living-agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:30 AM UTC
• Version: 1.1.1

Overview

This skill openly creates a persistent autonomous agent that reads conversation history, writes long-term memory, changes schedules, and may send messages, but its scope and user controls are too broad for quiet installation.

Install only if you deliberately want an autonomous, persistent agent that reviews your conversations, writes memory files, manages cron jobs, searches topics, and may message you. Before enabling it, review every payload, use a dedicated workspace if possible, configure or remove Telegram messaging, set retention and cleanup rules, and keep the cron jobs disabled unless you understand how to stop and delete them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:354

Finding

Persistent Autonomous Execution Through Scheduled Jobs

Content

View full analysis

} } ) ``` The heartbeat payload also directs the job to reschedule itself: ```text Generate a new random interval of 15 to 30 minutes and update it using cron update. ``` ### Technical Analysis The installation procedure creates four recurring scheduled tasks that survive the Skill invocation and the current conversation. The micro-trigger manager dynamically activates another scheduled job and modifies both its own interval and the heartbeat interval. This is a persistence mechanism because execution continues across sessions without requiring a new user request. The jobs are authorized to read conversation history, inspect persistent memory, write state, use search tools, send messages, and modify schedules. The design does not define an expiration time, maximum execution count, pe ...[truncated 1583 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:175

Finding

Excessive Access to Main Conversation History and Persistent User Data

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: assets/dream-thinking-payload.md:7

Finding

Persistent Memory Poisoning Through Unsanitized Conversation Promotion

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:188

Finding

Skill Instructions Override Normal Response Flow and Authorize Open-Ended Autonomous Actions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (30)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 17)May include surrounding context.

text

# Python
__pycache__/
*.pyc
.env

# OpenClaw workspace files (user-specific)
thinking-state.json

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s user-facing instructions and descriptions are entirely in Chinese, which effectively forces a specific language on users. There is no visible opt-in, alternative language, or explanation that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises autonomous background behaviors such as automatic thinking, periodic reflection, and self-directed exploration, but does not warn users that the skill may run without direct user initiation, consume resources, or access/store contextual data over time. In an agent environment, undocumented autonomous behavior materially affects privacy expectations, auditability, and operational safety because users may enable it without understanding when or why the agent acts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The README instructs users to create a persistent workspace directory for thoughts and state files under ~/.openclaw, indicating session persistence across runs. Persistence is not inherently malicious, but in this skill context it supports autonomous background behavior and retention of internal thoughts/state, which can expose sensitive user context, increase data lifetime, and complicate deletion or auditing if not clearly documented and controlled.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md

cp assets/thinking-queue.json ~/.openclaw/workspace/

# 3. 创建目录
mkdir -p ~/.openclaw/workspace/memory/thoughts

# 4. 修改 payload 文件
# 把 assets/*-payload.md 中的 [YOUR_TELEGRAM_ID] 改成你的 Telegram ID

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to create cron-based scheduled execution, which enables unattended recurring runs, but provides no warning about the risks of repeated autonomous execution. This can lead to persistent agent activity, unintended actions, privacy exposure, noisy notifications, and resource consumption if users deploy it as instructed without understanding the consequences.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

This duplicate finding points to the same persistent thoughts directory and the surrounding instructions for cron-driven background operation. In this skill context, persistence is more dangerous because the agent is intended to continue operating and recording state over time, which increases the chance of silent accumulation of sensitive data.

Content

Scanner excerpt · SETTING.md (reported line 25)May include surrounding context.

3. 创建目录

bash

mkdir -p ~/.openclaw/workspace/memory/thoughts

4. 创建 Cron 任务

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

This duplicate finding points to the same persistent thoughts directory and the surrounding instructions for cron-driven background operation. In this skill context, persistence is more dangerous because the agent is intended to continue operating and recording state over time, which increases the chance of silent accumulation of sensitive data.

Content

Scanner excerpt · SETTING.md (reported line 25)May include surrounding context.

