Ai Collab

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:36 PM UTC
• Version: 2.0.0

Overview

This skill is openly for multi-agent automation, but it asks users to enable broad autonomous execution, persistence, credential use, and remote chat-to-agent routing with weak controls.

Install only if you intentionally want a persistent multi-agent automation setup. Review and tighten the Bash auto-approval, cron/watchdog, tmux send-keys approval, Telegram bridge, credential storage, logging, and financial-action rules before use; avoid routing secrets or untrusted chat messages into the inbox.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: examples/jim-workflow-prompt.md:37

Finding

System-Prompt Injection Disables Human Approval and Safety Escalation

Content

View full analysis

CLAWDY: [DONE:step-name] one-line result\n" "$(date '+%Y-%m-%d %H:%M:%S')" >> "$LOG" # or printf "%s JIM -> CLAWDY: [BLOCKED:step-name] reason — pivoting to next\n" "$(date '+%Y-%m-%d %H:%M:%S')" >> "$LOG" # or printf "%s JIM -> CLAWDY: [SKIP:step-name] reason — will retry after other steps\n" "$(date '+%Y-%m-%d %H:%M:%S')" >> "$LOG" ``` ### Rule 6: Batch Report Only After Task Completion Do NOT send a status update after each micro-step. Send ONE report when the full task is done or fully blocked: ``` [DONE:task-name] Steps 1-4 complete. Step 2 was skipped (CAPTCHA — needs Jeremy). Result: X. [BLOCKED:task-name] Steps 1-2 done, step 3 hard-blocked: API returns 403. Tried A and B. Next: try C or escalate. ``` ### Rule 7: Escalate Only These Things to Jeremy Escalate ONLY when: - CAPTCHA or browser OAuth click required (no automation possible) - Password/2FA needed that isn't in ~/.openclaw/.env - Decision with irreversible financial consequences > $20 - You've tried Plan A, B, and C and all are blocked ``` The document is explicitly presented as a “System Prompt Injection” to be added to the primary agent's system prompt. It declares its rules “NON-NEGOTIABLE,” broadly presumes authorization, prohibits permission checks, and restricts escalation to a narrow set of cases. ### Technical Analysis These instructions alter the agent's safety ...[truncated 1611 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:436

Finding

Unrestricted Bash Auto-Approval Grants Excessive Agent Privileges

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: scripts/daemon.sh:29

Finding

Unauthenticated Inbox Content Is Inserted Directly into an Autonomous Agent Prompt

Content

View full analysis

/dev/null | while read dir event file; do FULLPATH="$INBOX/$file" [ ! -f "$FULLPATH" ] && continue MSG=$(cat "$FULLPATH") rm "$FULLPATH" logline "$AGENT_A_NAME -> $AGENT_B_NAME: $MSG" SYSTEM_PROMPT="You are $AGENT_B_NAME, an autonomous AI agent collaborating with $AGENT_A_NAME. Use the protocol: [ACK:name] to acknowledge, [DONE:name] result to close tasks, [BLOCKED:name] reason if stuck. Keep responses under 100 words. Be direct. No preamble. Chat log location: $LOG" RESPONSE=$(claude --print --model "$MODEL" \ "$SYSTEM_PROMPT $AGENT_A_NAME says: $MSG" 2>/dev/null) logline "$AGENT_B_NAME -> $AGENT_A_NAME: $RESPONSE" # Route response back to Agent A if command -v openclaw &>/dev/null; then openclaw agent --agent main -m "[$AGENT_B_NAME]: $RESPONSE" --json > /dev/null 2>&1 fi ``` ### Technical Analysis Any file moved into the watched inbox is accepted as an Agent A message. The daemon does not authenticate its producer, verify file ownership or permissions, validate a signature, impose a message-size limit, or classify the content as untrusted. The complete message is concatenated directly into the same prompt string that carries the daemon's behavioral instructions. This creates a prompt-injection boundary failure. The generated response is then forwarded to the primary OpenClaw agent, creating a second trust transition. The actual consequences depend on the tools and permissions available to `claude --print` and the receiving OpenClaw agent. At minimum, an attacker able to write to the inbox can influence both agents' outputs. If either agent has shell or tool access, the impact may extend to local actions. ### Attack Path 1. An attacker gains write access to the configured inb ...[truncated 1059 chars]

