Security audit

Proactivity (Proactive Agent)

Security checks for vulnerabilities and agentic risk

Overview

This proactivity skill is purpose-aligned and transparent about keeping local notes, with explicit approval required for workspace edits and high-impact actions.

Install only if you want the agent to maintain local working memory and proactive follow-up notes under ~/proactivity. Review those files periodically, avoid storing secrets there, and approve workspace AGENTS, TOOLS, SOUL, or HEARTBEAT edits only after checking the shown snippets.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
- It never modifies its own `SKILL.md`.

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.
md
version: 1.0.1 homepage: https://clawic.com/skills/proactivity description: Anticipates needs, keeps work moving, and improves through use so the agent gets more proactive over time. changelog: "Strengthens proactive behavior with reverse prompting, self-healing, working-buffer recovery, and clearer SOUL and AGENTS setup." metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":[]},"os":["linux","darwin","win32"],"configPaths":["~/proactivity/"],"configPaths.optional":["./AGENTS.md","./TOOLS.md","./SOUL.md","./HEARTBEAT.md"]}} ---

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
version: 1.0.1 homepage: https://clawic.com/skills/proactivity description: Anticipates needs, keeps work moving, and improves through use so the agent gets more proactive over time. changelog: "Strengthens proactive behavior with reverse prompting, self-healing, working-buffer recovery, and clearer SOUL and AGENTS setup." metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":[]},"os":["linux","darwin","win32"],"configPaths":["~/proactivity/"],"configPaths.optional":["./AGENTS.md","./TOOLS.md","./SOUL.md","./HEARTBEAT.md"]}} ---

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
version: 1.0.1 homepage: https://clawic.com/skills/proactivity description: Anticipates needs, keeps work moving, and improves through use so the agent gets more proactive over time. changelog: "Strengthens proactive behavior with reverse prompting, self-healing, working-buffer recovery, and clearer SOUL and AGENTS setup." metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":[]},"os":["linux","darwin","win32"],"configPaths":["~/proactivity/"],"configPaths.optional":["./AGENTS.md","./TOOLS.md","./SOUL.md","./HEARTBEAT.md"]}} ---

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · execution.md (reported line 51)May include surrounding context.
md
version: 1.0.1 homepage: https://clawic.com/skills/proactivity description: Anticipates needs, keeps work moving, and improves through use so the agent gets more proactive over time. changelog: "Strengthens proactive behavior with reverse prompting, self-healing, working-buffer recovery, and clearer SOUL and AGENTS setup." metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":[]},"os":["linux","darwin","win32"],"configPaths":["~/proactivity/"],"configPaths.optional":["./AGENTS.md","./TOOLS.md","./SOUL.md","./HEARTBEAT.md"]}} ---

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · execution.md (reported line 58)May include surrounding context.
md
version: 1.0.1 homepage: https://clawic.com/skills/proactivity description: Anticipates needs, keeps work moving, and improves through use so the agent gets more proactive over time. changelog: "Strengthens proactive behavior with reverse prompting, self-healing, working-buffer recovery, and clearer SOUL and AGENTS setup." metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":[]},"os":["linux","darwin","win32"],"configPaths":["~/proactivity/"],"configPaths.optional":["./AGENTS.md","./TOOLS.md","./SOUL.md","./HEARTBEAT.md"]}} ---

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · execution.md (reported line 59)May include surrounding context.
md
version: 1.0.1 homepage: https://clawic.com/skills/proactivity description: Anticipates needs, keeps work moving, and improves through use so the agent gets more proactive over time. changelog: "Strengthens proactive behavior with reverse prompting, self-healing, working-buffer recovery, and clearer SOUL and AGENTS setup." metadata: {"clawdbot":{"emoji":"⚡","requires":{"bins":[]},"os":["linux","darwin","win32"],"configPaths":["~/proactivity/"],"configPaths.optional":["./AGENTS.md","./TOOLS.md","./SOUL.md","./HEARTBEAT.md"]}} ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
This skill NEVER: - edits any file outside `~/proactivity/` without explicit user approval in that session - applies hidden workspace changes without showing the exact proposed lines first - sends messages, spends money, deletes data, or makes commitments without approval - keeps sensitive user data out of proactive state files ## Data Storage

