Self Improving Agent Cn.Skip

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:37 AM UTC
• Version: 1.0.0

Overview

This skill is a memory helper, but it asks the agent to automatically persist user guidance across sessions, modify instruction files, and retry installs with sudo without clear controls.

Install only if you are comfortable with a global memory system that can store commands, errors, corrections, and preferences across projects. Before using it, disable automatic sudo fallback, require explicit confirmation before saving or applying memories, avoid automatic edits to AGENTS.md or MEMORY.md, and review/redact memory files regularly.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: log_correction.py:20

Finding

Untrusted Corrections Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: log_correction.py:20-44; related retrieval occurs at check_memory.py:35-44 and check_memory.py:71-74
Vulnerability Type: Persistent storage of untrusted behavioral instructions
Risk Level: High

Vulnerable Code

python

entry = {
    "type": "correction",
    "timestamp": datetime.now().isoformat(),
    "topic": topic,
    "wrong": wrong,
    "correct": correct,
    "context": context,
    "count": 1
}

corrections_file = f"{MEMORY_DIR}/corrections.jsonl"
if os.path.exists(corrections_file):
    with open(corrections_file, "r") as f:
        for line in f:
            try:
                old = json.loads(line.strip())
                if old.get("topic") == topic and old.get("wrong") == wrong:
                    entry["count"] = old.get("count", 1) + 1
                    break
            except:
                pass

with open(corrections_file, "a") as f:
    f.write(json.dumps(entry, ensure_ascii=False) + "\n")

The stored correction is subsequently selected and displayed by check_memory.py:

python

corrections_file = f"{MEMORY_DIR}/corrections.jsonl"
if os.path.exists(corrections_file):
    with open(corrections_file, "r") as f:
        for line in f:
            try:
                entry = json.loads(line.strip())
                if entry.get("topic", "").lower() in command.lower():
                    results.append(("correction", entry))
            except:
                pass

Technical Analysis

The correction logger accepts arbitrary values for topic, wrong, correct, and context and stores them in long-term JSONL memory without validating their source, intent, scope, or content. There is no separation between descriptive data and instructions that may influence future Agent behavior.

The documented skill workflow instructs the Agent to record user corrections automatically a ...[truncated 1971 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user confirmation before persisting any behavioral correction.
• Store provenance metadata, including the originating user, session, project, timestamp, and approval status.
• Scope corrections to a specific project by default rather than using global memory.
• Reject content that attempts to override security policies, approval requirements, tool restrictions, credential handling, or system instructions.
• Treat retrieved memory as untrusted quoted data, not executable or authoritative Agent instructions.
• Do not automatically copy user-controlled corrections into AGENTS.md, MEMORY.md, or other instruction-bearing files.
• Add review, revocation, expiry, and audit-log mechanisms for all persistent corrections.
• Apply integrity protection or authenticated storage where other local processes or users could modify the memory files.

T09 · Insecure Skill Coding Practices

Warning

• Location: log_error.py:20

Finding

Sensitive Commands and Error Data Are Persisted in Plaintext

Content

View full analysis

Vulnerability Details

File Location: log_error.py:20-32; similar plaintext writes occur in log_correction.py:20-44 and log_best_practice.py:20-30
Vulnerability Type: Insecure storage of potentially sensitive operational data
Risk Level: Medium

Vulnerable Code

python

entry = {
    "type": "error",
    "timestamp": datetime.now().isoformat(),
    "command": command,
    "error": error_msg,
    "fix": fix,
    "priority": priority,
    "status": "pending"
}

with open(f"{MEMORY_DIR}/errors.jsonl", "a") as f:
    f.write(json.dumps(entry, ensure_ascii=False) + "\n")

Technical Analysis

Full command lines, error messages, proposed fixes, correction contexts, and best-practice text are written directly to plaintext JSONL files. The code performs no secret detection or redaction before persistence.

Command lines and error output commonly contain API tokens, passwords, authorization headers, private repository URLs, environment values, customer data, internal hostnames, and sensitive filesystem paths. The storage routines do not explicitly enforce restrictive directory or file permissions. They also provide no retention limit, record-size limit, encryption, or consent mechanism.

The documentation advises users to redact sensitive information, but this is not enforced by the implementation. It also recommends periodically backing up memory files to Git, which could permanently expose secrets through repository history.

