Proactive Agent Skill 1.0.0

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:13 AM UTC
• Version: 1.0.0

Overview

This skill is not deceptive, but it asks agents to persist conversation data, check private sources, and run recurring automation without enough consent, scoping, or safety boundaries.

Review this skill carefully before installing. Use it only if you explicitly want cross-session memory and scheduled automation, and configure it to avoid storing secrets, credentials, private messages, regulated data, or full transcripts. Do not enable email/calendar checks or cron jobs unless each account, schedule, task, writable path, retention period, and removal process is clearly defined.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:149
• Finding: Persistent Autonomous Execution Through Recurring Cron Jobs## Vulnerability Details **File Location**: `SKILL.md`, lines 149–158 **Vulnerability Type**: Recurring scheduled-task persistence **Risk Level**: High **Vulnerable Code:** ```bash # Create cron job for daily maintenance 0 8 * * * openclaw run --task "daily-maintenance" 0 20 * * * openclaw run --task "evening-review" # Weekly optimization 0 9 * * 1 openclaw run --task "weekly-optimization" ``` ### Technical Analysis The skill directs users or agents to install recurring cron jobs that execute OpenClaw tasks after the original interaction has ended. This establishes cross-session persistence. The behavior and permitted operations of `daily-maintenance`, `evening-review`, and `weekly-optimization` are not defined or constrained in the audited package. The instructions do not require explicit approval for each execution, a dedicated least-privileged account, restricted writable paths, execution timeouts, or an expiration date. Consequently, these persistent jobs could repeatedly execute later-defined or modified task behavior with the permissions available to the OpenClaw process. ### Attack Path 1. The skill is loaded to configure proactive automation. 2. A user or agent follows the supplied cron setup instructions. 3. Persistent cron entries are installed for the OpenClaw process. 4. The scheduler invokes the underspecified tasks twice daily and once weekly. 5. If task definitions are subsequently modified, compromised, or resolved from an untrusted source, cron continues executing the changed behavior without contemporaneous user review. 6. The jobs retain the filesystem and service access of the account running OpenClaw. ### Impact Assessment Successful exploitation could provide repeated cross-session execution with the privileges of the OpenClaw account. Depending on that account's permissions and the eventual task definitions, the execution could read or modify workspace files, alter agent state, process ...[truncated 234 chars]
• Remediation: ## Remediation Suggestions - Do not install recurring jobs by default. - Require informed user approval for every exact command, schedule, task definition, and permission scope. - Fully define and review each task before scheduling it. - Run scheduled jobs under a dedicated least-privileged account with narrowly restricted filesystem and network access. - Use absolute executable paths, a minimal environment, execution timeouts, locking, and integrity-checked task definitions. - Prefer user-triggered jobs or schedules that automatically expire. - Display installed jobs clearly and provide tested commands for disabling and removing them. - Require renewed authorization before a scheduled task definition can change.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:24
• Finding: Indiscriminate Plaintext Retention of Conversation and Task Data## Vulnerability Details **File Location**: `SKILL.md`, lines 24–33, 52–57, and 163–174 **Vulnerability Type**: Unsafe persistent storage of potentially sensitive information **Risk Level**: High **Vulnerable Code:** ```markdown ### 1. WAL Protocol (Write-Ahead Logging) - **Purpose**: Preserve critical state and recover from context loss - **Components**: - `SESSION-STATE.md` - Active working memory (current task) - `working-buffer.md` - Danger zone log - `MEMORY.md` - Long-term curated memory ### 2. Working Buffer - Captures every exchange in the "danger zone" - Prevents loss of critical context during session restarts - Automatically compacts and archives important information ``` ```markdown ### WAL Protocol Workflow 1. **Capture**: Log all critical exchanges to working buffer 2. **Compact**: Periodically review and extract key insights 3. **Curate**: Move important information to MEMORY.md 4. **Recover**: Restore state from logs after restart ``` ```markdown ### 1. Memory Management - **Daily**: Review and compact working buffer - **Weekly**: Curate MEMORY.md from daily logs - **Monthly**: Archive and cleanup old files ### 2. Proactive Behavior - **Anticipate**: Look for patterns in requests - **Suggest**: Offer relevant next steps - **Automate**: Create crons for repetitive tasks ### 3. Error Recovery - **Log everything**: Critical details to working buffer ``` ### Technical Analysis The skill recommends capturing every exchange and critical task detail in workspace Markdown files, then moving selected data into long-term memory. These instructions do not define secret detection, personal-data minimization, informed consent, restrictive file permissions, encryption, source-control exclusions, secure deletion, or enforceable retention limits. Conversations and tool results can contain credentials, authentication tokens, personal information, confidential business data, ...[truncated 1808 chars]
• Remediation: ## Remediation Suggestions - Replace “captures every exchange” and “log everything” with data-minimizing, explicit allowlist-based retention. - Obtain informed user consent before retaining any information across sessions. - Never persist passwords, API keys, access tokens, authentication cookies, recovery codes, private keys, or unnecessary personal data. - Apply secret and personal-data detection before writing records and redact sensitive values. - Store only concise facts specifically selected for future use, rather than complete transcripts. - Enforce restrictive file permissions and encrypt sensitive persistent state where appropriate. - Exclude memory files from source control, public synchronization, and unnecessary backups. - Implement enforceable retention periods, user-visible inspection, selective deletion, and secure cleanup. - Treat all restored text as untrusted data rather than higher-priority instructions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:60