Remediation

View remediation

T06 · System Persistence

Warning

• Location: SKILL.md:380

Finding

Cron and Watchdog Instructions Create Persistent Autonomous Agent Execution

Content

View full analysis

15 min, restart: ```bash # check_daemon.sh (add to crontab: */15 * * * *) PIDFILE="/tmp/agentb_daemon.pid" LOG="$HOME/.openclaw/workspace/collab/chat.log" # Check PID alive pid_alive=0 [ -f "$PIDFILE" ] && kill -0 "$(cat $PIDFILE)" 2>/dev/null && pid_alive=1 # Check last activity within 15 min last_ts=$(grep -oP '^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}' "$LOG" 2>/dev/null | tail -1) recent=0 if [ -n "$last_ts" ]; then age=$(( ($(date +%s) - $(date -d "$last_ts" +%s 2>/dev/null || echo 0)) / 60 )) [ "$age" -lt 15 ] && recent=1 fi if [ "$pid_alive" = "0" ] || [ "$recent" = "0" ]; then tmux send-keys -t agentb-session "bash daemon.sh" Enter fi ``` ``` ### Technical Analysis Scheduled polling is related to asynchronous collaboration, but the proposed configuration persists across interactive sessions. The watchdog additionally restarts an autonomous agent when it appears dead or inactive. The inactivity test treats a quiet system as unhealthy. Consequently, a daemon with no legitimate work for 15 minutes can be restarted unnecessarily. Restarting through `tmux send-keys` is also context-sensitive and can execute text in an unintended terminal state. The repository provides instructions rather than directly modifying the user's crontab. Persistence occurs when the user follows those instructions. ### Attack Path 1. The user installs the minute-by-minute poller and 15-minute watchdog in crontab. 2. A compromised or misconfigured daemon is stopped, or the log simply remains quiet. 3. The watchdog ...[truncated 726 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daemon.sh:33

Finding

Complete Agent Messages and Responses Are Persisted without Redaction

Content

View full analysis

$AGENT_B_NAME: $MSG" SYSTEM_PROMPT="You are $AGENT_B_NAME, an autonomous AI agent collaborating with $AGENT_A_NAME. Use the protocol: [ACK:name] to acknowledge, [DONE:name] result to close tasks, [BLOCKED:name] reason if stuck. Keep responses under 100 words. Be direct. No preamble. Chat log location: $LOG" RESPONSE=$(claude --print --model "$MODEL" \ "$SYSTEM_PROMPT $AGENT_A_NAME says: $MSG" 2>/dev/null) logline "$AGENT_B_NAME -> $AGENT_A_NAME: $RESPONSE" ``` Related Telegram logging appears at `references/telegram-bridge.md:75-78`: ```bash mv "$TMPFILE" "$INBOX/msg_$(date +%s%N).txt" log_system "Telegram → inbox: ${text:0:60}" ``` ### Technical Analysis The implementation records complete task messages and complete model responses in `chat.log`. Collaboration tasks can naturally contain private source code, personal data, API output, file contents, access tokens, or other secrets. The documentation says never to log secrets, but no technical redaction or enforcement implements that rule. The script creates the inbox with `mkdir -p` but does not enforce restrictive directory or log permissions. Truncating Telegram messages to 60 characters does not make them safe because secrets commonly fit within that length. ### Attack Path 1. A user or bridged producer includes a secret or private value in a task. 2. The daemon appends the complete message to `chat.log`. 3. Agent B may repeat the value in its response, causing a second log copy. 4. Another local principal, later agent process, backup system, or log collector reads the persistent log. 5. The retained value is reused to access the associated account or data. ### Impact Assessment Exposed information may include task content, personal Telegram ...[truncated 342 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/telegram-bridge.md:20

