T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:262- Finding
Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
1215656 Self Improving Agent@3.0.6
Security checks for vulnerabilities and agentic risk
Overview
This self-improvement skill is not malicious, but it persistently writes and promotes agent learnings into future prompt context with broad triggers and limited safety boundaries.
Review this before installing in shared or sensitive workspaces. Use project-local configuration, avoid global hooks unless necessary, restrict matchers instead of running on every prompt, and require human review plus redaction before anything from .learnings is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
hooks/openclaw/handler.js:27- Finding
Runtime JavaScript Hook Omits the Sub-Agent Isolation Check Present in TypeScript
- Content
View full analysis
{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The TypeScript source contains an additional isolation check that is absent from JavaScript: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } ``` ### Technical Analysis The distributed JavaScript and TypeScript implementations are behaviorally inconsistent. The TypeScript source explicitly identifies sub-agent injection as something that should be avoided, but the JavaScript implementation lacks that check. If OpenClaw loads the CommonJS JavaScript handler, sub-agent bootstrap events receive `SELF_IMPROVEMENT_REMINDER.md` even though the TypeScript implementation intends to exclude them. The injected reminder encourages promotion into persistent files such as `SOUL.md`, `AGENTS.md`, and `TOOLS.md`. This is not direct arbitrary code execution. H ...[truncated 1732 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about operational memory/learning management: capturing learnings, errors, corrections, and reviewing them for continuous improvement. The supplied code does something materially different: it is a filesystem-writing helper that creates a new skill scaffold under ./skills (or another relative directory) from a skill name. While comments mention creating a skill from a learning entry, the script does not actually parse, capture, update, or review learnings; it only emits a template containing TODO placeholders and references to a learning ID/file. Therefore the primary purpose and concrete capabilities do not match the declared description.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Modifying or instructing users to modify ~/.claude/settings.json affects the agent's global configuration directory, which is a high-sensitivity location because it governs behavior across sessions. In this context, adding executable command hooks there creates durable, cross-project persistence and a central point where compromised script references could influence all future agent usage.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description says to use the skill when a command fails, when a user corrects the agent, when a better approach is discovered, and to "also review learnings before major tasks," but it does not clearly bound what counts as a major task or when these conditions should not trigger. These broad conditions cover many normal interactions and lack exclusion criteria, increasing the risk of over-invocation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions explicitly encourage sharing learnings across sessions using history and message-passing tools, which can propagate user-provided context into other agent contexts and persistent stores. In practice this creates a meaningful confidentiality risk because sensitive prompts, project details, or credentials mentioned in one session may be copied into additional durable locations without minimization.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The logging templates call for storing full context, what happened, what was wrong, user needs, and related files in durable markdown files. That creates a direct natural-language data leakage path because secrets, proprietary code details, personal information, or sensitive operational context may be preserved long-term and later surfaced to other agents or users.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The listed feature-request triggers include generic phrases like "Can you also..." and "Is there a way to...", which are common conversational patterns and not narrowly scoped to this skill. Because the document presents these as automatic detection triggers, the skill may activate or log entries in many ordinary conversations where the user did not intend self-improvement behavior.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The recommendation to 'promote aggressively' broadens the blast radius of any sensitive content captured in learnings by pushing it into higher-priority context files used across future tasks. This increases the likelihood of persistent cross-task disclosure and makes accidental leakage harder to contain or delete.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Project-level hook configuration introduces persistent automated behavior that survives across sessions for anyone using the repository. While persistence is the feature being documented, it is still security-relevant because it can silently re-enable executable hooks in future sessions and affect collaborators who inherit the repo configuration.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
An empty matcher causes the hook to fire for every prompt, creating a broad and persistent execution surface. In this skill context, that means the activator script runs continuously across normal interaction, which amplifies the effect of any script compromise, logic bug, or prompt-sensitive behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Placing the hook in ~/.claude/settings.json enables it for all sessions and projects, expanding impact beyond a single repository or task. If the referenced script is unsafe, tampered with, or simply noisy, the risk persists globally and can affect unrelated work contexts where users may not expect the hook to run.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The minimal setup still uses an empty matcher, so it remains always-on despite being presented as a lower-overhead option. That framing may lead users to think only performance changes, when in fact the security exposure of unconditional prompt-triggered execution remains.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Codex configuration mirrors the same empty-matcher pattern, extending broad automatic execution to another agent environment. Repeating the pattern across tools increases blast radius and normalizes unsafe defaults, making users more likely to deploy unconditional hooks widely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document's security section materially understates risk by claiming the scripts only output text and do not run commands, while the setup explicitly configures those scripts as command hooks. This misleading assurance can cause users to grant trust to executable hook scripts without appropriate review, increasing the chance of unintended code execution or abuse if the scripts are modified or replaced.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'Detection Triggers' section lists general conditions like 'Knowledge gaps' and user corrections such as 'No, that's wrong...' as triggers, which are common occurrences and do not clearly define when the skill should activate versus not activate. The documentation also lacks negative examples or scope limits, increasing the risk of unintended invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Triggers such as 'Tool call error' and 'Model behavior surprise' are broad conditions that can occur frequently in normal use, but the file does not specify thresholds, examples, or exclusions. This ambiguity can cause the skill to run on routine events rather than only on meaningful self-improvement cases.
- Content