Security audit

Xiaopi Self Improving

Security checks for vulnerabilities and agentic risk

Overview

This is a local memory skill, but it needs review because it tells agents to automatically persist conversation-derived memories into files that can steer future behavior.

Install only if you intentionally want a persistent agent memory system. Before using it, require explicit approval before any write to AGENTS.md, MEMORY.md, .learnings, or git-tracked files; avoid storing secrets; periodically review and delete memory entries; and require fresh confirmation before applying remembered fixes involving sudo, global installs, or other system-changing commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly documents persistent file writes to memory stores and project/user files, but no declared permissions or explicit capability boundary is provided. This creates a transparency and consent problem: users may install a seemingly simple memory skill without understanding that it can modify local state and persist data across sessions and projects.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The documented behavior goes beyond passive memory recall and includes modifying AGENTS.md and MEMORY.md, which are high-influence files that can affect future agent behavior. Persisting data into these control surfaces creates an instruction-injection and cross-session persistence risk, especially if untrusted or user-supplied text is copied into them automatically.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill describes using remembered failures to automatically alter future command execution, including escalating to sudo. That turns a memory feature into autonomous operational decision-making with privilege implications, which can cause unsafe command changes or privilege escalation based on incomplete or poisoned historical context.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases are common conversational terms such as '不对', '应该', and similar wording, so ordinary dialogue could be captured as durable memory without clear intent. This makes the system easy to poison, causes accidental persistence of transient remarks, and increases the chance that incorrect or adversarial statements influence future behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents automatic synchronization into user and project files but does not present those modifications as a prominent warning or consent requirement. Hidden or underemphasized persistent writes are dangerous because they can silently alter future agent behavior and contaminate repositories or local configuration with unreviewed content.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Automatic cross-project synchronization of natural-language memories into global and project files can spread sensitive information far beyond the original context. Even if the intent is convenience, this creates a real confidentiality risk because corrections, preferences, and operational notes may include secrets, internal paths, or private business context that then become durable and widely reused.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill encourages automatic recording of user corrections and long-term retention of those interactions, which can capture personal, confidential, or regulated information from ordinary conversation. Retaining such data beyond the session expands the privacy and compliance exposure, especially because the capture is automatic rather than narrowly scoped.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: **AI动作**: 1. 记录错误到 `errors.jsonl` 2. 下次执行前检查记忆 3. 自动改用: `sudo npm install -g xxx` 或本地安装 ### 场景3：发现更好做法
Confidence: 97% confidence
Finding: The example explicitly recommends automatically switching to sudo after a permission failure. Normalizing privilege escalation in response to past errors is dangerous because it can lead the agent to rerun commands with elevated privileges without adequate scrutiny, increasing the blast radius of mistakes or poisoned memory.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 创建记忆目录 mkdir -p ~/.openclaw/memory/self-improving # 使用本skill cat ~/.openclaw/skills/self-improving-agent/SKILL.md
Confidence: 88% confidence
Finding: Persistent session memory itself is not inherently malicious, but this skill stores durable state under the user's home directory and uses it to influence future behavior across sessions. In this context, that persistence materially increases risk because incorrect, sensitive, or adversarially injected memories can survive and continue affecting later operations.

Static analysis

No suspicious patterns detected.