Finding

Telegram Bridge Sources a Broad Shell Environment and Exposes the Bot Token in Process Arguments

Content

View full analysis

/dev/null || echo "0") log_system() { printf "%s SYSTEM: %s\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$1" >> "$LOG" } log_system "Telegram bridge started" while true; do RESPONSE=$(curl -s \ "https://api.telegram.org/bot${BOT_TOKEN}/getUpdates?offset=$((OFFSET+1))&limit=10&timeout=20&allowed_updates=[\"message\"]") ``` ### Technical Analysis The bridge imports `~/.openclaw/.env` by executing it as shell code. If that file contains credentials for unrelated OpenClaw components, all of them enter the bridge process environment even though the bridge only requires three Telegram values. Sourcing also executes shell syntax in the file rather than parsing a restricted data format. The Telegram Bot API requires the token in the request path, but interpolating it into curl's command-line argument can expose it to local process inspection while curl is running. The documented `chmod 600` mitigates direct file reads but does not address excessive secret inheritance or process-argument visibility. Credential access is necessary for the optional Telegram feature; access to a broad shared ...[truncated 984 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill is presented as collaboration infrastructure, but it also includes an approval mechanism that injects keystrokes into another tmux session and automation hooks that can drive agent behavior indirectly. That mismatch is dangerous because users may invoke it expecting benign coordination while it also enables remote-like control of another agent session and unattended actions.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

logline "A -> B: $MSG"

  # Run Agent B (claude --print)
  RESPONSE=$(claude --print --model claude-haiku-4-5-20251001 \
    "You are Agent B. Agent A says: $MSG
Respond in under 100 words. Use [DONE:taskname] or [BLOCKED:taskname] to close loops.
Context: shared collab system. Chat log: $LOG" 2>/dev/null)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

The skill establishes a pattern for storing shared secrets in a collaboration workspace used by multiple components and logging nearby operational data. Even with a note not to log secrets, colocating credentials with agent automation increases the chance of accidental disclosure, prompt inclusion, or misuse by subprocesses.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

~/.openclaw/workspace/collab/ chat.log # THE shared record — all messages logged here inbox/ # A→B message queue (atomic mv only) .env # Shared secrets (chmod 600, never log) task_queue.md # Optional: structured task backlog status_tracker.md # Optional: current task status per agent

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The bridge explicitly sources a .env containing Telegram credentials in a long-running loop that also performs network requests and message processing. This widens the blast radius of token exposure through shell debugging, process inheritance, misconfiguration, or accidental reuse by adjacent scripts.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

bash

# Minimal bridge loop (inline version):
source ~/.openclaw/.env
OFFSET_FILE="/tmp/tg_offset"
while true; do
  OFFSET=$(cat "$OFFSET_FILE" 2>/dev/null || echo "0")

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The financial gate protocol introduces transaction-related decision logic that is outside the stated purpose of setting up collaboration between agents. Embedding financial action rules into a collaboration skill normalizes autonomous or semi-autonomous monetary behavior and creates a path to unauthorized or poorly reviewed transactions.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The instruction to use permissive auto-approval in a local Claude settings file weakens execution safeguards for subsequent commands and tools. In a skill that already coordinates autonomous agents, reducing approval friction materially increases the risk of unintended or unsafe actions being executed without human review.

Content

Scanner excerpt · SKILL.md (reported line 436)May include surrounding context.

md

3. Verify RESPONSE trimming line not corrupted (common issue: accidentally set to `RESPONSE=""`)
4. Restart daemon: `kill $(cat /tmp/clawdy_daemon.pid) && sleep 1 && bash clawdy_daemon.sh`

**Auto-approve**: Use `Bash(*)` in `~/.claude/settings.local.json`. **NEVER** use tmux send-keys cron — it sends keypresses blindly to the wrong sessions.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/claude-claude.md (reported line 19)May include surrounding context.

