Agent Autonomy Kit Zc

Stop waiting for prompts. Keep working.

Security Scan

The skill's instructions are coherent with an autonomy kit, but it omits any declaration of credentials or host-side requirements (Discord/Slack tokens, OpenClaw auth, cron permissions) and explicitly tells agents to run continuous autonomous cron jobs and post externally—this mismatch and the autonomy implications warrant caution.

Purpose & Capability

The name/description (turn an agent proactive) matches the content: task queue, heartbeats, cron jobs, team communication and token-budgeting are all expected for an autonomy kit. Nothing in the SKILL.md asks for unrelated capabilities or binaries.

Instruction Scope

Instructions direct agents to read and update local files (tasks/QUEUE.md, memory/YYYY-MM-DD.md), set cron jobs, spawn/team agents, and post to external team channels. Those are within an autonomy kit's remit but grant broad operational scope (continuous operation, external communications, agent spawning) and the doc gives open-ended discretion on what to 'do' during heartbeats—this increases risk if the agent has broad system/network permissions.

Install Mechanism

There is no install spec and no code files—this is instruction-only, so nothing will be downloaded or written by the skill itself during install. Lower install risk, but runtime actions depend on external host tooling (cron, openclaw CLI).

Credentials

The README and templates assume the agent can post to Discord/Slack, run openclaw CLI commands, and write/read memory/task files, but the skill declares no required environment variables or credentials. Missing declarations for channel/webhook tokens or OpenClaw credentials is an incoherence: the skill expects external credentials/permissions but doesn't list them.

Persistence & Privilege

The skill does not set always:true, but it instructs creation of recurring cron jobs and autonomous heartbeats that enable persistent, long-running activity. The skill itself doesn't directly request persistent platform privileges, but following its instructions will create persistent behavior—users should treat that as an elevation of runtime privilege.

Scan Findings in Context

[no-code-to-scan] expected: The regex scanner found no code files to analyze — this is expected because the skill is instruction-only. That increases the importance of manual review of SKILL.md and README, since there is no embedded code to inspect.

What to consider before installing

This kit is consistent with its goal of making agents proactive, but it assumes the host provides permissions and credentials it doesn't declare. Before installing or running it: 1) Confirm where cron jobs will run and which account creates them; run first in an isolated/test agent to observe behavior. 2) Identify and explicitly provision any credentials (OpenClaw auth, Discord/Slack webhooks or bot tokens) and only grant the minimum scopes needed for posting. 3) Limit heartbeat frequency and enforce token/budget caps to avoid runaway costs. 4) Require human-in-the-loop gates for agent spawning or high-impact actions. 5) Log all automated actions and review memory/task updates periodically. If you need higher assurance, request the author to declare required env vars and a tighter, less open-ended heartbeat procedure before use.

Agent Autonomy Kit

Transform your agent from reactive to proactive.

Quick Start

1. Create tasks/QUEUE.md with Ready/In Progress/Blocked/Done sections
2. Update HEARTBEAT.md to pull from queue and do work
3. Set up cron jobs for overnight work and daily reports
4. Watch work happen without prompting

Key Concepts

• Task Queue — Always have work ready
• Proactive Heartbeat — Do work, don't just check
• Continuous Operation — Work until limits hit

See README.md for full documentation.