T02 · Agent Memory Poisoning
Error
- Location
scripts/memory_update.py:470- Finding
Untrusted conversation history can poison persistent Agent files and escape the workspace
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Learning Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill openly aims to make an agent learn from past chats, but it gives AI-generated analysis too much power to change persistent agent files and retain sensitive conversation data.
Install only if you are comfortable with the skill reading recent conversations and agent memory files, sending that material through the OpenClaw session analysis path, and writing persistent agent behavior files. Use dry-run first, avoid storing secrets in conversations or memory files, restrict the workspace, review generated diffs manually, and prefer a patched version that enforces filename allowlists, path containment, schema validation, redaction, delete limits, and real rollback.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/memory_update.py:752- Finding
Deletion limits, confirmation, and rollback safeguards are not enforced
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/memory_update.py:465- Finding
Sensitive conversations and configuration data are sent for analysis and retained in plaintext artifacts
- Content
View full analysis
Dict[str, str]: """读取所有核心配置文件""" files_content = {} for filename in self.core_files: filepath = self.workspace / filename try: with open(filepath, 'r', encoding='utf-8') as f: files_content[filename] = f.read() except Exception as e: print(f"⚠️ 读取 {filename} 失败：{e}") files_content[filename] = '' return files_content ``` ```python sessions = sessions_list(activeMinutes=1440, limit=20) conversation_summary = [] for session in sessions: history = sessions_history( sessionKey=session['sessionKey'], limit=50 ) for msg in history['messages']: if msg['role'] == 'user': conversation_summary.append({ 'type': 'question', 'content': msg['content'][:max_content_length], 'timestamp': msg['timestamp'], 'agent': session.get('agentId', 'unknown') }) elif msg['role'] == 'assistant': conversation_summary.append({ 'type': 'answer', 'content': msg['content'][:max_content_length], 'timestamp': msg['timestamp'], 'agent': session.get('agentId', 'unknown') }) ``` ```python prompt = self._build_prompt(conversation_summary, files_content, agent_name) result = sessions_send(message=prompt, timeoutSeconds=timeout) update_plan = json.loads(result) ``` ```python history = { 'timestamp': datetime.now().isoformat(), 'stats': stats, 'summary': update_plan.get('summary', ''), 'updates': update_plan.get('upd ...[truncated 2287 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:5- Finding
Runtime installation uses broad, unpinned dependency constraints
- Content
View full analysis
=6.0 # 配置文件解析 # Optional dependencies # openclaw>=1.0.0 # OpenClaw SDK (如果可用) # Development dependencies pytest>=7.0.0 # 单元测试 black>=22.0.0 # 代码格式化 flake8>=4.0.0 # 代码检查 ``` ```bash git clone https://github.com/Acczdy/self-learning-skill.git cd self-learning-skill pip install -r requirements.txt ``` ### Technical Analysis All listed packages use open-ended minimum-version constraints. Following the documented installation procedure causes pip to resolve whatever current package versions satisfy those constraints, rather than installing a reviewed and reproducible dependency set. Development tools are also included in the same file as the runtime dependency, increasing the number of packages installed in production environments. No dependency hashes are supplied to verify downloaded artifacts. No evidence was found that the named packages are malicious or typosquatted. The risk arises from non-reproducible dependency resolution and unnecessary supply-chain exposure. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` procedure. 2. pip resolves the newest available versions satisfying the broad lower bounds. 3. A compromised, malicious, or unexpectedly incompatible future release is selected. 4. Package installation or subsequent imports execute that release under the installing user's privileges. ### Impact Assessment A compromised dependency could execute code with the privileges of the user running pip or the application. The practical likelihood is lower than the application-level vulnerabilities because exploitation requires compromise or malicious publication of an accepted dependency version. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (52)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the skill forwards full conversation summaries and memory/config contents to an external AI or session API without clear disclosure, that creates a real confidentiality risk. The danger is amplified here because the skill is explicitly positioned as a memory-management tool, so operators may feed it sensitive user preferences, history, and internal agent state that should not be transmitted externally without consent and minimization.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
If the skill forwards full conversation summaries and memory/config contents to an external AI or session API without clear disclosure, that creates a real confidentiality risk. The danger is amplified here because the skill is explicitly positioned as a memory-management tool, so operators may feed it sensitive user preferences, history, and internal agent state that should not be transmitted externally without consent and minimization.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the skill forwards full conversation summaries and memory/config contents to an external AI or session API without clear disclosure, that creates a real confidentiality risk. The danger is amplified here because the skill is explicitly positioned as a memory-management tool, so operators may feed it sensitive user preferences, history, and internal agent state that should not be transmitted externally without consent and minimization.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill forwards full conversation summaries and memory/config contents to an external AI or session API without clear disclosure, that creates a real confidentiality risk. The danger is amplified here because the skill is explicitly positioned as a memory-management tool, so operators may feed it sensitive user preferences, history, and internal agent state that should not be transmitted externally without consent and minimization.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - scripts/memory_update.py: 主执行脚本 (配置文件更新)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - scripts/memory_update.py: 主执行脚本 (配置文件更新)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - scripts/memory_update.py: 主执行脚本 (配置文件更新)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - scripts/memory_update.py: 主执行脚本 (配置文件更新)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - scripts/memory_update.py: 主执行脚本 (配置文件更新)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
