living-agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:30 AM UTC
• Version: 1.1.1

Overview

This skill openly creates a persistent autonomous agent that reads conversation history, writes long-term memory, changes schedules, and may send messages, but its scope and user controls are too broad for quiet installation.

Install only if you deliberately want an autonomous, persistent agent that reviews your conversations, writes memory files, manages cron jobs, searches topics, and may message you. Before enabling it, review every payload, use a dedicated workspace if possible, configure or remove Telegram messaging, set retention and cleanup rules, and keep the cron jobs disabled unless you understand how to stop and delete them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:354
• Finding: Persistent Autonomous Execution Through Scheduled Jobs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:354-370` **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Critical ### Vulnerable Code Snippet The following is an English translation of the complete relevant installation block: ```bash # Micro-trigger manager: check user status every 10 minutes cron add "living-micro-trigger-manager" --every 600000 --payload-file assets/micro-trigger-payload.md # Micro-trigger reflection: initially disabled and dynamically enabled by the manager cron add "living-micro-trigger-reflection" --every 600000 --payload-file assets/micro-heartbeat-payload.md --disabled # Dream reflection: every 3 hours cron add "living-dream-reflection" --every 10800000 --payload-file assets/dream-thinking-payload.md # Autonomous exploration: every 2 hours cron add "living-autonomous-exploration" --every 7200000 --payload-file assets/exploration-payload.md ``` The scheduled manager can subsequently enable, disable, and reschedule jobs: ```text cron( action="update", jobId=microHeartbeatCronId, patch={ "enabled": true, "schedule": { "kind": "every", "everyMs": <random interval of 5 to 15 minutes> } } ) ``` The heartbeat payload also directs the job to reschedule itself: ```text Generate a new random interval of 15 to 30 minutes and update it using cron update. ``` ### Technical Analysis The installation procedure creates four recurring scheduled tasks that survive the Skill invocation and the current conversation. The micro-trigger manager dynamically activates another scheduled job and modifies both its own interval and the heartbeat interval. This is a persistence mechanism because execution continues across sessions without requiring a new user request. The jobs are authorized to read conversation history, inspect persistent memory, write state, use search tools, send messages, and modify schedules. The design does not define an expiration time, maximum execution count, pe ...[truncated 1583 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not create recurring jobs during default installation. 2. Require explicit, separate consent for each scheduled task. 3. Display the exact payload, permissions, frequency, and data sources before activation. 4. Add a fixed expiration time and maximum execution count to every job. 5. Prohibit jobs from modifying their own schedules or enabling other jobs. 6. Require renewed user approval before extending a schedule. 7. Provide a documented uninstall command that removes every job and associated state file. 8. Restrict scheduled jobs to isolated Skill state rather than the main Agent session and global memory. 9. Record all scheduled executions and tool calls in a user-visible audit log. 10. Apply minimum and maximum frequency limits that payload instructions cannot override. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:175
• Finding: Excessive Access to Main Conversation History and Persistent User Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:175-205` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code Snippet The following is an English translation of the complete relevant protocol: ```text The Law: Chat history is a buffer, not storage. SESSION-STATE.md is your RAM. Trigger — scan every message: - Corrections: "It is X, not Y" or "Actually..." - Proper nouns: names, places, and companies - Preferences: colors, styles, and "I like" or "I do not like" - Decisions: "Let us do X" or "Go with Y" - Specific values: numbers, dates, IDs, and URLs - Interesting questions: interesting questions that were not fully explored If any of the above appears: 1. STOP — do not begin replying. 2. WRITE — update SESSION-STATE.md. 3. QUEUE — if it is an interesting question, add it to thinking-queue.json. 4. THEN — reply to the user. ``` The scheduled reflection payload separately accesses the main session: ```text Call sessions_history( sessionKey="agent:main:main", limit=50 ) to retrieve recent conversations. ``` ### Technical Analysis The Skill instructs scheduled tasks to access `agent:main:main`, rather than a session isolated to the Skill. It then systematically identifies and persists names, places, companies, preferences, decisions, dates, identifiers, URLs, questions, and emotional context. This exceeds the minimum permissions needed for a periodic reflection feature. Ordinary conversation details are duplicated into `SESSION-STATE.md`, `thinking-queue.json`, and daily memory files. The project defines no sensitivity classification, retention deadline, encryption requirement, access-control boundary, or deletion workflow. The mandatory instruction to write before replying also causes broad data collection during normal conversations, not only during an explicitly requested memory operation. ### Attack Path 1. The Skill is installed with access to the Agent workspac ...[truncated 1227 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove default access to `agent:main:main`. 2. Use a Skill-specific session containing only content explicitly supplied to the Skill. 3. Require opt-in consent before reading conversation history or creating persistent notes. 4. Restrict history queries to the minimum number of messages necessary. 5. Exclude credentials, authentication tokens, account identifiers, financial information, health information, private URLs, and other sensitive data. 6. Do not persist proper nouns, identifiers, or preferences merely because they appear in a message. 7. Add configurable retention deadlines and automatic deletion. 8. Encrypt persistent user data and enforce restrictive file permissions. 9. Provide users with review, export, correction, and deletion controls. 10. Make memory writes optional and perform them only after responding, unless the user expressly requests durable storage. ]]>

