T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:99- Finding
Persistent Agent Memory Poisoning Through Untrusted Corrections
- Content
View full analysis
- Remediation
View remediation
Security audit
Xiaopi Self Improving
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed memory helper, but it gives agents broad automatic persistence and privilege-escalation guidance that users should review carefully before installing.
Install only if you are comfortable with an agent saving failures, corrections, and best practices into persistent local memory and potentially project instruction files. Do not allow automatic writes to AGENTS.md, MEMORY.md, or Git backups without review, and require explicit approval before any sudo command or stored recommendation is reused. Avoid logging commands or errors that contain tokens, passwords, private URLs, or customer/project secrets.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
log_error.py:20- Finding
Plaintext Persistence and Disclosure of Potentially Sensitive Data
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:138- Finding
Automatic Privileged Retry Using Sudo After Installation Failure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
The declared description emphasizes an automatic self-improvement and memory system that captures mistakes, user corrections, and best practices and stores them as long-term memory. The supplied code does not perform capture, storage, or learning. Instead, it only checks preexisting local memory files (
errors.jsonlandcorrections.jsonl) for entries related to a supplied command and displays them. This is related to the declared theme, but it is materially narrower: it is a memory retrieval/check utility, not the broader automatic memory formation/self-improvement system described. The code also does not process best practices, which are explicitly mentioned in the description.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow suggests that after a permission failure, the agent may automatically switch to sudo on future attempts. In a self-improving skill, this means an unreviewed past outcome can escalate future commands to privileged execution, greatly increasing the blast radius of mistakes or prompt injection.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs the agent to read and write persistent memory files and project documentation, but it declares no explicit tool scope or permission boundaries. That makes the capability opaque to users and enforcement layers, increasing the chance of unauthorized or overly broad file access.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The same persistent storage pattern also supports reuse of previously captured content across future sessions, which can preserve poisoned, incorrect, or sensitive data beyond its original context. Because the skill encourages automatic recording, the persistence mechanism materially increases the risk of long-lived contamination.
- Content
bash # 创建记忆目录 mkdir -p ~/.openclaw/memory/self-improving # 使用本skill cat ~/.openclaw/skills/self-improving-agent/SKILL.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The same persistent storage pattern also supports reuse of previously captured content across future sessions, which can preserve poisoned, incorrect, or sensitive data beyond its original context. Because the skill encourages automatic recording, the persistence mechanism materially increases the risk of long-lived contamination.
- Content
bash # 创建记忆目录 mkdir -p ~/.openclaw/memory/self-improving # 使用本skill cat ~/.openclaw/skills/self-improving-agent/SKILL.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
mkdir -p ~/.openclaw/memory/self-improving
使用本skill
cat ~/.openclaw/skills/self-improving-agent/SKILL.md
text ## 使用方法
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill emphasizes automatic recording but does not clearly warn users that corrections and experiences may be persisted across sessions and projects. This undermines informed consent and increases the chance of silently storing private, project-confidential, or regulated information.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The example remediation for a failed command explicitly suggests 'use sudo,' normalizing privilege escalation as a remembered fix. In a self-improving system, remembered privileged workarounds can later be applied inappropriately and increase the risk of system-wide damage.
- Content
python3 ~/.openclaw/skills/self-improving-agent/log_error.py
--command "npm install xxx"
--error "permission denied"
--fix "use sudo or check permissions"text ### 2. 记录用户纠正
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directs automatic recording of user corrections and preferences into long-term memory stores, which may include personal preferences, sensitive context, or manipulated instructions. Because these memories affect future behavior, the feature can become a persistence channel for privacy leakage or instruction poisoning.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The memory output example reinforces sudo as a stored recommendation for future execution. Persisting privilege-escalation advice inside reusable memory can cause unsafe command suggestions to recur automatically.
- Content
输出示例：
text ⚠️ 发现相关记忆: [错误] 2026-03-05: npm install 权限失败 → 改用 sudo 或在用户目录安装 [纠正] 2026-03-04: 项目使用单引号而非双引号
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Broad correction trigger phrases such as common disagreement language can cause the agent to persist ordinary conversation as long-term memory without clear user intent. In a memory-writing skill, this creates a real risk of storing inaccurate preferences, sensitive text, or adversarial prompt content across sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Ambiguous trigger phrases for 'better methods' can capture speculative or casual discussion and promote it into persistent guidance. Because the skill later reuses stored memories to influence future actions, this can poison agent behavior over time.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Broad stale-knowledge triggers may store ordinary remarks as authoritative evidence that prior guidance is obsolete. In a system designed to alter future behavior based on persisted memory, this can lead to integrity issues and lasting misinformation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Automatically updating project files like AGENTS.md and MEMORY.md without a clear warning or confirmation can modify trusted documentation and spread persisted content into repositories. This is especially risky because those files may influence future agent behavior and may later be committed or shared.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Cross-project synchronization to global memory, project directories, and documentation files can copy user-provided information into multiple persistent locations. This materially increases the risk of privacy leakage, repository contamination, and propagation of poisoned or sensitive content beyond the originating context.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This line explicitly says the agent may automatically switch to 'sudo npm install -g xxx' after prior failure. Automatic privileged command generation is dangerous because it can turn benign installation failures into root-level execution without fresh user consent.
- Content
md **AI动作**: 1. 记录错误到 `errors.jsonl` 2. 下次执行前检查记忆 3. 自动改用: `sudo npm install -g xxx` 或本地安装 ### 场景3：发现更好做法
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code presents its description, docstrings, and output messages in Chinese, with no indication that users can select another language or that the tool is intentionally limited to a Chinese-speaking context. The policy explicitly flags language or locale constraints that are imposed without user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code includes user-facing natural language in the module description, CLI help text, and console output exclusively in Chinese. That imposes a specific language/locale on users without opt-in, which matches the policy-violation category for language constraints.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description is written entirely in Chinese and presents the skill as a Chinese-localized experience, but there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-only region or compliance context. This creates a natural-language locale policy concern because it implicitly fixes the skill's language without documented choice or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest description is written entirely in Chinese and the trigger phrases and examples assume Chinese-language inputs such as "不对" and "错了". There is no indication that the skill supports language choice or that the Chinese-only behavior is intentionally limited to a specific locale or user base.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and all user-facing CLI help/output strings are written in Chinese, indicating a fixed language choice. There is no visible option for users to select another language or any justification that this tool is intended only for a Chinese-speaking context.
- Content
Static analysis
No suspicious patterns detected.