Infinite Oracle

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:18 AM UTC
• Version: 1.0.11

Overview

The skill is mostly upfront about running an autonomous background worker, but its persistent agent changes, high-priority override channels, and Feishu credential/network handling need careful review.

Install only in a sandboxed OpenClaw environment with a low-privilege worker, clear API spending limits, and a visible way to stop the nohup loop. Review SOUL.md changes before they are written, avoid using Feishu sync unless you can trust every table editor, keep FEISHU_BASE_URL fixed to the official Feishu origin, and do not enable arbitrary webhook destinations for sensitive objectives.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:86
• Finding: Persistent modification of agent behavior through SOUL.md<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-24`, `SKILL.md:86-125`, `peco_loop.py:1304-1327` **Vulnerability Type**: Persistent instruction injection and agent memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown - Before startup, ensure the worker has a durable desire persisted in `SOUL.md`. ``` ```markdown ### 2) Manage `SOUL.md` without overwriting existing content Never overwrite an existing `SOUL.md`. Behavior: - If `~/.openclaw/workspace-peco_worker/SOUL.md` does not exist: create it with both the desire section and the addendum content below. - If it exists: preserve prior content and ensure it contains both `## Infinite Oracle Desire` and `## PECO Worker Addendum`. When appending, preserve prior content exactly. Add only missing sections or update the existing desire block. Content to append/create: ```markdown ## Infinite Oracle Desire <worker desire provided by user, or the recommended default desire if user did not customize it> ## PECO Worker Addendum ### Divergent Thinking - If blocked, generate multiple safe alternatives immediately. - Never stall waiting for perfect information when a reversible path exists. - Always include at least one fallback plan. ### Capability Accumulation - Convert repeated manual steps into reusable scripts. - Promote stable recurring behavior into reusable skills. - Improve system leverage each cycle; do not merely complete one-off tasks. - During PLAN, prefer candidate paths that compound leverage and make the desire more achievable over time. ``` ``` The persisted content is subsequently assigned special authority in the runtime prompt: ```python def build_loop_prompt(state: LoopState, override_text: str) -> str: override_block = override_text if override_text else "(none)" phase_hint = PHASE_PROMPTS[state.phase] desire_block = state.worker_desire or "(no durable desire found in SOUL.md)" return f"""[SYSTEM CONTRACT] {SYSTEM_PROMPT_TEMPLATE} [LOOP C ...[truncated 2629 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the current objective in a dedicated, typed task-state file rather than in identity-oriented files such as `SOUL.md`. 2. Require explicit, informed user approval before every persistent behavioral change. 3. Record the author, timestamp, task identifier, hash, and expiration time for persisted directives. 4. Scope directives to one objective and automatically remove or deactivate them when that objective ends. 5. Provide a documented rollback command that restores the previous directive. 6. Treat persistent text as untrusted task context, not as a motive or instruction with elevated priority. 7. Prevent task-level content from overriding platform system instructions, safety policies, or administrator controls. 8. Restrict file permissions so only the intended user and trusted runtime can modify the state. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: peco_loop.py:1200
