Security audit

Self Improving Agent 3.0.0

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed self-improvement logger, but it can persist user-derived content into agent-control files and broad always-on hooks without enough approval or redaction safeguards.

Install only if you intentionally want persistent self-improvement memory. Keep hooks project-scoped where possible, avoid the global ~/.claude/settings.json setup unless you accept always-on behavior, review every learning before promotion, and redact secrets, customer data, transcripts, tokens, proprietary prompts, and raw command outputs before writing to .learnings or agent instruction files.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:17
Finding: Untrusted conversational observations can poison persistent agent instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:17-26, SKILL.md:341-360, hooks/openclaw/handler.js:11-25, hooks/openclaw/handler.js:42-51, references/openclaw-integration.md:120-142
Vulnerability Type: Persistent agent memory and instruction poisoning
Risk Level: High

Vulnerable Code

SKILL.md:17-26:

markdown
| Situation | Action | |-----------|--------| | Command/operation fails | Log to `.learnings/ERRORS.md` | | User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` | | User wants missing feature | Log to `.learnings/FEATURE_REQUESTS.md` | | API/external tool fails | Log to `.learnings/ERRORS.md` with integration details | | Knowledge was outdated | Log to `.learnings/LEARNINGS.md` with category `knowledge_gap` | | Found better approach | Log to `.learnings/LEARNINGS.md` with category `best_practice` | | Simplify/Harden recurring patterns | Log/update `.learnings/LEARNINGS.md` with `Source: simplify-and-harden` and a stable `Pattern-Key` | | Similar to existing entry | Link with `**See Also**`, consider priority bump | | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) |

hooks/openclaw/handler.js:11-25:

javascript
After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Wo ...[truncated 2767 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit human approval before modifying SOUL.md, AGENTS.md, TOOLS.md, CLAUDE.md, Copilot instructions, or any other automatically loaded agent-control file.

Store learnings as inert quoted data rather than executable instructions. Clearly delimit the original source text and mark it as untrusted.

Record provenance for every learning, including originating user, session, source message, verification state, and reviewer.

Introduce trust states such as unverified, verified, and approved-for-promotion; only the final state may be promoted.

Reject or quarantine learning content containing imperative agent directives, shell commands, credential requests, external URLs, encoded payloads, or instructions to override existing policies.

Generate a proposed patch for human review instead of directly editing persistent instruction files.

Restrict promotion to concise, independently verified factual statements. Do not promote raw user-provided text.

Add conflict detection so promoted rules cannot override platform safety requirements or higher-priority workspace policies.

Add the TypeScript handler's sub-agent exclusion to handler.js, or generate both handlers from one source to prevent security-relevant divergence.

Maintain an auditable history and provide a rollback mechanism for every promoted instruction.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/extract-skill.sh:91
Finding: Output-directory containment can be bypassed through symbolic links
Content: View full analysis
Vulnerability Details

File Location: scripts/extract-skill.sh:91-105, scripts/extract-skill.sh:112-117, scripts/extract-skill.sh:174-178
Vulnerability Type: Path containment bypass through symbolic-link traversal
Risk Level: Low

Vulnerable Code

scripts/extract-skill.sh:91-105:

bash
# Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME"

scripts/extract-skill.sh:112-117:

bash
# Check if skill already exists if [ -d "$SKILL_PATH" ] && [ "$DRY_RUN" = false ]; then log_error "Skill already exists: $SKILL_PATH" log_error "Use a different name or remove the existing skill first." exit 1 fi

scripts/extract-skill.sh:174-178:

bash
# Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH"

The subsequent file creation uses:

bash
cat > "$SKILL_PATH/SKILL.md" << TEMPLATE

Technical Analysis

The script attempts to confine writes to the current workspace by rejecting absolute paths and .. components. This is only lexical validation and does not determine where the path resolves on the filesystem.

If skills, a component supplied through --output-dir, or another parent component is a symbolic link, mkdir -p and shell redirection follow that link. The resolved destination can therefore be outside the current workspace even though the supplied path is relative and contains no .. segment.

Quoting prevents shell word splitting and command injection, but it does not prevent symbolic-link traversal. The ...[truncated 1145 chars]
Remediation: View remediation
Remediation Suggestions

Determine a canonical workspace root before processing arguments, for example with realpath -P.

Resolve the existing output-directory parent and verify that its canonical path equals the workspace root or begins with the workspace root followed by a path separator.

Reject every symbolic-link component between the workspace root and the destination using lstat, test -L, or an equivalent no-follow API.

Create the destination under a trusted directory opened by file descriptor rather than repeatedly resolving path strings.

Create files with exclusive, no-follow semantics where supported. A small helper using openat with O_NOFOLLOW, O_CREAT, and O_EXCL is safer than shell redirection.

Revalidate the canonical destination immediately before writing to reduce time-of-check to time-of-use exposure.