卸载
bash rm -rf ~/.openclaw/hooks/self-learning
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
卸载
bash rm -rf ~/.openclaw/hooks/self-learning
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script sends summarized conversation history to an AI analysis call without any explicit consent, warning, or minimization step. Because conversations may contain sensitive personal data, credentials, or operational details, this creates a real confidentiality risk through unnecessary third-party/model exposure.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow turns conversational content into autonomous file modification instructions, then writes them into long-term configuration and memory files with minimal validation. In the context of a self-learning skill, this is especially dangerous because prompt injection, mistaken inferences, or malicious user statements can become persistent trusted state and influence future agent behavior.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The prompt explicitly tells the AI to extract and persist new configuration data including API keys, tokens, channel IDs, and similar sensitive identifiers from conversation history into long-term files. This creates a durable secret-spillage mechanism where casually mentioned or compromised credentials are copied into multiple persistent stores, dramatically increasing exposure and blast radius.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The changelog content is entirely presented in Chinese, including the title and explanatory text, with no indication that language selection is optional or user-configurable. Under the policy criteria, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill's core purpose is to analyze dialogue history and persist learned information into memory/configuration files, creating an inherent retention surface for sensitive natural-language content. In this context, persistence is more dangerous because the tool is designed to continually accumulate and operationalize user-provided information across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes automatic updates to core configuration files and cleanup of backups, but it does not prominently warn users that the skill will modify persistent files and may delete retained backups. In a self-learning skill that targets MEMORY.md, IDENTITY.md, and similar files, this can cause unintended state corruption or loss of user-managed data if invoked without clear consent and safeguards.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The learning-record feature encourages storing detailed execution history plus structured records of corrections, errors, and requests, which can easily capture sensitive prompts, commands, file paths, tokens, or internal context. Because the records are positioned as a long-term self-improvement mechanism, they may normalize over-retention of user inputs beyond what is necessary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow states that the tool obtains the past 24 hours of conversation history for analysis, but the documentation does not warn about privacy implications or data minimization. Because conversation history may contain credentials, personal data, or sensitive business context, silent collection for self-learning materially increases exposure risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented workflow instructs broad collection of the previous 24 hours of conversations and then saving execution history, which compounds both collection and retention risk. In a self-learning skill, this creates a direct path for sensitive dialogue to be copied into additional files and logs, increasing blast radius if the workspace is shared, synced, or later exfiltrated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language description, usage guidance, and triggers are presented only in Chinese, which effectively constrains activation and operation guidance to a specific language. The file does not indicate that users may choose another language or that the locale restriction is intentional and justified.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is explicitly designed to retain user-provided conversation details in persistent memory and output artifacts, but the documentation does not define data-minimization, sensitivity boundaries, or exclusion rules. Because the purpose is to analyze conversations and update memory/configuration files, the context makes this more dangerous: ordinary chats may contain credentials, personal data, or internal project information that should never be persisted automatically.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Broad trigger phrases like '自我学习', '记忆更新', and '配置优化' can cause the skill to activate during ordinary conversation, leading to unintended access to conversation history, memory files, or write operations. In a skill that is designed to persist information and modify agent state, ambiguous invocation materially increases the risk of over-collection and unwanted state changes.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Instructing the system to analyze recent conversation history and record corrections, errors, feature requests, and promoted content into structured logs and project files creates a durable data-retention surface that can capture sensitive or unnecessary information. This is especially risky in a self-learning skill because promoted content may spread user-supplied details from transient chats into long-lived files like SOUL.md, AGENTS.md, or TOOLS.md, increasing exposure and persistence.
- Content
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- hooks/openclaw/HOOK.md:67