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
This skill NEVER: - edits any file outside `~/proactivity/` without explicit user approval in that session - applies hidden workspace changes without showing the exact proposed lines first - sends messages, spends money, deletes data, or makes commitments without approval - keeps sensitive user data out of proactive state files ## Data Storage

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
Something might need attention. What should I do?

text
## Reverse Prompting Use reverse prompting when the user would benefit from:

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content: Scanner excerpt · execution.md (reported line 49)May include surrounding context.
Something might need attention. What should I do?

text
## Reverse Prompting Use reverse prompting when the user would benefit from:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file defines when heartbeat messages should occur using broad natural-language criteria such as 'active work with no clear next step' and 'moments where a proactive suggestion would remove avoidable friction.' The guidance lacks concrete trigger boundaries or explicit exclusion examples beyond general silence conditions, which makes activation scope subjective and prone to unintended invocation.
Content: No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: The instruction to 'use reverse prompting' is ambiguous and can encourage the agent to steer the user into revealing additional context, secrets, or internal state indirectly rather than requesting only necessary information. In a proactivity skill that also persists memory and session state, this becomes more dangerous because extra elicited information may be stored durably and later reused outside the user's expectations.
Content: Scanner excerpt · setup.md (reported line 19)May include surrounding context.
md
**Proactivity** Being proactive is part of the job, not an extra. Anticipate needs, look for missing steps, and push the next useful move without waiting to be asked. Use reverse prompting when a suggestion, draft, check, or option would genuinely help. Recover active state before asking the user to restate work. When something breaks, self-heal, adapt, retry, and only escalate after strong attempts. Stay quiet instead of creating vague or noisy proactivity.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The setup directs the agent to create and initialize a persistent local state directory and files under ~/proactivity, but it does not require an explicit user-facing disclosure that data will be stored and workspace behavior files may be modified. In an agent skill, silent persistence of task history, preferences, and follow-up state can surprise users, create privacy concerns, and expand the blast radius of prompt injection or accidental data retention.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.md (reported line 110)May include surrounding context.
mkdir -p ~/proactivity/{domains,memory} touch ~/proactivity/{memory.md,session-state.md,heartbeat.md,patterns.md,log.md} touch ~/proactivity/memory/working-buffer.md chmod 700 ~/proactivity ~/proactivity/domains ~/proactivity/memory chmod 600 ~/proactivity/{memory.md,session-state.md,heartbeat.md,patterns.md,log.md} chmod 600 ~/proactivity/memory/working-buffer.md

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.md (reported line 111)May include surrounding context.
touch ~/proactivity/{memory.md,session-state.md,heartbeat.md,patterns.md,log.md} touch ~/proactivity/memory/working-buffer.md chmod 700 ~/proactivity ~/proactivity/domains ~/proactivity/memory chmod 600 ~/proactivity/{memory.md,session-state.md,heartbeat.md,patterns.md,log.md} chmod 600 ~/proactivity/memory/working-buffer.md

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.md (reported line 112)May include surrounding context.
touch ~/proactivity/{memory.md,session-state.md,heartbeat.md,patterns.md,log.md} touch ~/proactivity/memory/working-buffer.md chmod 700 ~/proactivity ~/proactivity/domains ~/proactivity/memory chmod 600 ~/proactivity/{memory.md,session-state.md,heartbeat.md,patterns.md,log.md} chmod 600 ~/proactivity/memory/working-buffer.md

text

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The listed triggers such as 'Stalled work', 'Context drift', 'Time window', and 'Promise made' are high-level concepts rather than specific invocation conditions. Without clearer boundaries, exclusions, or concrete trigger phrases, the skill could activate in many normal conversations and cause unintended proactivity.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The phrase 'triggers that justify messaging the user' is underspecified and leaves the agent broad discretion to initiate contact without clear user-approved conditions. In a proactive agent skill, ambiguous outreach criteria can lead to unnecessary, premature, or manipulative notifications, and may cause the agent to act beyond expected boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The guidance instructs the agent to write to session-state, action log, and pattern log files without requiring any user-facing notice or consent boundary. In a proactive skill, silent persistence can surprise users, leak sensitive workflow details into shared state, or create durable records the user did not expect.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.