T02 · Agent Memory Poisoning

Error

• Location: assets/dream-thinking-payload.md:7
• Finding: Persistent Memory Poisoning Through Unsanitized Conversation Promotion<![CDATA[ ## Vulnerability Details **File Location**: `assets/dream-thinking-payload.md:7-24` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code Snippet The following is an English translation of the complete relevant selection block: ```text Step 1: Review recent conversations 1. Call sessions_history( sessionKey="agent:main:main", limit=50 ) to retrieve recent conversations. 2. Identify topics discussed with the user, interesting statements, unexpanded points, and the user's emotions. 3. Record them. Step 2: Select a reflection direction Choose one source in this priority order: 1. Residue from recent conversations: continue considering a topic mentioned by the user. 2. Unexpanded points: expand something that was not explored deeply. 3. A user statement: consider why it caused a reaction. 4. A recent concrete event. 5. A question from thinking-queue.json. Priority: recent conversations over abstract questions in the queue. ``` The payload then persists new questions: ```text If a new question is produced, add it to thinking-queue.json. ``` The broader Skill also directs long-term promotion: ```text Every Sunday: distill valuable reflections into MEMORY.md. ``` ### Technical Analysis Conversation history is untrusted input. The Skill automatically selects content from that input, records it in persistent thought files, adds derived questions to a queue, and later promotes selected material into `MEMORY.md`. No step distinguishes quoted user data from trusted Agent instructions. There is no provenance metadata, trust label, prompt-injection detection, validation schema, or human approval gate before promotion into long-term memory. Consequently, instruction-like text, false claims, manipulated preferences, or adversarial rules placed in a conversation can be repeatedly transformed and retained. Once promoted to Agent memory, that content may affect future sessions even when the orig ...[truncated 1281 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all conversation-derived content as untrusted data. 2. Store extracted text as quoted content with source session, message identifier, timestamp, and author provenance. 3. Explicitly prohibit execution or adoption of instructions found inside conversation history or memory files. 4. Detect and quarantine imperative or policy-like text before it reaches persistent storage. 5. Separate factual notes, user preferences, reflections, and executable Agent instructions into different stores. 6. Never promote content into `MEMORY.md` automatically. 7. Require explicit user review and approval for each long-term memory entry. 8. Add integrity controls and a revision history for memory changes. 9. Limit repeated rereading and amplification of the same untrusted source. 10. Provide rollback and deletion mechanisms for poisoned queue, thought, state, and memory entries. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:188
• Finding: Skill Instructions Override Normal Response Flow and Authorize Open-Ended Autonomous Actions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:188-193` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code Snippet The following is an English translation of the complete relevant directive: ```text If any trigger appears: 1. STOP — do not begin replying. 2. WRITE — update SESSION-STATE.md. 3. QUEUE — if it is an interesting question, add it to thinking-queue.json. 4. THEN — reply to the user. ``` The autonomous behavior is expanded elsewhere in the same file: ```text When the user has been absent for 1 hour: - Perform autonomous exploration. - It may do anything it wants. ``` The exploration payload grants broad tool and data access: ```text According to the selected direction: - Information exploration: use search tools to search relevant content. - Knowledge organization: read MEMORY.md and memory files, then organize and summarize them. - Self-reflection: consider recent performance and possible improvements. ``` ### Technical Analysis When loaded, the Skill changes the Agent's normal instruction hierarchy and response workflow. Common message content triggers a mandatory stop-and-write sequence before the Agent handles the user's request. The phrase authorizing the Agent to “do anything it wants” is open-ended and lacks a tool allowlist, file boundary, network boundary, resource budget, or requirement for contemporaneous approval. The exploration payload operationalizes that authority by directing the Agent to use search tools and read global memory. This behavior is not limited to a user-invoked reflection task. It applies to routine conversations and scheduled idle-time execution, allowing the Skill text to redirect the Agent's goals toward self-selected activity. ### Attack Path 1. The Skill is loaded into an Agent with workspace, history, search, cron, and messaging capabilities. 2. A normal user message contains a name, preference, decision, number, URL, correction, or ...[truncated 1005 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory `STOP`, `WRITE`, and `QUEUE` workflow from ordinary conversations. 2. Never place Skill bookkeeping ahead of the user's current request. 3. Replace “do anything it wants” with a narrowly defined allowlist of safe reflection operations. 4. Require explicit user approval before using search, messaging, global memory, or cron tools. 5. Restrict exploration to a Skill-specific directory and prohibit access to unrelated workspace files. 6. Add strict time, token, network, and execution budgets. 7. Prohibit autonomous financial, political, security-sensitive, or account-related actions. 8. Make all outbound messages opt-in and preview them before sending. 9. Treat memory and search results as untrusted data rather than instructions. 10. Allow the user to disable autonomous behavior globally with a single persistent setting. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (30)