Environment Variables

bash

# In ~/.openclaw/.env
AGENT_A_NAME=JIM
AGENT_B_NAME=CLAWDY
AGENT_B_MODEL=claude-haiku-4-5-20251001

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Directly referencing ~/.openclaw/.env in operational instructions is a credential-access pattern because it teaches the agent to rely on a local secret file during autonomous task execution. In this context, the multi-agent design and 'do not ask permission' language make it more dangerous by reducing the likelihood of human review before secrets are accessed or used.

Content

Scanner excerpt · examples/jim-workflow-prompt.md (reported line 68)May include surrounding context.

md

Escalate ONLY when:
- CAPTCHA or browser OAuth click required (no automation possible)
- Password/2FA needed that isn't in ~/.openclaw/.env
- Decision with irreversible financial consequences > $20
- You've tried Plan A, B, and C and all are blocked

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/telegram-bridge.md (reported line 13)May include surrounding context.

2. Add bot to your group → send a message → get the GROUP_ID:

   bash

   curl -s "https://api.telegram.org/bot<BOT_TOKEN>/getUpdates" | python3 -m json.tool | grep '"id"' | head -5
   # Group IDs are negative numbers: -1001234567890
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Sourcing ~/.openclaw/.env loads sensitive credentials directly into the shell environment for a long-running script, creating a credential exposure point through local file compromise, process inspection in some environments, accidental logging, or reuse by child processes. Because the bot token grants access to Telegram bot operations and message retrieval, compromise can enable unauthorized monitoring or bot abuse.

Content

Scanner excerpt · references/telegram-bridge.md (reported line 36)May include surrounding context.

md

# telegram-bridge.sh — Route Telegram group messages to Agent B inbox
# Run: tmux new-session -d -s tg-bridge "bash scripts/telegram-bridge.sh"

source ~/.openclaw/.env

BOT_TOKEN="${TELEGRAM_BOT_TOKEN:?TELEGRAM_BOT_TOKEN not set}"
GROUP_ID="${TELEGRAM_GROUP_ID:?TELEGRAM_GROUP_ID not set}"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The bridge continuously ingests untrusted remote content from Telegram and forwards selected message text directly into an agent inbox as 'USER:' messages, effectively converting an external chat into agent instructions. In this skill context, that is dangerous because it creates a remote prompt-injection and autonomous action channel, especially for a daemon agent designed to act on inbox content without strong sanitization or approval gates.

Content

Scanner excerpt · references/telegram-bridge.md (reported line 55)May include surrounding context.

md

log_system "Telegram bridge started"

while true; do
  RESPONSE=$(curl -s \
    "https://api.telegram.org/bot${BOT_TOKEN}/getUpdates?offset=$((OFFSET+1))&limit=10&timeout=20&allowed_updates=[\"message\"]")

  UPDATES=$(echo "$RESPONSE" | python3 -c "

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script forwards inbox message contents to the Claude CLI, which may transmit them to an external model provider, without any user-facing disclosure or data-classification guardrails. Because this skill is explicitly designed for autonomous agent-to-agent coordination, it is likely to process broad task context and potentially sensitive workspace data, making undisclosed external transmission a significant confidentiality risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Very broad trigger phrases increase the likelihood that the skill is invoked in contexts beyond simple collaboration setup, including sensitive automation scenarios. Because this skill contains powerful operational patterns, overbroad activation raises the chance of accidental use with insufficient review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

# 1. Source config
source ~/.openclaw/workspace/collab/.ai-collab.env

# 2. Create the collab workspace
mkdir -p "$COLLAB_INBOX"

# 3. Start Agent B daemon (in a tmux session)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The optional Telegram bridge expands the trust boundary from local agent coordination to external network I/O and credential handling. Even if optional, bundling it into the same skill increases the chance of exposing chat content, bot tokens, and user messages without operators realizing they are enabling a network-connected component.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The Telegram bridge describes ingesting messages and handling bot credentials, but does not foreground the privacy implications of routing user communications through an external service and into agent workflows. Users may unknowingly expose personal, group, or operational data to third-party infrastructure and logs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The Telegram setup instructs disabling group privacy so the bot can read all group messages, which effectively establishes persistent surveillance of a chat space. In the context of agent automation, that makes more conversational data available for ingestion and misuse than is necessary for core collaboration.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

