Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed local ask-vs-act memory aid that creates persistent notes under ~/escalate but does not hide execution, exfiltrate data, or bypass approval for high-impact actions.
Install this only if you want an agent to keep local, cross-session notes about when it should act versus ask. Review the ~/escalate files periodically, and be cautious about approving workspace AGENTS or SOUL snippets because they can influence future agent behavior.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- User adds constraints that weren't there before
- Context changed significantly
**Response to demotion:** Don't apologize excessively. Simply say: "Got it, I'll check with you on [category] going forward."
The skill's activation guidance is intentionally broad: it says to use the skill whenever the user wants the agent to decide what can be handled autonomously and to turn it on for agents that act proactively across sessions. That can cause the escalation policy to be invoked in many ordinary planning, drafting, or operational contexts, increasing the chance that the skill's learned ask-vs-act rules influence behavior beyond the user's intended scope.
This skill explicitly teaches the agent to infer delegation patterns and, after confirmation, 'decide without asking' and eventually 'never re-ask.' In a system connected to tools or external side effects, that can normalize broad standing autonomy, causing the agent to act beyond the user's current intent when context shifts or signals are misread.
I've noticed you've delegated [category] decisions twice now. Should I handle [category] autonomously going forward?
The activation condition 'when ~/escalate/ is missing or empty' is broad and can trigger setup based on filesystem state alone, without confirming user intent to initialize persistent local memory. In an agent context, this can cause unsolicited creation of stateful files and behavioral routing changes, which is risky because it modifies local environment and future agent behavior before explicit consent.
The file instructs immediate creation of directories/files and permission changes before a meaningful consent checkpoint. In a security-sensitive agent setting, automatically writing to ~/ and establishing persistent state can be abused to implant durable behavior, alter future decision-making, or surprise the user with side effects outside the current task.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/escalate/domains
touch ~/escalate/{memory.md,decisions.md}
chmod 700 ~/escalate ~/escalate/domains
chmod 600 ~/escalate/{memory.md,decisions.md}
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/escalate/domains touch ~/escalate/{memory.md,decisions.md} chmod 700 ~/escalate ~/escalate/domains chmod 600 ~/escalate/{memory.md,decisions.md}
If `~/escalate/memory.md` is empty, initialize it from `memory-template.md`.
No suspicious patterns detected.