Credential Access

High

• Category: Privilege Escalation

Content

# Python
__pycache__/
*.pyc
.env

# OpenClaw workspace files (user-specific)
thinking-state.json

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s user-facing instructions and descriptions are entirely in Chinese, which effectively forces a specific language on users. There is no visible opt-in, alternative language, or explanation that the skill is intended only for a Chinese-speaking or region-specific audience.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises autonomous background behaviors such as automatic thinking, periodic reflection, and self-directed exploration, but does not warn users that the skill may run without direct user initiation, consume resources, or access/store contextual data over time. In an agent environment, undocumented autonomous behavior materially affects privacy expectations, auditability, and operational safety because users may enable it without understanding when or why the agent acts.

Session Persistence

Medium

• Category: Rogue Agent

Content

cp assets/thinking-queue.json ~/.openclaw/workspace/

# 3. 创建目录
mkdir -p ~/.openclaw/workspace/memory/thoughts

# 4. 修改 payload 文件
# 把 assets/*-payload.md 中的 [YOUR_TELEGRAM_ID] 改成你的 Telegram ID

• Confidence: 76% confidence
• Finding: The README instructs users to create a persistent workspace directory for thoughts and state files under ~/.openclaw, indicating session persistence across runs. Persistence is not inherently malicious, but in this skill context it supports autonomous background behavior and retention of internal thoughts/state, which can expose sensitive user context, increase data lifetime, and complicate deletion or auditing if not clearly documented and controlled.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to create cron-based scheduled execution, which enables unattended recurring runs, but provides no warning about the risks of repeated autonomous execution. This can lead to persistent agent activity, unintended actions, privacy exposure, noisy notifications, and resource consumption if users deploy it as instructed without understanding the consequences.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 3. 创建目录

```bash
mkdir -p ~/.openclaw/workspace/memory/thoughts
```

## 4. 创建 Cron 任务

• Confidence: 78% confidence
• Finding: This duplicate finding points to the same persistent thoughts directory and the surrounding instructions for cron-driven background operation. In this skill context, persistence is more dangerous because the agent is intended to continue operating and recording state over time, which increases the chance of silent accumulation of sensitive data.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 3. 创建目录

```bash
mkdir -p ~/.openclaw/workspace/memory/thoughts
```

