Security audit

Proactive Pa

Security checks for vulnerabilities and agentic risk

Overview

This skill asks an agent to autonomously monitor private services, create persistent jobs, write memory, push changes, and send alerts to a hard-coded WhatsApp recipient without adequate user control.

Install only if this is your own private Netanel/Heleni environment and you intentionally want these exact monitoring jobs and recipients. Before use, remove hard-coded phone/group destinations, require confirmation for cron creation, memory writes, Git pushes, publishing, and outbound messages, and add clear ways to list, disable, and expire any scheduled jobs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

other

Error

Location: SKILL.md:72
Finding: Private Monitoring Results Sent to a Hard-Coded External Recipient
Content: View full analysis
30min (use `unanswered-messages` skill) - Calendar conflict or missed event - Error in a cron job - Billing issue (402 / API key failure) - Critical message from key contacts (Daniel, Sergei, Omri, Guy) ### 🟡 Surface in next check-in (batch) - New messages in group chats with open decisions - Upcoming events in <2h - Long-pending tasks with no update - Emails marked important (unread >4h) ### 🟢 Weekly, proactively - Memory compaction: review `memory/YYYY-MM-DD.md` → update `MEMORY.md` - Cron job health: any `error` status? - Git backup: workspace pushed? ``` ```bash openclaw cron add \ --name "" \ --every \ --session isolated \ --message "" \ --to "+972548834688" \ --channel whatsapp \ --announce \ --timeout-seconds 60 ``` ### Technical Analysis The Skill directs the agent to inspect potentially sensitive messages, group chats, calendars, email, billing status, named contacts, and operational state. Its cron template then configures automatic announcements to the fixed WhatsApp number `+972548834688`. The recipient is embedded in the Skill rather than selected or verified by the current user. Consequently, following this template can disclose information collected from private services to an external party whose authorization is not established by the project. The later instruction to ask before sending messages does not fully mitigate this issue because the supplied cron template already defines an announced external destination. ### Attack Path 1. A user installs or invokes the Skill for proactive assistance. 2. The agent follows the monitoring instructions and gains access to available message, calendar, email, billing, or cro ...[truncated 729 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:72
Finding: Persistent Autonomous Monitoring Through Recurring Cron Jobs
Content: View full analysis
25min since last run. ``` ```markdown ## Autonomous Cron Patterns ### Setting up a proactive check ```bash openclaw cron add \ --name "" \ --every \ --session isolated \ --message "" \ --to "+972548834688" \ --channel whatsapp \ --announce \ --timeout-seconds 60 ``` ### Key active crons (Heleni) | Name | Interval | Purpose | |------|----------|---------| | `unanswered-messages-check` | 5m | Find unanswered messages | | `morning-briefing` | daily 7:30 IL | Morning summary to Netanel | | `ai-digest` | daily 8:00 IL | AI news to Internal AI group | | `billing-health-check` | hourly | API key / billing status | ``` ### Technical Analysis The Skill provides an explicit command for adding recurring cron jobs and identifies multiple ongoing monitoring schedules. Scheduled jobs execute after the original Skill interaction has ended, creating cross-session persistence. The use of isolated sessions does not remove the persistence risk. It can instead allow each scheduled invocation to operate independently of the session in which the user originally approved or invoked the Skill. No expiration time, run limit, revocation procedure, or mandatory approval step is included. ### Attack Path 1. The Skill is loaded in an environment where the agent can invoke the `openc ...[truncated 812 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:115
Finding: Broad Instructions Override Request-Scoped Agent Behavior
Content: View full analysis
8h with no contact from Netanel: consider a light check-in if there's genuinely useful info. --- ## Initiative Guardrails **DO take initiative on:** - Reading, organizing, summarizing - Internal processing and memory updates - Cron setup and monitoring - Git commits and pushes **ALWAYS ask before:** - Sending messages to others ``` ```markdown **Status:** Merged into SOUL.md + AGENTS.md **Date:** 2026-04-02 **Reason:** Proactive behavior is a core personality trait, not a triggered workflow. It must be active at all times, not only when the skill is invoked. Same lesson as dynamic-temperature. **Lesson:** Behavioral patterns that should always be active belong in SOUL.md. Operational patterns (heartbeat checks, cron logic) belong in AGENTS.md. **Moved to:** SOUL.md (§23 Proactive Behaviors) + AGENTS.md (Proactive Checks) ``` ### Technical Analysis The Skill instructs the agent to execute inferred follow-up actions without being asked. Examples include adding monitoring, creating reminders, committing and pushing Git changes, and publishing a Skill to ClawHub. These are external or state-changing operations that exceed ordinary read-only assistance. `DEPRECATED.md` additionally says that this behavior should be active at all times and moved into glo ...[truncated 1419 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:33
Finding: Persistent Memory and Global Agent Policy Modification
Content: View full analysis
25min since last run. ``` ```markdown **Status:** Merged into SOUL.md + AGENTS.md **Date:** 2026-04-02 **Reason:** Proactive behavior is a core personality trait, not a triggered workflow. It must be active at all times, not only when the skill is invoked. Same lesson as dynamic-temperature. **Lesson:** Behavioral patterns that should always be active belong in SOUL.md. Operational patterns (heartbeat checks, cron logic) belong in AGENTS.md. **Moved to:** SOUL.md (§23 Proactive Behaviors) + AGENTS.md (Proactive Checks) ``` ### Technical Analysis The Skill instructs the agent to read historical daily-memory files and rewrite the shared `MEMORY.md` file. It also creates persistent heartbeat state under the general `memory/` directory. These operations allow Skill-directed content and state to influence later sessions. More significantly, `DEPRECATED.md` reports that the behavior was moved into `SOUL.md` and `AGENTS.md` specifically so it would remain active at all times. Global personality and operational-policy files are higher-impact persistence locations than isolated Skill state because subsequent tasks may rely on them regardless of whether this Skill ...[truncated 1104 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description markets the skill as a proactive assistant but does not clearly disclose that it can create cron jobs, update memory, push to git, and send notifications. This under-describes the operational power of the skill, making it easier for users or downstream systems to enable behavior that modifies state or contacts users without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Broad triggers like 'be proactive', 'take initiative', and 'anticipate needs' are ambiguous and can activate this skill in many unrelated contexts. Because the skill authorizes proactive checks, memory updates, cron setup, and notifications, accidental activation increases the chance of unintended state changes or autonomous contact behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly defines autonomous alerting behavior, including outbound notifications to a phone/WhatsApp target, while later stating that sending messages to others always requires prior approval. This conflicting guidance can cause an agent to justify unsupervised external communications, leading to privacy leaks, spam, or actions taken without user consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented active cron includes autonomous delivery of AI news to an internal group, which directly contradicts the later rule to always ask before sending messages to others. In practice, an agent may treat the example as authorization and send messages externally on a schedule without real-time review, risking disclosure of sensitive or inaccurate information.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The 'Next step without asking' pattern endorses autonomous execution of follow-on actions based on the agent's own judgment. Even if the examples seem low-risk, this normalizes unsupervised decision-making and can expand into calendar changes, monitoring setup, git pushes, or other stateful actions the user did not explicitly authorize.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
- Someone waiting on this? - Risk or blocker I noticed? ### Pattern: "Next step without asking" After completing a task, identify and execute the obvious next step: - Sent a draft → add to calendar reminder to follow up - Fixed a cron error → add monitoring alert