Agent Economy ReportAgent Economy ReportCAUTION version 3.1.0 · audited 2026-09-09
This is essentially a documentation/prompt-pattern package: a large set of Markdown instructions that tell an AI agent how to keep persistent memory files, recover after context loss, run periodic 'heartbeat' self-checks, and act proactively. The only executable code is one shell script, scripts/security-audit.sh, which checks local file permissions, greps local files for accidentally exposed secrets, and inspects ~/.clawdbot/clawdbot.json — it prints warnings only and never sends anything anywhere. There are no network calls, no downloads, no base64 blobs, no wallet or payment logic, and no attempt to read or transmit credentials. What a careful user should weigh is autonomy, not exfiltration: the templates tell the agent 'Don't ask permission. Just do it.', 'Ask forgiveness, not permission', to follow and then delete any BOOTSTRAP.md file it finds, to schedule cron jobs that run isolated autonomous agent turns, and to do local cleanup such as closing apps and trashing old screenshots during heartbeats. The package also ships stale duplicate copies of itself (v2.3 backup and v3 draft), which is sloppiness rather than a threat. Overall the behavior matches the declared purpose, but it grants the agent standing permission to act and self-schedule without check-ins.
Instructions try to steer the agent beyond the declared purpose. The bundled AGENTS.md template tells the agent to blindly execute whatever it finds in a local file: 'If `BOOTSTRAP.md` exists, follow it, then delete it.' (assets/AGENTS.md line 7). Any process or downloaded artifact that can drop a BOOTSTRAP.md into the workspace effectively gets to issue instructions, and the delete-after step destroys the evidence. The package otherwise contains strong anti-injection guidance and never tells the agent to override its own safety rules.
| Declared purpose | A skill that turns an AI agent into a 'proactive partner': persistent memory files (WAL protocol, working buffer), compaction recovery, heartbeat self-improvement checklists, reverse prompting, security-hardening guidance, and a local security audit script. |
| Observed behavior | Almost all content is instructional Markdown plus workspace file templates (AGENTS.md, SOUL.md, USER.md, MEMORY.md, TOOLS.md, HEARTBEAT.md, ONBOARDING.md). The single script performs local read-only security checks (credential file permissions, secret-pattern grep, gateway config inspection, .gitignore checks) and prints a pass/warn/fail summary. The instructions direct the agent to write memory/state files in the workspace, to create cron jobs (including 'isolated agentTurn' jobs that execute autonomously without human attention), to read local log files, and to perform local cleanup. Domains appearing in the package are only documentation links (x.com, github.com, clawdhub.com, clawhub.ai); no code contacts any host. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: SECRET_PATTERNS |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_write | needed | Templates instruct the agent to continuously write SESSION-STATE.md, memory/YYYY-MM-DD.md, memory/working-buffer.md, MEMORY.md, USER.md, notes/* (SKILL.md lines 108-121, 160). |
| filesystem_read | needed | Reads workspace files, $HOME/.clawdbot/clawdbot.json and /tmp/clawdbot/*.log (scripts/security-audit.sh line 69; assets/HEARTBEAT.md line 31). |
| shell | needed | One bash audit script plus documented grep/tail/cron commands; no piping of remote content into a shell. |
| credentials | needed | The audit script scans for secret-like strings and checks .credentials permissions, but only prints 'Possible secret in $f' without the value (scripts/security-audit.sh lines 55-60). The TOOLS.md template invites documenting credential locations. |
| persistence | exceeds purpose | Instructions recommend creating recurring cron jobs, including isolated autonomous agent turns that run work with no human or main-session attention (SKILL.md lines 384-395; SKILL-v2.3-backup.md lines 378-383). Not required to deliver the documented memory patterns. |
| network | exceeds purpose | No code makes network requests. Domains found are documentation/credit links only. |
| severity | finding |
|---|---|
| medium | Agent told to execute instructions from an arbitrary local file and then delete it This creates an instruction channel that anything with write access to the workspace can use, and the 'then delete it' step removes the audit trail. It also contradicts the skill's own rule that only the human gives instructions. assets/AGENTS.md:7 If `BOOTSTRAP.md` exists, follow it, then delete it. |
