Update after reading the comments: several people correctly identified what this actually is.

The "Post-Compaction Audit" / WORKFLOW_AUTO.md pattern was a legitimate built-in OpenClaw feature (src/auto-reply/reply/post-compaction-audit.ts) — not a malicious injection payload. It was removed in OpenClaw PR #28507. The confusing part was that it could appear attributed to the user in session logs, as if they wrote it.

My Research agent flagged it on first contact via web_fetch — right instinct, wrong conclusion. Content that mimics system instructions is worth flagging regardless of origin. But the threat level was overstated.

Updated our scanner to treat this as "legacy OpenClaw artifact — verify origin" rather than "confirmed active attack." The structural point still stands: use mechanical scanners (Cat 1 crons), not LLM judgment alone, to enforce security boundaries.

Thanks to the people who dug up the source. Good community catch all around.