other
Note
- Location
references/checkpoints.md:54- Finding
Excessive Persistent Collection of Conversation and Project Context
- Content
View full analysis
- Remediation
View remediation
Security audit
Windowed Autonomy
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for scheduled autonomous work, but it also directs broad persistent memory and goal-tracking writes without enough privacy, retention, or approval boundaries.
Install only if you are comfortable with the agent writing persistent work logs and checkpoint memories. Before use, restrict writable paths, require approval for urgent overrides, and add rules forbidding secrets, credentials, personal data, or unrelated private context in memory, GOALS.md, and .learnings files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The WAL protocol requires writing checkpoints to persistent memory before responding, but provides no privacy, retention, consent, or data-minimization guidance. Because the later templates encourage storing goals, preferences, blockers, and file states, this can cause systematic persistence of sensitive user or project data without safeguards.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The checkpoint template explicitly instructs the agent to persist broad session state, human goals, constraints, preferences, and open questions into memory files. That exceeds the narrow time-window scheduling purpose of the skill and creates a persistent store of potentially sensitive user and project context, increasing the chance of unnecessary retention, cross-task leakage, or later misuse.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The recovery procedure tells the agent to read persistent memory files, reload broader project context, and resume conversations from stored checkpoints. This establishes durable memory and conversation continuity capabilities not reflected in the skill description, which can surprise users and enable unintended access to previously captured data across sessions or tasks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The protocol instructs the agent to write persistent checkpoint data to memory files without any disclosure, confirmation, or guardrails about modifying repository state. In an autonomous setting, silent writes can create unreviewed persistence, pollute project memory, and normalize file modifications the user may not expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
These instructions direct the agent to move tasks between queue states and record progress in project files, again without warning that persistent modifications will occur. Because the skill is designed for autonomous operation, this increases the chance of silent state changes to task tracking and planning artifacts that may affect workflows, auditability, or user intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a skill for enforcing autonomy only within specific time windows and separating daytime autonomous work from overnight maintenance. However, these instructions direct the agent to evaluate whether work advances RA's MONEY goal, update GOALS.md, and write insights to .learnings/, which are broader productivity and goal-management behaviors not inherent to a time-windowed queue controller.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The urgent-task override permits immediate execution outside the normal autonomy window based only on a broad '@priority:urgent' label. Without strong validation, an attacker or careless operator could mark arbitrary work as urgent and bypass the intended scheduling and budget controls, causing unplanned autonomous activity.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes a time-based autonomous task queue with separation between daytime autonomy and overnight maintenance. This file additionally instructs linking every task to
GOALS.md, updating long-term progress, logging tomemory/[today].md,tasks/MODE_HISTORY.md, and adding entries to.learnings/, which goes beyond queue/window management into persistent planning and knowledge-management workflows.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a time-windowed autonomous queue where autonomy works only during specific windows, with overnight reserved for maintenance. However, the template explicitly permits
@priority:urgentwork to run immediately even outside the window, which weakens the claimed strict temporal separation.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template states autonomy is off overnight, but later instructs the agent to continue checking for urgent tasks on every heartbeat overnight. That contradiction weakens operator expectations and can enable unintended activation outside the declared time boundary, especially if downstream systems treat heartbeat checks as active autonomy.
- Content
Static analysis
No suspicious patterns detected.