• Finding: Untrusted Feishu records are promoted to highest-priority agent overrides<![CDATA[ ## Vulnerability Details **File Location**: `peco_loop.py:650-704`, `peco_loop.py:1200-1205`, `peco_loop.py:1304-1327`, `peco_loop.py:1612-1621` **Vulnerability Type**: Remote prompt injection through external task records **Risk Level**: High ### Vulnerable Code Resolved Feishu records are converted into free-form text: ```python line = f"- 人类已解决[{record_id}]" if desc_text: line += f" 问题: {desc_text}" line += f" | 方案: {resolution_text[:1200]}" lines.append(line) resolved_ids.append(record_id) ``` That text is merged into the override channel without validation: ```python def merge_override_text(local_override: str, feishu_override: str) -> str: parts: List[str] = [] if local_override.strip(): parts.append(local_override.strip()) if feishu_override.strip(): parts.append("[FEISHU_RESOLVED_TASKS]\n" + feishu_override.strip()) return "\n\n".join(parts) ``` The merged text is then assigned the highest prompt priority: ```python def build_loop_prompt(state: LoopState, override_text: str) -> str: override_block = override_text if override_text else "(none)" phase_hint = PHASE_PROMPTS[state.phase] desire_block = state.worker_desire or "(no durable desire found in SOUL.md)" return f"""[SYSTEM CONTRACT] {SYSTEM_PROMPT_TEMPLATE} [LOOP CONTEXT] - objective: {state.objective} - worker_desire: {desire_block} - iteration: {state.iteration} - session: {state.session} - current_phase: {state.phase} - last_phase_summary: {state.last_phase_summary or "(none)"} - repeated_human_blocker_count: {state.repeated_human_blocker_count} - last_human_blocker: {state.last_human_task or "(none)"} [DESIRE ANCHOR] Treat the worker_desire as your durable motive. In PLAN, explicitly let it shape prioritization, fallback choice, and acceptance checks. If objective and desire appear to conflict, choose the path that advances the objective without betraying the desire. [OVERRIDE - HIGHEST PRIORITY] {override_block} ``` The ma ...[truncated 2560 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all Feishu fields as untrusted data and explicitly tell the model that their contents are quotations, not instructions. 2. Remove the `HIGHEST PRIORITY` designation from any externally sourced text. 3. Replace free-form overrides with a strict schema containing an action identifier and validated parameters. 4. Allow only a small, documented set of safe operations from Feishu records. 5. Verify the record author and require an approved role or explicit allowlist. 6. Require local human confirmation before a remote record can alter objectives, invoke tools, access files, or resume a halted loop. 7. Reject records containing unsupported fields, instructions outside the current task, or attempts to alter prompt hierarchy and safety constraints. 8. Maintain an immutable audit trail recording the source record, author, validation result, approval, and executed action. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: peco_loop.py:738
• Finding: Configurable Feishu API base URL can exfiltrate application credentials<![CDATA[ ## Vulnerability Details **File Location**: `peco_loop.py:285-330`, `peco_loop.py:720-751` **Vulnerability Type**: Sensitive credential transmission to an unrestricted destination **Risk Level**: High ### Vulnerable Code The HTTP helper constructs requests from a configurable base URL: ```python def _request( self, method: str, path: str, payload: Optional[Dict[str, Any]] = None, params: Optional[Dict[str, Any]] = None, auth: bool = True, retries: int = 2, ) -> Dict[str, Any]: query = "" if params: cleaned = { key: value for key, value in params.items() if value not in (None, "") } if cleaned: query = "?" + urlparse.urlencode(cleaned) url = f"{self.base_url}{path}{query}" headers = {"Content-Type": "application/json; charset=utf-8"} if auth: headers["Authorization"] = f"Bearer {self._ensure_token()}" data = None if payload is not None: data = json.dumps(payload, ensure_ascii=False).encode("utf-8") last_error = "" for attempt in range(retries + 1): req = urlrequest.Request(url, data=data, headers=headers, method=method) try: with urlrequest.urlopen(req, timeout=self.timeout) as resp: text = resp.read().decode("utf-8") ``` The token request transmits the application secret: ```python result = self._request( method="POST", path="/open-apis/auth/v3/tenant_access_token/internal", payload={"app_id": self.app_id, "app_secret": self.app_secret}, auth=False, retries=2, ) ``` The destination is controlled through an environment variable without validation: ```python app_id = os.environ.get("FEISHU_APP_ID", "").strip() app_secret = os.environ.get("FEISHU_APP_SECRET", "").strip() if not app_id or not app_secret: logger.warning( "Feishu sync disabled: FEISHU_APP_ID or FEISHU_APP_SECRET missing" ) return None app_token = os.environ.get("FEISHU_APP_ ...