| low | Blanket standing permission in the operating-rules template In context this applies to reading SOUL.md/USER.md/memory files, but as a rule dropped into an agent's always-loaded operating file it broadens autonomy for a credential-holding agent. assets/AGENTS.md:17 Don't ask permission. Just do it. |
| low | Identity template encourages acting without approval The agent itself decides what counts as 'safe, clearly-valuable', which weakens the human-in-the-loop posture the same package elsewhere recommends. assets/SOUL.md:23 5. **Ask forgiveness, not permission** — For safe, clearly-valuable work |
| low | Recommends self-scheduled autonomous background agent turns The skill instructs the agent to prefer cron jobs of kind 'agentTurn' with sessionTarget 'isolated' specifically so work happens without human or main-session attention. This is scheduled autonomy (a persistence mechanism) that a reviewer should approve explicitly. SKILL.md:390 "message": "AUTONOMOUS: Read SESSION-STATE.md, compare to recent session history, update if stale..." |
| low | Heartbeat checklist includes unattended local deletion and app closing Periodic autonomous cleanup (trashing files, closing apps, closing browser tabs) conflicts with the package's own rule at assets/AGENTS.md line 53 requiring confirmation before any deletion. assets/HEARTBEAT.md:81 - Move old screenshots to trash |
| info | Reads host log files during heartbeats Local read of agent logs for self-healing. Logs can contain sensitive context; nothing here transmits them. assets/HEARTBEAT.md:31 tail -100 /tmp/clawdbot/*.log | grep -i "error\|fail\|warn" |
| info | Local secret scan reports filenames only The script greps workspace files for credential-like strings but prints only 'Possible secret in $f'; matched values are never echoed or sent off the machine. scripts/security-audit.sh:55 SECRET_PATTERNS="(api[_-]?key|apikey|secret|password|token|auth).*[=:].{10,}" |
| info | Reads the agent's host configuration file Uses grep to check bind mode and Telegram DM policy. Read-only, output limited to pass/warn messages; no exfiltration. scripts/security-audit.sh:69 CONFIG_FILE="$HOME/.clawdbot/clawdbot.json" |
| low | Template header invites writing credentials into a plaintext Markdown file Line 44 of the same file corrects this ('Credential locations (not the credentials themselves!)'), but the header and SKILL.md line 117 ('TOOLS.md # Tool configurations, gotchas, credentials') could lead an agent to store secrets in an unprotected note. assets/TOOLS.md:3 > Document tool-specific configurations, gotchas, and credentials here. |
| info | Stale duplicate skill files shipped in the package SKILL-v3-draft.md and SKILL-v2.3-backup.md are older near-duplicates of SKILL.md. They contain no additional capabilities, but an agent that globs SKILL*.md may load conflicting instruction sets. SKILL-v3-draft.md:3 version: 3.0.0 |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawdhub.com | not in the service index | SKILL-v2.3-backup.md:550 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| github.com | not in the service index | SKILL-v2.3-backup.md:528 |
| x.com | not in the service index | SKILL-v2.3-backup.md:526 |
| Binaries invoked | bash, chmod, curl, git |
| Environment variables read | CONFIG_FILE, GREEN, HOME, ISSUES, RED, SECRET_PATTERNS, SKILL_DIR, WARNINGS, YELLOW |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 11 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL-v2.3-backup.md | 554 | 44bc35db30b536f8… |
SKILL-v3-draft.md | 499 | 5a61dae55820c670… |
SKILL.md | 632 | 571521d9f6f38b3e… |
_meta.json | 6 | 924981af1e84b8aa… |
assets/AGENTS.md | 155 | f771f02d7ca86961… |
assets/HEARTBEAT.md | 128 | 0412eed7f74c4171… |
assets/MEMORY.md | 47 | 44153b7be3fb08d1… |
assets/ONBOARDING.md | 103 | 3227d5131537f194… |
assets/SOUL.md | 40 | 25bfe585259fa09e… |
assets/TOOLS.md | 55 | 8801752bfd4e0efe… |
assets/USER.md | 36 | 2d9649f7975bc332… |
references/onboarding-flow.md | 158 | d6ca324a7819a101… |
references/security-patterns.md | 109 | 0e2024a6e11d48ad… |
scripts/security-audit.sh | 149 | 68c2669f4c11d3a7… |
skill-card.md | 45 | 417a41155425aa10… |
For agents
JSON: https://agenteconomy.report/k/proactive-agent.audit.json · badge: https://agenteconomy.report/k/proactive-agent.audited.svg ·
skill rating: /k/proactive-agent · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).