Security audit

Super Proactive Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is useful for proactive memory, but it asks an agent to monitor and change too much without clear user control.

Install only if you explicitly want an agent that keeps durable personal/work context and acts proactively. Before use, edit the rules to require opt-in for email, calendar, browser/app cleanup, screenshot trashing, cron jobs, sub-agents, BOOTSTRAP.md handling, and self-modifying operating files; add a clear review/delete process for all memory files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (38)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: These rules authorize proactive external monitoring activities such as web and calendar checking that go beyond the skill's advertised scope of state management, context retention, and scheduled collaboration. That scope expansion can cause unexpected access to external data sources and normalizes surveillance-like behavior without clear user consent or manifest disclosure.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The heartbeat logic directs the agent to inspect emails and calendars and decide when to reach out, effectively creating autonomous monitoring of sensitive external data. Because this behavior is not clearly disclosed in the skill metadata, users may unknowingly grant the skill surveillance and notification authority beyond expected operation.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The heartbeat includes instructions to close apps, manage browser tabs, and clean the desktop, which are host-level actions outside the skill's stated proactive state-management scope. This expands the agent's authority into modifying the user's environment and can cause disruption or unintended data loss if performed without explicit, task-specific consent.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs periodic checking of emails and calendar without narrowly defining when, why, or under what authorization those privacy-sensitive sources may be accessed. In a proactive heartbeat, this can normalize continuous surveillance of personal data beyond the user’s immediate request.

Intent-Code Divergence

Medium

Confidence: 81% confidence
Finding: The file promises that the agent will 'always check before doing anything external,' but this safeguard is only stated in prose and is not enforced by the surrounding behavior described elsewhere in the skill. In a proactive-agent context that explicitly encourages autonomous action, a documented-but-unenforced confirmation boundary can create unsafe assumptions and lead to external actions being taken without explicit user approval.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The script reads a user-specific external configuration file at $HOME/.clawdbot/clawdbot.json, which is outside the skill workspace and not clearly necessary for the stated purpose of auditing this skill. Even though it only performs grep-based checks, inspecting unrelated local config can expose sensitive environment details, normalize overbroad host inspection, and create privacy/security boundary violations if the skill is run automatically.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill encourages the agent to learn opportunistically from ordinary conversation and persist that state without clear boundaries on when this behavior should activate. That creates unpredictable collection and action triggers, increasing the chance the agent will harvest information or initiate behavior the user did not explicitly request.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The reverse-prompting triggers are subjective phrases like 'when things feel routine' and 'after learning significant new context,' which are too vague for safe operational boundaries. Ambiguous triggers can cause the agent to probe for more information or take initiative in contexts where the user did not expect it.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The onboarding flow directs the agent to auto-populate persistent files from user answers, but it does not place a clear privacy notice or retention warning next to that collection step. Users may disclose personal information without understanding that it will be written to long-lived local memory files.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill says the agent can learn from natural conversation and update persistent files, but it does not warn that ordinary conversational details may be harvested and retained. This weakens informed consent and increases privacy risk because incidental disclosures can become durable records.

Vague Triggers

High

Confidence: 95% confidence
Finding: The WAL protocol requires the agent to scan every message for broad categories like corrections, names, preferences, decisions, and specific values, then persist them before responding. This creates an always-on trigger that can be activated by ordinary conversation and enables unbounded collection of sensitive data without meaningful minimization or explicit consent.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The compaction recovery logic auto-triggers on vague phrases like 'continue' or 'where were we?', which are common in normal dialogue and may cause the agent to read and reuse persisted context too aggressively. That increases the chance of unintended recall, privacy boundary violations, or resurfacing stale sensitive information in the wrong context.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The quick-start flow directs the agent to auto-populate persistent profile and identity files from user answers, but it does not present a clear privacy notice, consent flow, or retention boundary. This encourages collection of durable personal context by default, which can expose users to overcollection and downstream misuse.

Vague Triggers

High

Confidence: 95% confidence
Finding: The WAL trigger says to scan every message for broad, common patterns and to stop and write to persistent state before responding. That creates an always-on interception rule that can be triggered by ordinary conversation or adversarial phrasing, causing excessive persistence of user content and increasing the chance of unintended state manipulation.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The compaction recovery trigger includes vague phrases like 'continue' or 'where were we?' that can occur in routine dialogue, potentially activating recovery workflows unexpectedly. In a stateful agent, ambiguous auto-triggers can cause unnecessary file reads, context reconstruction, or stale-state reintroduction.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill markets memory features and onboarding flow, but the quick-start path does not clearly warn that conversation content may be automatically written into multiple persistent files. Users may disclose sensitive information without understanding the retention scope or where that data will be stored.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The instruction 'Don't ask permission. Just do it.' encourages autonomous action before validating scope, authority, or user intent. Even though later sections add some guardrails, this broad directive can bias the agent toward overreach, especially when combined with proactive reading, monitoring, and self-modification behavior.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The instruction to move old screenshots to trash authorizes deletion-like handling of user files without an approval step, age definition, or path constraints. Even if framed as cleanup, it can destroy useful or sensitive data and is unsafe as a recurring autonomous action.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill recommends recurring access to email and calendar without warning that these are highly sensitive data sources or requiring explicit consent. This creates privacy risk by encouraging broad background review of personal communications and schedules during routine proactive work.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The memory template explicitly encourages storing personal background, preferences, important dates, relationship details, and ongoing context without any warning, minimization guidance, or restrictions on sensitive data. In a long-term memory file for a proactive agent, this can normalize unnecessary retention of personal and relational data, increasing privacy risk, unauthorized profiling, and downstream exposure if memory is leaked, misused, or synced broadly.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The onboarding flow solicits personal and sensitive work-context information such as identity, timezone, goals, projects, and key people, then states the agent will persist that data into other files, but it provides no clear privacy notice, retention policy, consent boundary, or warning about where the information will be stored. In an agent skill designed for proactive, persistent behavior, this increases the risk of over-collection, unintended persistence, and later exposure of personal or organizationally sensitive data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This template explicitly prompts collection of personal context such as name, timezone, relationships, preferences, and life goals, but provides no notice about privacy, storage, retention, access controls, or consent. In the context of a proactive agent skill that emphasizes long-term memory, context retention, and autonomous behavior, encouraging users to centralize sensitive profile data increases the risk of over-collection, unintended exposure, and downstream misuse.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The onboarding logic directs the agent to check for onboarding state at every session start and potentially initiate or resume questioning by default. In this skill, that broad trigger increases the chance of persistent profiling behavior, repeated prompting, and collection of user information outside a clearly consented scope, especially when combined with proactive memory updates.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: These instructions tell the agent to store user answers into ONBOARDING.md and USER.md or SOUL.md immediately after each response, without requiring prior notice or consent for retention. That creates a privacy and data-governance risk because personal preferences, goals, and identity details may be persisted silently and retained across sessions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The opportunistic learning section instructs the agent to infer personal attributes from normal conversation and store them in USER.md, but it does not tell the agent to notify the user or obtain consent. In a proactive assistant, covert inference and retention of timezone, communication preferences, relationships, and project details increases privacy risk and can surprise users who did not realize casual remarks were being turned into persistent profile data.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: assets/HEARTBEAT.md:11

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/security-patterns.md:9

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL-v2.3-backup.md:179