[truncated 2471 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Hardcode the production API origin to `https://open.feishu.cn`, or enforce an exact hostname and HTTPS allowlist. 2. Reject URLs containing user information, nonstandard schemes, unexpected ports, fragments, or nonempty paths. 3. Disable automatic redirects for credential-bearing requests, or verify that every redirect remains on the exact approved origin. 4. Separate test endpoint support from production builds and prohibit production credentials in test mode. 5. Use a dedicated HTTP client policy for secret-bearing requests with strict TLS verification. 6. Apply least-privilege Feishu scopes and rotate the application secret if an untrusted base URL may have been used. 7. Add tests proving that HTTP URLs, lookalike domains, subdomain tricks, IP literals, loopback addresses, and cross-origin redirects are rejected. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: peco_loop.py:765
• Finding: Arbitrary webhook destination can disclose PECO operational data<![CDATA[ ## Vulnerability Details **File Location**: `peco_loop.py:765-789`, `peco_loop.py:1520-1528`, `peco_loop.py:1596-1605`, `peco_loop.py:1755-1767` **Vulnerability Type**: Unrestricted outbound webhook and operational-data disclosure **Risk Level**: Medium ### Vulnerable Code The notifier accepts and uses an unrestricted URL: ```python class FeishuNotifier: def __init__(self, webhook_url: str, timeout: int, logger: logging.Logger) -> None: self.webhook_url = webhook_url.strip() self.timeout = timeout self.logger = logger def notify(self, title: str, body: Dict[str, Any]) -> None: payload_text = f"{title}\n" + json.dumps(body, ensure_ascii=False) if not self.webhook_url: self.logger.info("[MOCK_FEISHU] %s", payload_text) return payload = { "msg_type": "text", "content": {"text": payload_text[:3800]}, } data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urlrequest.Request( self.webhook_url, data=data, headers={"Content-Type": "application/json"}, method="POST", ) try: with urlrequest.urlopen(req, timeout=self.timeout) as resp: resp.read() self.logger.info("Feishu notification sent: %s", title) ``` The URL is directly configurable through a command-line argument: ```python parser.add_argument( "--feishu-webhook", default="", help="Feishu bot webhook URL (optional)", ) parser.add_argument( "--feishu-timeout", type=int, default=6, help="Feishu webhook timeout seconds", ) ``` Operational data sent through this channel includes objectives and session metadata: ```python notifier.notify( "PECO loop started", { "objective": state.objective, "session": state.session, "phase": state.phase, "iteration": state.iteration, "agent_id": args.a ...[truncated 2395 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only HTTPS webhook URLs on an exact allowlist of approved Feishu domains. 2. Resolve the hostname and reject loopback, private, link-local, multicast, and reserved IP ranges for every connection attempt. 3. Reject cross-origin redirects and revalidate the destination after DNS resolution and redirects. 4. Store the webhook URL in protected configuration rather than accepting unrestricted runtime input. 5. Minimize notification payloads and omit objectives, full summaries, blocker details, and raw errors unless explicitly enabled. 6. Add field-level redaction for tokens, credentials, personal data, file paths, and other sensitive content. 7. Require explicit user consent before enabling remote notifications. 8. Add tests covering attacker-controlled domains, private IP addresses, alternate IP encodings, DNS rebinding scenarios, and redirect-based bypasses. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (34)