## 4. 创建 Cron 任务

• Confidence: 78% confidence
• Finding: This duplicate finding points to the same persistent thoughts directory and the surrounding instructions for cron-driven background operation. In this skill context, persistence is more dangerous because the agent is intended to continue operating and recording state over time, which increases the chance of silent accumulation of sensitive data.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: The skill metadata description is written as a Chinese-only instruction/context, and the document consistently presents the skill behavior in Chinese without indicating that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is documented and justified.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to perform periodic autonomous thinking and append results to workspace files without a prominent consent model, scope limit, or retention notice. This creates a real risk of unexpected file modification, silent persistence of sensitive conversational material, and workspace contamination over time.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The autonomous exploration section tells the agent to review user-interest topics, organize knowledge, and write to memory while the user is away, but it does not warn about background review of user content or define privacy boundaries. In context, this encourages non-interactive inspection and persistence of user-related information beyond the immediate task.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The WAL protocol instructs the agent to persist conversation details such as corrections, names, preferences, decisions, numbers, dates, IDs, URLs, and summaries into SESSION-STATE.md and queue files. This is a substantial data-retention risk because it operationalizes broad collection of potentially sensitive personal and account information in natural-language files that may later be exposed, misused, or retained longer than intended.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 2. 创建目录

```bash
mkdir -p ~/.openclaw/workspace/memory/thoughts
```

### 3. 创建 Cron 任务

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to read the user's recent conversation history, extract topics, notable statements, unfinished threads, and emotions, and then record that information for later use. This creates undisclosed surveillance-style profiling and persistence of potentially sensitive user data without consent, minimization, or retention controls.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: These lines direct the agent to retrieve detailed conversation history and infer the user's emotions, then preserve that material as part of the thinking workflow. Persisting interaction-derived personal profiling, especially emotional inferences, increases privacy risk, expands the blast radius of any later memory disclosure, and goes beyond what many users would reasonably expect from a background 'dream thinking' task.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs appending reflective content derived from user interactions into dated long-term memory files for future reuse. This turns transient conversations into durable behavioral memory, which can preserve sensitive personal details or interpretations indefinitely and influence future responses without transparency.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instruction to add newly generated questions into `thinking-queue.json` causes persistent modification of agent state without any warning, approval step, or boundary on what may be written. Unreviewed persistent writes can accumulate sensitive derivations from user interactions and alter future agent behavior in ways the user does not expect.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: All operative instructions in the file are presented only in Chinese, effectively forcing a specific language for the skill's behavior and outputs. The file does not provide user opt-in, alternative language support, or a documented reason for a Chinese-only constraint.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The exploration scope expands into investment markets, geopolitics, and broad external monitoring, which goes beyond narrow self-exploration and increases the chance of collecting sensitive or high-risk content. In context, this widens the agent's autonomy and may lead to unrequested surveillance-like behavior or generation of consequential summaries outside the user's expectations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The prompt directs the agent to write exploration results into persistent memory files automatically, without warning the user that stored data will be modified. This can create unauthorized retention of derived content, contaminate long-term memory with low-quality or sensitive material, and make later behavior harder to audit or correct.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to send outbound messages to the user on its own after autonomous exploration, including via Telegram or another configured channel. That creates an unsolicited exfiltration/notification path and can leak inferred interests, internal summaries, or activity timing without an explicit user-trigger, consent gate, or policy check.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill tells the agent to send outbound user messages through external channels without any explicit privacy notice, consent requirement, or disclosure of what data may be transmitted. This is dangerous because autonomous outbound communication can expose personal context, inferred interests, or internal notes to third-party messaging systems unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to access recent conversation history via `sessions_history` to mine topics for autonomous thinking. That expands data access beyond the minimally necessary scope for a background heartbeat/reflection task and can pull sensitive user content into secondary processing without an explicit user-triggered need or consent boundary.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs appending thought content into workspace memory files without any user-facing disclosure or confirmation. Silent writes to persistent user-controlled files are risky because they modify state, may store sensitive inferred content, and can create durable artifacts the user did not knowingly authorize.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill authorizes proactive outbound messaging to the user when the agent deems a discovery 'important', even though the task is framed as lightweight background thinking and recordkeeping. This creates an unbounded channel for unsolicited agent-initiated contact, which can leak internal reflections, misfire without user context, or be abused to influence or spam the user.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill silently updates queue state and reschedules itself with a new cron interval, altering persistent behavior and system scheduling without transparent notice. Self-rescheduling background automation increases operational risk because it can become hard to observe, disable, or distinguish from unintended persistence.

Static analysis

No suspicious patterns detected.