• Finding: Overbroad Recurring Access to Email and Calendar Data## Vulnerability Details **File Location**: `SKILL.md`, lines 60–67 and 133–146 **Vulnerability Type**: Excessive access to private data sources **Risk Level**: Medium **Vulnerable Code:** ```markdown #### 1. Heartbeat Checks ```bash # Check every 30 minutes - Email inbox for urgent messages - Calendar for upcoming events - Weather for relevant conditions - System status and health ``` ``` ```markdown ## Email Checks - Check for urgent unread messages - Flag important notifications ## Calendar Checks - Upcoming events in next 2 hours - Daily schedule overview ## System Checks - OpenClaw gateway status - Skill availability - Memory usage ``` ### Technical Analysis The heartbeat design encourages recurring access to email and calendar information, but it does not require opt-in authorization, read-only scopes, field-level minimization, credential isolation, or restrictions on retaining retrieved content. Email and calendar access is separate from the core write-ahead logging function and can require substantial permissions over private account data. An implementation that follows these instructions broadly could retrieve message bodies, senders, subjects, contacts, meeting attendees, locations, conferencing links, and event descriptions. Because the same skill recommends persistent logging, retrieved data may also be copied into plaintext state files. ### Attack Path 1. The user enables heartbeat checks to obtain proactive notifications. 2. The implementation requests or receives broad email and calendar permissions. 3. A recurring heartbeat accesses private account records every 30 minutes. 4. The agent processes more fields or records than are necessary to identify an urgent message or imminent event. 5. Retrieved details may be exposed in agent output or retained in the memory files recommended elsewhere in the skill. 6. Any later process or session with access to that output or st ...[truncated 578 chars]
• Remediation: ## Remediation Suggestions - Make email and calendar integrations separate, explicit opt-in features. - Explain exactly which account, records, fields, and time ranges will be accessed. - Request narrowly scoped, read-only permissions and avoid send, delete, modify, administration, or full-mailbox scopes. - Retrieve only the minimum metadata needed; do not access message bodies or attachments unless separately requested. - Restrict calendar queries to the smallest necessary time window and fields. - Isolate integration credentials and never write them to memory or transcript files. - Do not persist retrieved private content by default. - Provide visible access logs, immediate revocation controls, and periodic permission review. - Require renewed consent before expanding scopes or adding another account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The memory architecture encourages persistent storage of session and working data, but omits warnings that conversation content and task details may be retained over time. This creates privacy and compliance risk because users may not expect their interactions to be logged into durable files.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The working buffer is described as capturing every exchange in the danger zone, which encourages indiscriminate retention of raw conversational content. Such broad logging increases the chance that secrets, personal data, credentials, or confidential instructions are stored in plaintext and later exposed or reused unsafely.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The WAL workflow instructs the agent to log critical exchanges, compact them, and move important information into long-term memory without defining sensitivity boundaries. This can transform transient sensitive content into persistent records, increasing breach impact and making accidental disclosure more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly recommends periodic autonomous checks of sensitive sources such as email inboxes and calendars, but provides no consent, scope, or privacy warning. In a proactive-agent skill, this can normalize ongoing background access to personal data and lead to unexpected collection or review of user information.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill promotes autonomous maintenance actions such as file organization, cleanup, and backup verification without warning about possible changes to user data or system state. This is dangerous because unattended automation can modify, move, or delete files in ways the user did not explicitly approve or anticipate.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 3. Creating Autonomous Crons
```bash
# Create cron job for daily maintenance
0 8 * * * openclaw run --task "daily-maintenance"
0 20 * * * openclaw run --task "evening-review"

• Confidence: 80% confidence
• Finding: The cron examples operationalize unattended recurring execution, which can preserve and repeatedly act on session context without strong boundaries or approval checkpoints. While the example itself is not overtly malicious, session-persistent automation in this skill increases the risk of unintended actions, stale-context decisions, and repeated processing of sensitive data.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The best-practice advice to 'log everything' strongly reinforces comprehensive capture of session data into persistent buffers. In practice this is a classic over-collection pattern that amplifies privacy, confidentiality, and secondary-use risks, especially for a skill centered on persistence and autonomy.

Static analysis

No suspicious patterns detected.