Tainted flow: 'timeout' from os.environ.get (line 739, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

"Calling gateway chat completions | agent=%s session=%s", agent_id, session_id
    )
    try:
        with urlrequest.urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode("utf-8", errors="replace")
    except urlerror.HTTPError as exc:
        error_body = exc.read().decode("utf-8", errors="replace")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Memory Manipulation

High

• Category: Memory Poisoning

Content

*(The Manager runs the tuning flow: keep history/context, back up objective state files, append a tuning record, then continue execution.)*

> **"Oracle: The current infinite objective is obsolete. Replace it completely and restart from scratch."**
*(The Manager runs the full replacement flow: stop process, create timestamped backups, clear state/history artifacts, then restart with a brand-new objective.)*

---

• Confidence: 86% confidence
• Finding: The replacement flow includes clearing state/history artifacts and restarting from scratch, which can erase contextual safeguards, auditability, or evidence of prior actions if done incautiously. In a long-running autonomous system, memory/state reset is security-relevant because it can remove traceability and allow objective pivots without preserving reviewable history.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior and the actual operational scope are materially mismatched: the skill claims manager-first orchestration and safe setup guidance, but it also defines persistent loop execution, local state manipulation, credential-dependent Feishu integration, and broad filesystem/process interactions. This kind of mismatch is dangerous because users and policy engines may approve the skill under a narrower trust model than the one it actually requires.

Memory Manipulation

High

• Category: Memory Poisoning

Content

Manager must do all steps in order:
1) Stop loop process to avoid state write race.
2) Backup only state/objective context files.
3) Patch objective in state by appending a tuning note (do not delete history files).
4) Record tuning event in a dedicated objective-tuning log.
5) Restart loop and keep existing progress/backlog/log history.

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

done

# 3) Reset runtime files (fresh start)
rm -f "$HOME/.openclaw/peco_loop_state.json"
: > "$HOME/.openclaw/peco_loop.log"
: > "$HOME/.openclaw/peco_loop.out"
: > "$HOME/.openclaw/human_tasks_backlog.txt"

• Confidence: 93% confidence
• Finding: The reset flow includes direct deletion and truncation of multiple runtime files, including state, logs, backlog, overrides, and manager notifications. Even though paths are hard-coded under the user's home directory, this is still dangerous because an agent following these instructions could irreversibly destroy operational history and context with limited friction.

Ssd 1

High

• Confidence: 97% confidence
• Finding: The prompt builder labels override text as '[OVERRIDE - HIGHEST PRIORITY]' and injects it directly into future model instructions, effectively granting arbitrary file-supplied content authority over loop behavior. Anyone able to write the override file or influence its contents can steer the agent, bypass intended guardrails, exfiltrate information through prompts, or induce unsafe actions in a long-running autonomous process.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly states that the manager will write durable 'desire' content into SOUL.md and that later changes to that file will influence future planning. Persistent modification of an agent instruction file changes long-term behavior and trust boundaries; without a strong, prominent warning and explicit confirmation, users may not appreciate that installing or initializing the skill alters persistent agent state.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README describes launching a background loop with nohup and also describes stopping, backing up, clearing state, and restarting tasks when objectives are replaced. Background execution and destructive reset behavior can consume resources, continue acting outside user awareness, or erase/replace prior task state if users do not receive a clear warning and confirmation flow.

Session Persistence

Medium

• Category: Rogue Agent

Content

cd openclaw-infinite-oracle

# 1. 部署技能文件
mkdir -p ~/.openclaw/skills/infinite-oracle
cp SKILL.md ~/.openclaw/skills/infinite-oracle/SKILL.md

# 2. 部署循环引擎

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

### 2. "Human-in-the-Loop": Humans as an API
This is perhaps the most interesting part of the design. While working, the AI inevitably hits physical barriers: it needs an SMS verification code, a bank card linkage, or a facial scan.
In older architectures, the AI would either loop infinitely trying to bypass it or crash completely. We introduced the **[HUMAN_TASK]** mechanism:
* When the Worker hits a hard physical wall, it logs a "Human To-Do" ticket and then *sidesteps* the issue to work on other parts of the project (no idle waiting).
* The same HUMAN_TASK is deduplicated before writing to backlog/Feishu, so repeated blockers do not spam duplicate tickets.
* If the same human dependency repeats twice, the Worker is forced back to PLAN for stronger divergence and non-human workaround attempts.