Fail if SKILL_PATH already exists as any filesystem object, not only when it is a directory.

Add tests covering a symlinked default skills directory, symlinked intermediate output components, dangling symlinks, and destination replacement during execution.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about recording and consulting learnings after mistakes, corrections, missing capabilities, or tool/API failures. The supplied code does not implement any learning-capture, error-tracking, correction logging, or review functionality. Instead, it is a helper script for creating a new skill scaffold on disk from a learning entry, including directory/file creation and template generation. That is a materially different primary purpose and includes undeclared filesystem write behavior. While related at a broad process level to 'continuous improvement,' the actual code is specifically a skill-extraction/scaffolding utility, not a learning-capture skill as described.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 91% confidence
Finding: Directing users to modify ~/.claude/settings.json affects a sensitive agent configuration directory and establishes persistent command execution at the user level. In this context, the danger is elevated because the skill is specifically about self-improvement and persistence of learnings, so automatic global hooks can silently shape future sessions beyond a single project.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says to use the skill when a command fails unexpectedly, when a user corrects the agent, when a capability is missing, when a better approach is discovered, and to also review learnings before major tasks. These conditions are broad and common in normal agent interactions, and the file does not provide clear exclusion conditions or tighter boundaries for when the skill should not activate.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly encourages sharing learnings across sessions and reading other session transcripts, which creates a meaningful risk of propagating user-provided or task-derived sensitive information beyond its original context. Because this content is stored and redistributed through workspace memory and inter-session tools, accidental cross-session disclosure becomes much more likely.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The logging templates ask for full context, inputs, and user context, which strongly encourages retention of sensitive prompts, operational details, and possibly secrets in persistent markdown files. Persistent local memory increases exposure duration and can later leak through commits, backups, indexing, or future agent reads.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The feature-request triggers include phrases like "Can you also..." and "Is there a way to...", which frequently occur in ordinary conversation and many unrelated requests. Using these as activation cues without contextual constraints increases the chance of unintended skill invocation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The recommendation to promote learnings aggressively into durable agent context files increases blast radius by moving potentially user-derived information into broader, repeatedly loaded memory sources. Once promoted, the information may influence future sessions and become visible in unrelated tasks, creating a persistent natural-language data leakage channel.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: Placing hook configuration in .claude/settings.json creates session-persistent behavior that automatically re-applies in future runs of the project. While persistence can be legitimate, in an agent skill focused on learning capture it increases the chance of unintended long-term collection, recurring prompt interception, and difficulty noticing that automation remains enabled.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Using an empty matcher causes the hook to run on every prompt, creating broad always-on interception of user activity and expanding exposure to prompt contents and session context. In a self-improvement skill, this increases the amount of sensitive or irrelevant data processed automatically and raises the blast radius if the script behavior changes or is compromised.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-level setup places always-on hook execution in ~/.claude/settings.json, extending the behavior across projects and sessions. Because the hook runs automatically and globally, any flaw, compromise, or unexpected behavior in the referenced script can affect all future agent interactions and potentially expose sensitive prompts from unrelated work.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document's security section understates risk by claiming the scripts only output text and do not run commands, while the configuration explicitly executes shell scripts via hook commands and references an extraction script that performs scaffolding. This can mislead users into granting trust to automatically invoked code with the same permissions as the agent, reducing scrutiny of what those scripts actually do.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The setup instructs users to create a persistent .learnings/ directory for storing operational learnings, which introduces durable retention of model outputs, failures, and possibly user data. In the context of a self-improvement skill that later reuses stored content, this increases the risk of sensitive data persistence, unintended replay, and prompt-context contamination across future sessions.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.
openclaw hooks enable self-improvement

text
### 3. Create Learning Files Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation instructs persistent logging to workspace files and promotion into durable context files without clearly warning that potentially sensitive prompts, errors, or user-provided data may be retained across sessions. In an agent environment with automatic prompt injection from workspace files, this can unintentionally preserve and resurface sensitive information beyond the original interaction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The 'Detection Triggers' section includes ambiguous conditions like 'Knowledge gaps', 'API errors', and user corrections such as 'No, that's wrong...' without defining boundaries or exclusions. In a markdown skill guide, these broad natural-language triggers can overlap with common interaction patterns and make it unclear when the skill should act versus ignore routine events.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The test procedure says to send 'any prompt,' which confirms that the hook is expected to fire on unrestricted everyday input. This language broadens activation semantics rather than clarifying a specific trigger scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Tp4

Agent Config Directory Access

Option 2: User-Level Configuration

Exfiltration Commands

sessions_send

Vague Triggers

Session Persistence

Ssd 3

Ssd 3

Vague Triggers

Ssd 3

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Intent-Code Divergence

Session Persistence

Missing User Warnings

Vague Triggers

Vague Triggers

Static analysis