T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:319- Finding
Broad Trigger-Based Autonomous Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Autopilot
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed high-autonomy assistant mode, but it grants broad memory, filesystem, cron, and persistence authority without tight user control.
Review this skill carefully before installing. It is not obviously malicious and no exfiltration or executable payload was found, but it is designed to act broadly and persistently. Only use it where you are comfortable with full-memory review, filesystem inspection, worklog/profile retention, and scheduled automation, and require explicit confirmation before file changes, cron changes, or future autonomous actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/autonomous-operations.md:5- Finding
Excessive Collection of Private Memory and Environment State
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
references/autonomous-operations.md:42- Finding
Persistent Behavioral State Can Be Poisoned by Unverified Context
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
references/autonomous-operations.md:162- Finding
Unapproved Cron Creation Enables Cross-Session Persistence
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (38)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The activation conditions are not tightly bounded beyond explicit commands, so the agent may infer autopilot intent from ambiguous conversational language. In a skill designed for end-to-end execution, this ambiguity can convert ordinary conversation into consent for broad system actions, which is unsafe even if not maliciously intended.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description grants broad autonomous authority over planning, execution, context fusion, and memory access without an upfront warning that entering this mode can read extensive user data and potentially modify system state. Users may invoke it casually without understanding that they are enabling a much more powerful operational mode than standard assistance.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation sequence defines a broad autonomous operating mode that culminates in 'ACT on findings' after sweeping multiple data sources, but it does not establish clear boundaries, user consent checkpoints, or task scoping. In context, this makes the skill more dangerous because the metadata explicitly encourages use whenever the user says vague phrases like 'handle it' or '/autopilot,' enabling overbroad autonomous behavior from ambiguous prompts.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The startup procedure includes reading memory, worklogs, all cron jobs, and scanning the filesystem without any user-facing warning about privacy exposure, system inspection, or the breadth of data collection. In a high-autonomy skill, hidden background enumeration materially increases the risk of collecting sensitive information the user did not intend to disclose.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are broad everyday language such as 'status', 'just do it', and 'was soll ich machen', which can cause the agent to enter a high-autonomy mode from ambiguous user input rather than clear informed consent. In the context of this skill, that is especially dangerous because
/autopilotis defined to perform historical memory sweeps, proactive execution, and scheduling behavior, so accidental activation could expose private data or trigger unintended actions.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation conditions are not tightly bounded beyond explicit commands, so the agent may infer autopilot intent from ambiguous conversational language. In a skill designed for end-to-end execution, this ambiguity can convert ordinary conversation into consent for broad system actions, which is unsafe even if not maliciously intended.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates a full sweep of MEMORY.md and every file under memory/*.md on first activation, forcing bulk collection and consolidation of historical user data regardless of whether all of it is necessary for the current task. This violates data-minimization principles and increases privacy risk, especially because the mode is designed to act autonomously using that aggregated context.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill expands context gathering beyond memory files to worklogs, cron jobs, filesystem contents, and conversation history, creating a broad surveillance-style intake of user and system data before autonomous action. This enlarged data surface makes inadvertent exposure, overcollection, and misuse more likely, particularly when combined with autonomous scheduling and follow-up behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill describes workflow growth, follow-ups, and scheduling behavior that can create persistent changes, but it does not require a clear user-facing warning at the moment those persistent behaviors are enabled. This can lead to surprise automation, unintended retention, and ongoing actions that outlive the user's immediate request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation section permits unspecified natural-language triggers and scheduled cron triggers without clear guardrails, which can cause the skill to activate outside a fresh, explicit user request. For an autonomy-focused skill, background or inferred activation expands the attack surface for accidental execution, stale-intent actions, and privilege misuse across time.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation flow requires mining all available context, maintaining an ongoing autonomous state, logging decisions, and auto-scheduling based on accumulated user data. In combination, these behaviors create a powerful persistent agent loop with broad data access and continuing authority, which is dangerous if triggered unintentionally or without tightly bounded scope.