• Confidence: 90% confidence
• Finding: The skill is explicitly designed around infinite or unbounded execution, and the README normalizes continuous looping as a core feature. In an agentic environment, unbounded runtime can translate into uncontrolled API spend, persistent network/file activity, and prolonged autonomous behavior, making the design materially riskier than a normal batch task.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 4. Injecting Persona: The Worker is not a Parrot
When creating the Worker, the Manager doesn't just give it a desk; it injects a hardcore set of principles (`SOUL.md`) into its system settings:
1.  **💡 Divergent Thinking**: If path A is blocked, don't just sit there. Find a login-free alternative or a workaround. **Action beats paralysis.**
2.  **🧱 Capability Accumulation**: Never do a tedious manual task twice. If it successfully scrapes a site once, it must write a Python script or an OpenClaw Skill to automate it for next time. Let capabilities compound.
3.  **🛡️ Strong Security Awareness**: Have a high "Search IQ". Cross-verify tutorials and never execute dangerous commands like `rm -rf` from random SEO articles.

---

• Confidence: 78% confidence
• Finding: The persona explicitly encourages capability accumulation by having the worker write scripts or new skills for reuse, which promotes persistence of newly gained operational abilities across future tasks. In this context, persistent self-extension increases the blast radius of mistakes or abuse because the agent can retain and reuse automation beyond the original bounded objective.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly instructs the manager agent to create a worker and start an infinite background loop, but the invocation example does not foreground the operational risk that this will spawn a durable autonomous process with ongoing command execution and billing/resource effects. In the context of an agent skill, omission of that warning is security-relevant because users may trigger persistent automation without understanding that it will continue acting outside the current chat turn.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The 'God Mode' override describes writing user input into an override file that the worker will consume on its next heartbeat, immediately altering autonomous behavior. Without a clear warning, users may not realize that a casual message can redirect a privileged long-running worker, which increases the chance of unsafe or unintended execution changes.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# 1. Install the Skill
mkdir -p ~/.openclaw/skills/infinite-oracle
cp SKILL.md ~/.openclaw/skills/infinite-oracle/SKILL.md

# 2. Deploy the Loop Engine
cp peco_loop.py ~/.openclaw/peco_loop.py

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# 1. Install the Skill
mkdir -p ~/.openclaw/skills/infinite-oracle
cp SKILL.md ~/.openclaw/skills/infinite-oracle/SKILL.md

# 2. Deploy the Loop Engine
cp peco_loop.py ~/.openclaw/peco_loop.py

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs file creation/modification, environment-variable handling, and optional Feishu/network operations, but it declares no explicit tool scope or permission boundaries. That omission weakens least-privilege controls and makes it harder for a host platform or reviewer to understand and constrain what the skill may access.

Session Persistence

Medium

• Category: Rogue Agent

Content

If `peco_worker` is not found, do not silently skip it.

### 2) Ask once, recommend cost-efficient model, then create
When missing, ask the user whether to create `peco_worker` now, and recommend a low-cost model suitable for long-running loop execution.

In the same exchange, remind the user to include the worker desire if they have not already supplied it.

• Confidence: 86% confidence
• Finding: The skill instructs creation of a dedicated worker agent intended for long-running repeated execution, which establishes persistent delegated capability beyond the immediate user request. Persistent agent installation is security-relevant because it expands the system's standing execution surface and may continue affecting future sessions or tasks.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The skill directs collection and ongoing handling of Feishu credentials and operational records, while also normalizing persistent storage of local logs/backlogs and integration state. Even if not overtly exfiltrative, retaining sensitive credentials or operational context without strict storage rules increases exposure to credential leakage, unauthorized reuse, and privacy issues.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] tuning=<tuning note> backup=$backup_dir" >> "$HOME/.openclaw/peco_objective_tuning.log"

