-protocol.md ops/verification-protocol.md
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The README explicitly advertises that the agent may 'work while you're AFK' and execute mission-oriented tasks, but it does not clearly warn users that autonomous actions can modify files, memory, task queues, or other local state even when no user is present. In an agent-installation skill, that omission matters because users may enable the setup expecting convenience without fully understanding the scope of unattended changes.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises installation steps that copy files into the user's workspace and execute shell scripts, yet it declares no explicit tool scope or permissions. That creates a transparency and trust gap: users and security tooling cannot easily understand that local file modification and command execution are required before installation.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The installation instructions direct users to copy files into ~/.openclaw/workspace and run shell scripts, but they provide no explicit warning that local files will be created, overwritten, or permission-changed. This is dangerous because users may execute the commands without understanding persistence, overwrite risk, or the consequences of running unreviewed shell scripts.

Session Persistence

Medium
Category
Rogue Agent
Content
cp skills/enoch-tuning/templates/ops/verification-protocol.md ~/.openclaw/workspace/ops/verification-protocol.md
```

### Step 2 — Create memory structure
```bash
bash skills/enoch-tuning/setup/memory-structure.sh ~/.openclaw/workspace
```
Confidence
86% confidence
Finding
The skill intentionally creates a long-term memory structure under the user's workspace, which introduces session persistence. Persistent memory can accumulate sensitive personal, project, or operational data over time, and in this context the skill heavily encourages identity, user, mission, and memory files, increasing privacy and data-retention risk.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- **Hard Rules section in SOUL.md** — these are non-negotiable behavioral guardrails
- **Idiot Prevention Protocol in AGENTS.md** — protects your infrastructure from chat-based config changes
- **Verification Protocol** — removing this reintroduces stale data and fake completions
- **Automation tiers** — the boundary between "runs without asking" and "never without instruction" is load-bearing

## File Structure
Confidence
75% confidence
Finding
The skill explicitly promotes 'automation tiers' including actions that may 'run without asking,' which normalizes autonomous execution in a package that also performs file-system setup and persistent configuration. In a general agent-tuning context, encouraging silent execution raises the risk of unintended changes if boundaries are misconfigured or inherited too broadly.