T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:80- Finding
Persistent Injection of Skill Rules into Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Proactive-Do
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a disclosed todo automation workflow, but it asks for recurring autonomous runs, external email reporting, and persistent behavior changes without enough user control.
Review before installing. Only use this skill in a workspace where recurring todo automation is wanted, and require explicit approval for cron setup, any policy or memory-file changes, and each external email destination/content. Avoid putting secrets, customer data, private URLs, or sensitive personal details in todos that this skill may process.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T06 · System Persistence
Error
- Location
SKILL.md:46- Finding
Recurring Cross-Session Execution Through Scheduled Cron Events
- Content
View full analysis
1h, draft a simple plan with estimate and report. Maintain agent_work/ journals and include the todo/project name in every report. Deliver the start report by email per the proactive-do skill notification policy." - 2.5h follow-up payload text: "Follow-up heartbeat: review all work performed in the past 2.5h. For each task, if completed mark [done]; else mark [wip] with a one-line reason and next action. Report the changes and reference the related todo/project. Deliver the finish report by email per the proactive-do skill notification policy." ``` ### Technical Analysis The skill recommends creating OpenClaw cron events that survive the initiating interaction and repeatedly invoke Agent workflows. The scheduled payloads can read and modify workspace files, execute selected todo items, create journals, and trigger external email delivery. No mandatory consent gate is specified before schedule creation. The instructions also lack an expiration time, a constrained action allowlist, a schedule identifier, an inspection procedure, and a removal procedure. Consequently, a one-time adoption of the skill can lead to recurring autonomous behavior across future sessions. Although cron scheduling is described as recommended, it is still an explicit persistence mechanism supplied by the skill and can be followed automatically by an Agent. ### Attack Path 1. The skill is installed or adopted in a workspace. 2. The Agent follows t ...[truncated 1120 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:83- Finding
Potential Disclosure of Full Todo Content Through Automated Email
- Content
View full analysis
" (abbr = short names of the 3 todos) - Body: full text of the 3 selected todos; concise (≈2-minute read) - Follow-up email (at 2.5h reconciliation): - Subject: "[assistant] finish 3 todos + " (same abbr) - Body: brief summary of what was done, results, failures, and done/not-done per task (≈2-minute read) - Archive a copy of each email under `agent_work/heartbeat_emails/`. - Keep local preferences out of the published skill package unless they are intentionally shared. ``` ```markdown 5) Notification: send the Start email using gog CLI per the template above. ``` ```markdown 4) Notification: send the Finish email using gog CLI per the template above. ``` ### Technical Analysis The workflow instructs the Agent to send the full text of selected todos through Gmail and to send subsequent work results. Todo entries can contain confidential project names, personal information, internal URLs, operational details, or credentials inadvertently copied by a user. Recipient and sender settings may be loaded from a local preference file, but the skill does not require validation of that file’s ownership or permissions. It also does not require recipient confirmation, content classification, secret sca ...[truncated 1941 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md # Proactive-Do A lightweight workflow for proactive execution of a human's todo list with recurring reviews, clear state labels, structured documentation, and concise reporting. ## Quick start
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrases are very broad and include common productivity language like 'review todos', '[new]/[wip]/[done]', and references to todo files. This increases the chance the skill activates in contexts where the user did not intend autonomous task execution, file edits, journaling, or email reporting.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The notification policy directs the agent to email full todo text and work summaries and to archive copies locally, but it does not require warning the user that task contents may contain sensitive information. This can leak confidential project details, personal data, or internal plans to external mail systems and to secondary local storage.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly requires outbound emails containing full selected todo text and detailed summaries of work performed, then stores copies under agent_work/heartbeat_emails/. This creates multiple disclosure channels for potentially sensitive user content and operational details, especially because todos may contain confidential business, personal, or security-related information.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill's earlier workflow instructs the agent to send heartbeat emails automatically via gog CLI, including start/finish reports, while the safety section later says to halt for any external messaging requiring explicit approval. This contradiction can cause an agent to send emails without clear user consent, creating unauthorized outbound communication and possible data disclosure.
- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md ## Safety / escalation - Halt and report for any action requiring explicit approval or external messaging on behalf of the owner/requester. - Never loop indefinitely. Two failed attempts on the same blocker → stop, label [wip], report. - Always include the todo/project name and journal path in reports. ## Templates and helpers