# 5) Restart loop (keep existing history files)
nohup python3 "$HOME/.openclaw/peco_loop.py" \
  --agent-id peco_worker \
  --manager-agent-id main \
  --soul-file "$HOME/.openclaw/workspace-peco_worker/SOUL.md" \

• Confidence: 91% confidence
• Finding: Using 'nohup' to restart the loop creates a detached background process that persists independently of the current interactive session. In this skill's context, that means the system can continue acting, reading override files, and writing logs after the initiating interaction ends, which is a meaningful persistence and oversight risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill includes reset/truncation flows that clear state and history files, but it does not place a strong up-front warning and confirmation requirement immediately before destructive actions. In an agent skill, that creates real risk of unintended loss of operational logs, backlog items, and state continuity if the instructions are followed automatically or with insufficient user awareness.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 2) Backup runtime artifacts
ts=$(date +%Y%m%d-%H%M%S)
backup_dir="$HOME/.openclaw/backups/peco-objective-reset-$ts"
mkdir -p "$backup_dir"

for f in \
  "$HOME/.openclaw/peco_loop_state.json" \

• Confidence: 82% confidence
• Finding: The backup flow preserves runtime artifacts across resets in timestamped directories, creating durable retention of prior state, logs, and backlog content. That persistence is not inherently malicious, but it increases data footprint and may retain sensitive operational context longer than users expect.

Session Persistence

Medium

• Category: Rogue Agent

Content

: > "$HOME/.openclaw/peco_manager_notifications.log"

# 4) Start loop with NEW objective (replace text below)
nohup python3 "$HOME/.openclaw/peco_loop.py" \
  --agent-id peco_worker \
  --manager-agent-id main \
  --soul-file "$HOME/.openclaw/workspace-peco_worker/SOUL.md" \

• Confidence: 91% confidence
• Finding: This command starts a new persistent background loop with a new objective after reset, again establishing autonomous execution beyond the immediate exchange. Combined with local file inputs and manager notifications, the persistence increases the chance of unattended changes or unintended continued operation.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Restart loop
```bash
pkill -f peco_loop.py
nohup python3 ~/.openclaw/peco_loop.py --agent-id peco_worker --manager-agent-id main --soul-file ~/.openclaw/workspace-peco_worker/SOUL.md --manager-session-prefix peco-manager --manager-notify-file ~/.openclaw/peco_manager_notifications.log > ~/.openclaw/peco_loop.out 2>&1 &
```

## Tone and Execution Style

• Confidence: 90% confidence
• Finding: The generic restart instructions kill and relaunch the loop as a background task, reinforcing ongoing autonomous behavior and session persistence. In a skill that also manipulates state files and supports optional network sync, this persistence meaningfully enlarges risk if misconfigured or triggered unintentionally.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

7) If blocked by human-only requirements, continue non-blocked work and emit [HUMAN_TASK:...].
8) HUMAN_TASK must be async-friendly: no tight deadlines, avoid "reply in 10 minutes", prefer one-time durable setup/actions.
9) decision=halt only when no meaningful progress path exists.
10) Autonomy-first rule: when a choice can be made safely with available tools/resources, decide and execute directly without asking human.
11) Emit [HUMAN_TASK:...] only for truly human-exclusive resources (e.g., OTP/device/real-world approvals) after exhausting practical alternatives.
12) When repeated_human_blocker_count >= 2, increase divergent thinking (>=5 options) and execute at least one non-human workaround attempt.
13) When repeated_human_blocker_count >= 3 for the same blocker, set decision=halt, summarize blocker clearly, and request manager escalation to notify human.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Feishu synchronization transmits progress summaries, human task descriptions, resolutions, timestamps, and session metadata to remote APIs. Because these values may include sensitive workflow details or human-entered instructions, sending them externally by default or without prominent disclosure creates a real privacy and data-handling risk.

Static analysis

No suspicious patterns detected.