Attack Path

1. A command containing a token, password, private URL, or another secret fails.
2. The Agent passes the full command and error output to log_error.py.
3. The script serializes those values verbatim into errors.jsonl.
4. The file remains in persistent user-level storage without automatic expiry or redaction.
5. Another local user, process, backup system, repository commit, or later Agent session obtains the stored secret.
6. The exposed cr ...[truncated 662 chars]

Remediation

View remediation

Remediation Suggestions

• Redact secrets before persistence, including tokens, passwords, authorization headers, private keys, connection strings, signed URLs, and sensitive environment assignments.
• Prefer structured allowlisting of safe fields over attempting to store complete commands and error streams.
• Create the memory directory with mode 0700 and files with mode 0600, verifying permissions before every write.
• Use secure local encryption where the threat model includes filesystem disclosure.
• Add configurable retention periods, maximum record sizes, and secure deletion procedures.
• Require informed consent before storing raw commands or errors.
• Prohibit automatic Git commits of memory files and add the memory paths to ignore rules.
• Provide a review command that identifies and removes previously stored secrets.
• Avoid printing sensitive input values back to terminals or logs.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:138

Finding

Documented Automatic Sudo Fallback Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:138-146
Vulnerability Type: Automatic privilege escalation after package-installation failure
Risk Level: Medium

Vulnerable Instruction

bash

sudo npm install -g xxx

The surrounding documented workflow states that, after a global npm installation fails because of permissions, the Agent should automatically switch to the privileged command above or use a local installation.

Technical Analysis

Retrying a package installation with sudo expands execution from user privileges to root privileges without first determining why the operation failed, verifying the package and registry, inspecting lifecycle scripts, or obtaining explicit informed approval.

npm packages can define lifecycle hooks that execute during installation. Running installation as root can therefore allow package-controlled code to modify system-wide files and configurations. The included Python scripts do not invoke sudo; the risk is present in the skill instructions that define the Agent's intended operational behavior.

Attack Path

1. An attacker persuades the Agent to install an untrusted, compromised, or dependency-confused npm package globally.
2. The initial installation fails because the current user cannot write to the global package directory.
3. Following the documented workflow, the Agent retries with sudo npm install -g.
4. npm executes package lifecycle scripts with elevated privileges.
5. The malicious package modifies root-owned files, installs system-wide tooling, accesses root-readable data, or establishes another privileged foothold.

Impact Assessment

Successful exploitation may provide root-level code execution during package installation. Potential consequences include modification of system binaries or configuration, theft of root-accessible credentials, compromise of all local users, installation of persistent components, and complete host tak ...[truncated 299 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the automatic sudo fallback from the documented workflow.
• Prefer project-local installation, user-local prefixes, containers, virtual environments, or managed version environments.
• Require explicit approval immediately before every privileged command.
• Explain why elevation is necessary and identify the exact files and directories that will be modified.
• Verify package identity, registry source, version, integrity metadata, and publisher before installation.
• Inspect or disable package lifecycle scripts when appropriate.
• Never elevate merely because an operation returned a permission error; diagnose ownership and configuration first.
• If system-wide installation is unavoidable, use a narrowly scoped administrative deployment process rather than granting a general package manager root execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents persistent file reads and writes but does not declare any explicit tool scope or permission boundaries. This creates an under-specified capability surface where a host agent may write user or project files without clear consent or sandboxing expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file defines the skill entirely in Chinese and later specifies Chinese-only trigger phrases such as "不对" and "错了" for automatic behavior. There is no indication that users may choose another language or opt into this locale-specific behavior, which creates a language policy concern.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Persistent memory in ~/.openclaw/memory/self-improving creates a durable influence channel that survives the current session and can affect later work. Because this skill also proposes syncing into project and instruction files, the session persistence becomes more dangerous than ordinary local caching.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

bash

# 创建记忆目录
mkdir -p ~/.openclaw/memory/self-improving

# 使用本skill
cat ~/.openclaw/skills/self-improving-agent/SKILL.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Persistent memory in ~/.openclaw/memory/self-improving creates a durable influence channel that survives the current session and can affect later work. Because this skill also proposes syncing into project and instruction files, the session persistence becomes more dangerous than ordinary local caching.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

