Proactive-Do

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:30 AM UTC
• Version: 0.1.1

Overview

This skill is mostly a disclosed todo automation workflow, but it asks for recurring autonomous runs, external email reporting, and persistent behavior changes without enough user control.

Review before installing. Only use this skill in a workspace where recurring todo automation is wanted, and require explicit approval for cron setup, any policy or memory-file changes, and each external email destination/content. Avoid putting secrets, customer data, private URLs, or sensitive personal details in todos that this skill may process.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:80
• Finding: Persistent Injection of Skill Rules into Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 80 **Vulnerability Type**: Persistent modification of Agent policy or memory **Risk Level**: High ### Vulnerable Code Snippet ```markdown - Persist this behavior in the local workspace policy/memory files when that is appropriate for the environment. ``` ### Technical Analysis The skill instructs the Agent to persist its categorization and prioritization behavior in workspace policy or memory files. Such files can be loaded automatically in future sessions and may influence Agent behavior even when this skill is no longer being used. The instruction does not identify an isolated configuration file, limit the persisted rules to this skill, require informed user authorization, or define a rollback mechanism. The phrase “when that is appropriate” is not a sufficient security boundary because the Agent is left to decide whether and where to modify long-term state. This creates a memory-poisoning condition: skill-controlled instructions can be copied into persistent state and subsequently treated as trusted workspace guidance. ### Attack Path 1. A user invokes the skill or asks the Agent to add a todo. 2. The Agent reaches the instruction to persist the behavior. 3. The Agent locates a workspace policy, memory, or instruction file. 4. The Agent writes the skill’s categorization or prioritization rules into that file. 5. Future Agent sessions load the modified persistent state. 6. The persisted rules continue to influence unrelated todo processing or other workspace activity without the skill being explicitly invoked. ### Impact Assessment The issue can alter Agent behavior across future sessions within the affected workspace. It does not directly grant operating-system privileges, but it can contaminate trusted instruction state and influence later file modifications, task prioritization, or tool usage. The scope depends on which memory or policy file the Agent selects. If a shared or r ...[truncated 134 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction to write behavior into general workspace policy or memory files. - Keep categorization and prioritization rules inside `SKILL.md` or a dedicated configuration file such as `agent_work/proactive-do/config.md`. - Require explicit, informed user approval before making any persistent behavioral change. - Display the exact destination file and proposed content before writing. - Restrict persisted settings to the current workspace and this specific skill. - Document a rollback process that removes all persisted rules created by the skill. - Never modify global, shared, or automatically loaded Agent instruction files as part of ordinary todo handling. ]]>

