Proactive Agent Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:44 AM UTC
• Version: 1.0.0

Overview

This skill openly teaches proactive automation, but it also encourages persistent memory, broad monitoring, and unattended scheduled agent runs without enough user-control safeguards.

Review this skill carefully before installing. It is not shown to contain hidden code or exfiltration, but only use it if you are prepared to explicitly limit which services it may check, keep memory files out of source control and sync systems, redact sensitive data, approve anything promoted to long-term memory, and manage any cron jobs with clear listing, pausing, and removal procedures.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:150

Finding

Unattended Scheduled Tasks Create Cross-Session System Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 150-157; related guidance at lines 36-39 and 90-94
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Content:

bash

### 3. Creating Autonomous Crons
```bash
# Create cron job for daily maintenance
0 8 * * * openclaw run --task "daily-maintenance"
0 20 * * * openclaw run --task "evening-review"

# Weekly optimization
0 9 * * 1 openclaw run --task "weekly-optimization"

text

Related instructions explicitly recommend scheduled, context-aware automation and direct the user to configure heartbeat intervals and autonomous cron schedules.

### Technical Analysis

The skill recommends installing recurring jobs that invoke `openclaw run` without requiring renewed approval for each execution. These jobs survive the initial skill invocation and continue to run in later sessions. The document does not define immutable task implementations, an approved-task allowlist, execution privilege restrictions, audit requirements, or a removal procedure.

Although scheduling automation is an advertised feature rather than concealed behavior, the proposed implementation creates a durable execution mechanism. If a referenced task definition, persistent memory file, or agent instruction is subsequently compromised, the cron schedule can repeatedly trigger attacker-influenced behavior.

### Attack Path

1. A user follows the skill instructions and installs one or more recurring cron entries.
2. An attacker influences a referenced task definition or persistent state used by that task, such as through prompt injection or unauthorized workspace modification.
3. At the next scheduled time, cron invokes `openclaw run` without obtaining fresh user approval.
4. The agent loads the compromised task or state and performs the influenced actions.
5. The cron entry continues triggering the behavior until it is discovered and manually removed.

### 
...[truncated 519 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user approval before installing each schedule.
• Use a strict allowlist of reviewed task identifiers and bind schedules to immutable or integrity-verified task definitions.
• Run scheduled tasks under a dedicated least-privilege account with narrowly scoped filesystem and integration permissions.
• Prevent scheduled tasks from automatically treating persistent memory or external messages as executable instructions.
• Record each installation, modification, execution, and failure in an auditable log.
• Provide documented commands for listing, pausing, and removing every installed schedule.
• Add execution timeouts, rate limits, and failure thresholds that automatically disable repeatedly failing jobs.
• Prefer notification-only scheduled checks, followed by user approval for consequential actions.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:24

Finding

Unsanitized Conversation Content Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-34; related workflow at lines 53-57 and guidance at lines 162-175
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Content:

markdown

### 1. WAL Protocol (Write-Ahead Logging)
- **Purpose**: Preserve critical state and recover from context loss
- **Components**:
  - `SESSION-STATE.md` - Active working memory (current task)
  - `working-buffer.md` - Danger zone log
  - `MEMORY.md` - Long-term curated memory

### 2. Working Buffer
- Captures every exchange in the "danger zone"
- Prevents loss of critical context during session restarts
- Automatically compacts and archives important information

The later workflow directs the agent to capture critical exchanges, move selected information into MEMORY.md, and restore state from those logs after restart. The best-practice section also recommends logging everything and automatic recovery.

Technical Analysis

Conversation text is an untrusted input channel. Capturing every exchange, compacting it, promoting selected content into long-term memory, and restoring it in later sessions creates a path by which attacker-authored instructions can acquire persistent influence.

The skill does not require provenance metadata, trust labels, instruction-versus-data separation, prompt-injection filtering, integrity checks, or user approval before content is promoted into MEMORY.md. Summarization or compaction does not neutralize malicious instructions and may remove context that originally identified the content as untrusted.

Attack Path

1. An attacker supplies instruction-like content through a conversation or through information that the agent processes.
2. The working-buffer process records the content because it captures every exchange or considers it important.
3. During compaction, the malicious content is summarized or copied into MEMORY.md without ...[truncated 765 chars]

Remediation

View remediation

Remediation Suggestions

• Do not automatically promote conversation-derived instructions into long-term memory.
• Store external and conversational content as quoted data rather than authoritative agent instructions.
• Attach source, timestamp, author, trust level, and original context metadata to every retained item.
• Require explicit user review before promoting content from a working buffer into MEMORY.md.
• Detect and quarantine instruction-like text, requests to override policies, encoded payloads, and content that attempts to control future sessions.
• Maintain separate storage for trusted configuration and untrusted observations; never merge them during compaction.
• Apply integrity protection and version history to memory files, with user-visible rollback and deletion controls.
• On recovery, restore factual task state only and never automatically execute actions derived from restored content.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:131

Finding

Overbroad Plaintext Retention of Conversations and Personal-Service Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 131-147; related collection and retention guidance at lines 27-34, 54-67, and 162-173
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Content:

bash

### 2. Setting Up Heartbeats
```bash
# HEARTBEAT.md Template
# Check every 30 minutes