Route user Telegram messages into Agent B's inbox. Full setup guide: `references/telegram-bridge.md`

**Quick summary:**
1. Create a bot via [@BotFather](https://t.me/BotFather) → get `BOT_TOKEN`
2. Add bot to your group → get `GROUP_ID` (negative number, e.g. `-1001234567890`)
3. Disable Group Privacy Mode in BotFather so bot can read all messages
4. Get your Telegram `USER_ID` from [@userinfobot](https://t.me/userinfobot)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The Telegram polling example performs external network communication to a third-party API and can transmit or retrieve operational messages tied to agent activity. This creates exposure to data leakage, credential misuse, and remote input entering a local automation pipeline.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

md

OFFSET_FILE="/tmp/tg_offset"
while true; do
  OFFSET=$(cat "$OFFSET_FILE" 2>/dev/null || echo "0")
  UPDATES=$(curl -s "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/getUpdates?offset=$((OFFSET+1))&timeout=20")
  # Parse updates, drop user messages into inbox with USER: prefix
  # See references/telegram-bridge.md for full parsing implementation
  sleep 1

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document first recommends tmux send-keys for approval flow, then later warns never to use blind send-keys automation. That inconsistency is risky because operators may follow the unsafe pattern and inject input into the wrong session, accidentally approving commands or causing unintended actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Allowing either agent to act independently for sub-$20 financial actions still authorizes real-world transactions without mandatory human approval. Small-value thresholds are commonly abused because they appear low risk individually but can be repeated, chained, or exploited to bypass scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.

md

| Tier | Amount | Rule |
|------|--------|------|
| 1 | Under $20 | Either agent acts independently — no approval needed |
| 2 | $20–$50 | Both agents PROPOSE + APPROVE before acting |
| 3 | Over $50 | Requires `[AUTHORIZED:financial:amount:timestamp:Jeremy]` tag |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

Recommending auto-approve through agent settings encourages autonomous execution without interactive verification. In combination with daemonized multi-agent behavior, this can turn prompts or indirect inputs into actions with little or no human checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 436)May include surrounding context.

md

3. Verify RESPONSE trimming line not corrupted (common issue: accidentally set to `RESPONSE=""`)
4. Restart daemon: `kill $(cat /tmp/clawdy_daemon.pid) && sleep 1 && bash clawdy_daemon.sh`

**Auto-approve**: Use `Bash(*)` in `~/.claude/settings.local.json`. **NEVER** use tmux send-keys cron — it sends keypresses blindly to the wrong sessions.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The example documents a daemon, inbox directory, and persistent chat log used for inter-agent communication, but it provides no warning about retention, access controls, or the sensitivity of logged content. In a multi-agent setup, messages may include task details, system state, or other sensitive operational data, so undocumented background monitoring and persistence can lead to unintended disclosure or privacy issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example sends arbitrary task content from the local agent workflow to the OpenAI API via client.chat.completions.create(...) with msg passed directly as user content. In a multi-agent collaboration skill, that task content may include proprietary code, secrets, or sensitive project context, and the markdown does not visibly warn users that data is being transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · examples/jim-workflow-prompt.md (reported line 13)May include surrounding context.

Rule 1: Plan Before You Act

Before touching anything, write out numbered steps:

text

1. Do X
2. If X fails, do Y

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This prompt explicitly instructs the agent to append to a local file after every step, creating persistent side effects on the host filesystem without any safety guardrails, path validation, or warning about sensitive data being logged. In a multi-agent autonomous workflow, this increases the chance of uncontrolled file growth, leakage of task details, and modification of local state without user review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.