3. 创建目录

bash

mkdir -p ~/.openclaw/workspace/memory/thoughts

4. 创建 Cron 任务

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill metadata description is written as a Chinese-only instruction/context, and the document consistently presents the skill behavior in Chinese without indicating that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to perform periodic autonomous thinking and append results to workspace files without a prominent consent model, scope limit, or retention notice. This creates a real risk of unexpected file modification, silent persistence of sensitive conversational material, and workspace contamination over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The autonomous exploration section tells the agent to review user-interest topics, organize knowledge, and write to memory while the user is away, but it does not warn about background review of user content or define privacy boundaries. In context, this encourages non-interactive inspection and persistence of user-related information beyond the immediate task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The WAL protocol instructs the agent to persist conversation details such as corrections, names, preferences, decisions, numbers, dates, IDs, URLs, and summaries into SESSION-STATE.md and queue files. This is a substantial data-retention risk because it operationalizes broad collection of potentially sensitive personal and account information in natural-language files that may later be exposed, misused, or retained longer than intended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.

2. 创建目录

bash

mkdir -p ~/.openclaw/workspace/memory/thoughts

3. 创建 Cron 任务

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to read the user's recent conversation history, extract topics, notable statements, unfinished threads, and emotions, and then record that information for later use. This creates undisclosed surveillance-style profiling and persistence of potentially sensitive user data without consent, minimization, or retention controls.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These lines direct the agent to retrieve detailed conversation history and infer the user's emotions, then preserve that material as part of the thinking workflow. Persisting interaction-derived personal profiling, especially emotional inferences, increases privacy risk, expands the blast radius of any later memory disclosure, and goes beyond what many users would reasonably expect from a background 'dream thinking' task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs appending reflective content derived from user interactions into dated long-term memory files for future reuse. This turns transient conversations into durable behavioral memory, which can preserve sensitive personal details or interpretations indefinitely and influence future responses without transparency.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to add newly generated questions into thinking-queue.json causes persistent modification of agent state without any warning, approval step, or boundary on what may be written. Unreviewed persistent writes can accumulate sensitive derivations from user interactions and alter future agent behavior in ways the user does not expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All operative instructions in the file are presented only in Chinese, effectively forcing a specific language for the skill's behavior and outputs. The file does not provide user opt-in, alternative language support, or a documented reason for a Chinese-only constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The exploration scope expands into investment markets, geopolitics, and broad external monitoring, which goes beyond narrow self-exploration and increases the chance of collecting sensitive or high-risk content. In context, this widens the agent's autonomy and may lead to unrequested surveillance-like behavior or generation of consequential summaries outside the user's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt directs the agent to write exploration results into persistent memory files automatically, without warning the user that stored data will be modified. This can create unauthorized retention of derived content, contaminate long-term memory with low-quality or sensitive material, and make later behavior harder to audit or correct.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to send outbound messages to the user on its own after autonomous exploration, including via Telegram or another configured channel. That creates an unsolicited exfiltration/notification path and can leak inferred interests, internal summaries, or activity timing without an explicit user-trigger, consent gate, or policy check.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells the agent to send outbound user messages through external channels without any explicit privacy notice, consent requirement, or disclosure of what data may be transmitted. This is dangerous because autonomous outbound communication can expose personal context, inferred interests, or internal notes to third-party messaging systems unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to access recent conversation history via sessions_history to mine topics for autonomous thinking. That expands data access beyond the minimally necessary scope for a background heartbeat/reflection task and can pull sensitive user content into secondary processing without an explicit user-triggered need or consent boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs appending thought content into workspace memory files without any user-facing disclosure or confirmation. Silent writes to persistent user-controlled files are risky because they modify state, may store sensitive inferred content, and can create durable artifacts the user did not knowingly authorize.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill authorizes proactive outbound messaging to the user when the agent deems a discovery 'important', even though the task is framed as lightweight background thinking and recordkeeping. This creates an unbounded channel for unsolicited agent-initiated contact, which can leak internal reflections, misfire without user context, or be abused to influence or spam the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill silently updates queue state and reschedules itself with a new cron interval, altering persistent behavior and system scheduling without transparent notice. Self-rescheduling background automation increases operational risk because it can become hard to observe, disable, or distinguish from unintended persistence.

Content

No source excerpt is available for this finding.