## Email Checks
- Check for urgent unread messages
- Flag important notifications

## Calendar Checks
- Upcoming events in next 2 hours
- Daily schedule overview

## System Checks
- OpenClaw gateway status
- Skill availability
- Memory usage

text

Elsewhere, the skill states that the working buffer captures every exchange and recommends logging everything. It proposes storing this information in workspace Markdown files without defining protection controls.

### Technical Analysis

Email messages, calendar entries, complete conversations, and system-health details may contain personal information, authentication material, confidential business data, internal host information, or other secrets. The skill encourages broad collection and persistent storage but does not define data minimization, redaction, encryption, restrictive file permissions, per-source authorization, or enforceable retention and deletion controls.

Plaintext Markdown state files may be exposed to other local users, unrelated tools, workspace synchronization, source-control commits, or backup systems. The stated 30-day retention setting is only an example configuration and is not accompanied by implementation or enforcement guidance.

### Attack Path

1. A user enables heartbeat checks and persistent logging.
2. Sensitive content appears in a conversation, unread email, calendar event, or system-status response.
3. The agent records the content or a detailed summary in a workspace Markdown file.
4. The file is copied into a backup, synchronized, committed to source control, or read by
...[truncated 580 chars]

Remediation

View remediation

Remediation Suggestions

• Replace “captures every exchange” and “log everything” with explicit data-minimization rules.
• Require separate opt-in authorization for email, calendar, system monitoring, and conversation retention.
• Store only the minimum metadata needed for the task instead of complete message or event content.
• Redact credentials, tokens, personal identifiers, message bodies, and confidential fields before persistence.
• Encrypt sensitive state at rest and use restrictive owner-only filesystem permissions.
• Exclude memory files from source control, ordinary synchronization, and unprotected backups.
• Implement enforceable expiration, secure deletion, and user-accessible inspection controls.
• Document exactly what is collected, why it is retained, where it is stored, and which processes can access it.
• Avoid recording service data when a transient notification or boolean status is sufficient.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promotes autonomous checks of email, calendar, weather, and system status without requiring explicit consent, scoping, or data-handling safeguards. In an agent environment with connected tools, this can normalize ongoing monitoring of sensitive personal and system data and lead to privacy violations or unexpected automated actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'USE this skill when' list includes generic phrases like 'Automate routine checks' and 'Schedule automated tasks' without clear boundaries, exclusions, or negative examples. In a markdown skill description, this can cause the skill to match many ordinary user requests rather than a narrowly defined proactive-agent context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Instructing the agent to capture every exchange in a persistent working buffer creates a clear risk of storing secrets, personal data, and sensitive business information without minimization. Persistent logs can later be surfaced, reused, or exposed beyond the user's expectations, increasing confidentiality risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The WAL workflow explicitly directs the agent to record critical exchanges and promote important content into long-term memory, which can accumulate sensitive conversational data over time. Without classification and minimization controls, this creates durable privacy and data-governance risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The cron examples encourage persistent autonomous execution, which increases the attack surface and can perpetuate unsafe behavior or unintended actions across sessions if tasks are misconfigured. In the context of a proactive agent skill, unattended scheduled execution is more dangerous because it can repeatedly access tools or data without fresh user intent checks.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

3. Creating Autonomous Crons

bash

# Create cron job for daily maintenance
0 8 * * * openclaw run --task "daily-maintenance"
0 20 * * * openclaw run --task "evening-review"

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to 'log everything' broadens retention behavior and encourages indiscriminate storage of critical details, which likely includes credentials, personal data, and confidential user context. This is especially risky in agent systems that may later retrieve or act on stored memory automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.