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The protocol mandates broad collection of memory, worklog contents, cron state, filesystem information, user preference data, and project metadata before acting. This exceeds data minimization principles and is especially risky in an autonomous skill because it normalizes large-scale intake and retention of context that may be unrelated to the immediate task.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation flow explicitly instructs the agent to 'Scan filesystem' as part of autonomous startup, without limiting scope to task-relevant paths or requiring user confirmation. In a high-autonomy skill, this broadens data access well beyond the described memory/worklog fusion purpose and can expose unrelated secrets, credentials, source code, or private documents.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The historical memory sweep requires reading every memory file and building a compact timeline before autonomous action, creating a persistent user profile across sessions. In this skill context, that makes the issue more dangerous because the resulting timeline directly feeds future autonomous decisions, amplifying privacy risks and the consequences of accidental over-collection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The dashboard strings use German labels such as 'Projekt', 'abgeschlossen', 'überfällig', and 'anstehend', indicating a fixed locale in the skill's natural-language output. The file does not offer user opt-in for this language choice or document a justified region-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The cron operations section permits listing, creating, and deleting scheduled jobs without warning that these actions can alter system behavior persistently and destructively. Because cron changes survive the current conversation, misuse could disable legitimate automation, schedule unwanted execution, or create stealthy persistence.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file grants list/create/delete cron capabilities under 'Autopilot' even though scheduled task management is a system-modifying capability with persistence beyond the current session. In an autonomous mode, this can be abused or accidentally used to establish recurring actions, disrupt existing jobs, or create covert persistence on the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The worklog protocol mandates persistent writes about deliverables, errors, decisions, taste profile changes, and related activity without warning that sensitive user or project data may be stored. This can create unintended retention of private information and expand the attack surface if the worklog is later exposed or mined by future runs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file explicitly instructs the agent to build and update a persistent 'User Style Profile' over the session, including preference and reaction tracking, but does not specify notice, consent, minimization, retention limits, or boundaries on storage. In the context of an autonomy-focused skill that also references sweeping historical memory files, this increases the risk of silent profiling and unnecessary persistence of behavioral data beyond what is needed to complete the task.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The directive 'All decisions have defaults. Execute. Create. Curate. Generate. Log.' encourages autonomous action as the default behavior without requiring user confirmation, impact checks, or safety gating. In a high-autonomy skill like OpenClaw, this increases the chance of the agent taking irreversible, privacy-affecting, or otherwise impactful actions based on inferred intent rather than explicit authorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The language rules mandate using the session language for all outputs and state 'Never ask about language,' which removes user choice about language or locale. This is a natural-language policy issue because it enforces a language behavior without opt-in or an offered alternative.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language examples for editorial broadcasting are written in German ("Hinzugefügt", "Entfernt", "Redaktionell vereinfacht") with no indication that the skill is region-specific or that users may choose their preferred language. This creates a language-policy issue because the file appears to prescribe a specific output language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs a 'full context fusion' sweep across historical memory, worklog, cron, files, and conversation, which creates a broad data-access pattern without any user-facing consent, minimization, or sensitivity gating in this document. In a high-autonomy skill, this materially increases the chance of exposing or overusing sensitive information from prior sessions or unrelated files during planning and execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction to execute 'strong' ideas immediately authorizes autonomous action based on the model's internal assessment, without requiring confirmation for potentially state-changing operations. In the context of an autopilot skill, this can lead to unintended actions, side effects, or execution of ideas derived from sensitive context the user did not explicitly ask to operationalize.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The prescribed broadcast format uses German text ("Idee", "Beobachtung die dazu führte"), and later queue presentation examples are also in German. The file does not state that language selection is optional or limited to a German-specific context, so this may violate language/locale policy expectations.
- Content
Static analysis
No suspicious patterns detected.