bash

# 创建记忆目录
mkdir -p ~/.openclaw/memory/self-improving

# 使用本skill
cat ~/.openclaw/skills/self-improving-agent/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

mkdir -p ~/.openclaw/memory/self-improving

使用本skill

cat ~/.openclaw/skills/self-improving-agent/SKILL.md

text

## 使用方法

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The documented remediation for failed installs includes sudo, normalizing privilege escalation as an automatic or remembered fix. In a self-modifying memory skill, such advice can be persisted and replayed later, increasing the chance of unnecessary root execution and system-wide compromise if commands are wrong or maliciously influenced.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

python3 ~/.openclaw/skills/self-improving-agent/log_error.py
--command "npm install xxx"
--error "permission denied"
--fix "use sudo or check permissions"

text

### 2. 记录用户纠正

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The memory check example teaches the system to recommend sudo based on prior failures, which can cause stored unsafe habits to propagate into future command suggestions. This is especially risky because the recommendation is presented as a retrieved lesson rather than a fresh, context-checked decision.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

输出示例：

text

⚠️ 发现相关记忆:
  [错误] 2026-03-05: npm install 权限失败 → 改用 sudo 或在用户目录安装
  [纠正] 2026-03-04: 项目使用单引号而非双引号

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The correction trigger phrases are broad enough to match normal conversation, causing the system to persist casual or ambiguous user statements as durable memory. That creates a memory-poisoning path where incidental dialogue can alter future behavior without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Vague triggers for 'better methods' allow subjective or conversational text to be promoted into persistent best-practice memory. This increases the risk of storing unverified advice that later influences commands, code generation, or policy-like behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Broad outdated-knowledge triggers can be activated by casual statements like 'this is outdated' without validating the claim. That enables attackers or mistaken users to poison the knowledge base and steer future actions based on false deprecation or replacement guidance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest presents the skill as a memory system, but the documented behavior extends to modifying project and instruction-bearing files. That mismatch can mislead users about the true side effects and enable silent persistence into files that influence future agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill lacks a clear warning that it will automatically persist data across several files and locations, including cross-project memory targets. Users may unknowingly disclose preferences, corrections, or sensitive context into durable storage that affects later sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs persistence of user corrections and preferences into long-term memory files across projects, including AGENTS.md and MEMORY.md. This creates durable cross-session influence channels that can carry prompt injection, sensitive preferences, or attacker-supplied guidance far beyond the original interaction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Automatically editing AGENTS.md is particularly risky because it changes instruction context for future sessions and can create durable prompt injection or policy drift. A memory-capture skill should not silently mutate governing instruction files, especially across projects or sessions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This section explicitly says the AI will automatically switch to sudo npm install -g after a prior permission failure. Automatic privilege escalation based on remembered state is dangerous because it can convert benign failure handling into repeatable high-impact system modification without fresh authorization.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md

**AI动作**:
1. 记录错误到 `errors.jsonl`
2. 下次执行前检查记忆
3. 自动改用: `sudo npm install -g xxx` 或本地安装

### 场景3：发现更好做法

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s natural-language description and all user-facing messages are written only in Chinese, which effectively constrains interaction to a specific language. There is no indication that the user can opt into another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and user-facing strings are written in Chinese, and the file provides no indication that language selection is optional or region-specific. This can violate language/locale policy when a skill implicitly requires a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file includes its description and CLI help/output strings in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when they are optional or clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains natural-language documentation entirely in Chinese, and the tool's printed status messages are also Chinese-only. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language choice or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description is written entirely in Chinese and presents the skill as Chinese-language only, with no indication that users can choose another language or locale. This can violate language/locale policy when a skill imposes a specific language without explicit user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The sync targets are ambiguously scoped: .learnings is described as project-level, while AGENTS.md and MEMORY.md are not clearly limited to the current project. Ambiguous scoping can cause unintended writes to global or unrelated contexts, spreading potentially sensitive or untrusted memory data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Automatically changing future command execution based on prior failures is dangerous because the stored 'fix' may be wrong, stale, or unsafe, leading to repeated escalation of risky actions. In this document, the example explicitly suggests sudo as an automatic adjustment, increasing the chance of privilege misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.