T06 · System Persistence

Error

• Location: SKILL.md:46
• Finding: Recurring Cross-Session Execution Through Scheduled Cron Events<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 46 and lines 116-123 **Vulnerability Type**: Installation of recurring scheduled Agent tasks **Risk Level**: High ### Vulnerable Code Snippet ```markdown - Use OpenClaw cron to schedule system events that trigger these reviews (see Cron payloads below). ``` ```markdown ## Cron payloads (copy/paste) - 3h review payload text: "Heartbeat: review todo/todo.md for [new] items. Pick the top 3 to act on this pass. For each selected [new]: if ≤1h, do it now and report; if >1h, draft a simple plan with estimate and report. Maintain agent_work/ journals and include the todo/project name in every report. Deliver the start report by email per the proactive-do skill notification policy." - 2.5h follow-up payload text: "Follow-up heartbeat: review all work performed in the past 2.5h. For each task, if completed mark [done]; else mark [wip] with a one-line reason and next action. Report the changes and reference the related todo/project. Deliver the finish report by email per the proactive-do skill notification policy." ``` ### Technical Analysis The skill recommends creating OpenClaw cron events that survive the initiating interaction and repeatedly invoke Agent workflows. The scheduled payloads can read and modify workspace files, execute selected todo items, create journals, and trigger external email delivery. No mandatory consent gate is specified before schedule creation. The instructions also lack an expiration time, a constrained action allowlist, a schedule identifier, an inspection procedure, and a removal procedure. Consequently, a one-time adoption of the skill can lead to recurring autonomous behavior across future sessions. Although cron scheduling is described as recommended, it is still an explicit persistence mechanism supplied by the skill and can be followed automatically by an Agent. ### Attack Path 1. The skill is installed or adopted in a workspace. 2. The Agent follows t ...[truncated 1120 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not create recurring schedules automatically. - Require explicit user approval after presenting the exact schedule, payload, execution scope, and external side effects. - Use a dedicated schedule name so users can identify the job reliably. - Apply a short expiration date or a bounded number of executions by default. - Restrict scheduled reviews to local parsing and reporting unless the user separately authorizes task execution. - Require fresh approval before scheduled events send email or perform other external actions. - Document commands or user-interface steps to list, pause, and remove every schedule created by the skill. - Record schedule creation in a local audit log, including creator, time, payload, frequency, and expiration. - Constrain scheduled jobs to the intended workspace and least-privileged tool set. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:83
• Finding: Potential Disclosure of Full Todo Content Through Automated Email<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 83-94, 108, and 114 **Vulnerability Type**: Unsafe transmission and archival of potentially sensitive workspace data **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Notification delivery (heartbeat) - Prefer email over chat for heartbeat notifications. - Send email via gog CLI (Gmail / Google Workspace CLI) when it is available. - Resolve sender, recipient, and fallback behavior from a local preference file when present: - `agent_work/proactive-do/delivery_prefs.md` - If no preference file exists, ask once for delivery settings or use the current chat as a temporary fallback. - Start email (at 3h review start): - Subject: "[assistant] start doing on 3 todos + <abbr>" (abbr = short names of the 3 todos) - Body: full text of the 3 selected todos; concise (≈2-minute read) - Follow-up email (at 2.5h reconciliation): - Subject: "[assistant] finish 3 todos + <abbr>" (same abbr) - Body: brief summary of what was done, results, failures, and done/not-done per task (≈2-minute read) - Archive a copy of each email under `agent_work/heartbeat_emails/`. - Keep local preferences out of the published skill package unless they are intentionally shared. ``` ```markdown 5) Notification: send the Start email using gog CLI per the template above. ``` ```markdown 4) Notification: send the Finish email using gog CLI per the template above. ``` ### Technical Analysis The workflow instructs the Agent to send the full text of selected todos through Gmail and to send subsequent work results. Todo entries can contain confidential project names, personal information, internal URLs, operational details, or credentials inadvertently copied by a user. Recipient and sender settings may be loaded from a local preference file, but the skill does not require validation of that file’s ownership or permissions. It also does not require recipient confirmation, content classification, secret sca ...[truncated 1941 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Default to local or current-chat reporting instead of email. - Require explicit opt-in before enabling email delivery. - Before each message, display the destination address, subject, and proposed body and obtain confirmation. - Revalidate consent when the recipient changes or when a scheduled workflow is created. - Send a minimized summary rather than the full todo text. - Scan for credentials, tokens, personal data, internal URLs, and other sensitive content before transmission. - Redact or omit sensitive fields and allow users to mark todos as non-exportable. - Validate ownership and restrictive permissions for `delivery_prefs.md`. - Resolve the instruction conflict by making the approval requirement explicit in both review flows. - Make local email archival optional, use restrictive file permissions, and define a retention/deletion policy. - Keep external messaging disabled during scheduled runs unless the user has explicitly approved that bounded schedule and recipient. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Memory Manipulation

High

• Category: Memory Poisoning

Content

# Proactive-Do

A lightweight workflow for proactive execution of a human's todo list with recurring reviews, clear state labels, structured documentation, and concise reporting.

## Quick start

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are very broad and include common productivity language like 'review todos', '[new]/[wip]/[done]', and references to todo files. This increases the chance the skill activates in contexts where the user did not intend autonomous task execution, file edits, journaling, or email reporting.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The notification policy directs the agent to email full todo text and work summaries and to archive copies locally, but it does not require warning the user that task contents may contain sensitive information. This can leak confidential project details, personal data, or internal plans to external mail systems and to secondary local storage.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly requires outbound emails containing full selected todo text and detailed summaries of work performed, then stores copies under agent_work/heartbeat_emails/. This creates multiple disclosure channels for potentially sensitive user content and operational details, especially because todos may contain confidential business, personal, or security-related information.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill's earlier workflow instructs the agent to send heartbeat emails automatically via gog CLI, including start/finish reports, while the safety section later says to halt for any external messaging requiring explicit approval. This contradiction can cause an agent to send emails without clear user consent, creating unauthorized outbound communication and possible data disclosure.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

## Safety / escalation
- Halt and report for any action requiring explicit approval or external messaging on behalf of the owner/requester.
- Never loop indefinitely. Two failed attempts on the same blocker → stop, label [wip], report.
- Always include the todo/project name and journal path in reports.

## Templates and helpers

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Static analysis

No suspicious patterns detected.