Security audit

Aj Self Improving Agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed self-improvement logger with optional reminders, but users should control what gets saved or promoted into future agent memory.

Install only if you want an agent to keep durable learning notes. Treat .learnings and promoted prompt files as sensitive: redact secrets, tokens, customer data, full command output, and private transcript details; review changes before promoting them into AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or Copilot instructions; and enable hooks only after reviewing their paths and contents.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document states that the scripts 'only output text' and 'don't modify files or run commands', but the setup explicitly configures the agent to execute shell scripts via hook commands. That mismatch can cause users to underestimate the trust and execution risk of these hooks, increasing the chance they enable unreviewed code with the agent's permissions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The logging templates instruct retention of raw error output, command context, inputs, and related details without any sanitization guidance. Error streams and command parameters often contain secrets, tokens, internal paths, customer data, or other sensitive material, so this creates a durable local record of sensitive information that can later be exposed or committed.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: An empty matcher causes the hook to run on every prompt, creating an always-on execution path for a local shell script. In a self-improvement skill, that broad trigger surface increases exposure to abuse, accidental data capture, performance degradation, and persistence of unneeded behavior across all interactions.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The user-level configuration enables broad global activation, which extends the hook to all sessions without strong scoping or constraint guidance. That increases blast radius if the script is modified, replaced, or simply behaves unexpectedly, because every prompt across projects may invoke it.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup instructions have users configure automatic execution of local shell commands on each prompt before presenting a clear warning about the consequences. Because these commands run with the same permissions as the user, insufficiently prominent disclosure can lead to unsafe enablement of unreviewed code.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The guidance to 'avoid unnecessary caveats and disclaimers' can discourage the agent from presenting important safety caveats, uncertainty, or risk warnings when performing impactful actions. In a prompt-injection-prone workspace system, suppressing cautionary language increases the chance that unsafe operations are carried out without adequate user awareness or confirmation.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill explicitly encourages cross-session sharing of learnings and transcript-derived context, which can propagate sensitive user information beyond the original interaction boundary. Once information is copied into shared memory files or sent to another session, confidentiality expectations and access scope change, increasing leakage risk.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The error template directs the agent to preserve actual error messages, inputs, and parameters verbatim. In practice, these fields frequently include secrets, credentials, personal data, proprietary source snippets, and environment details, making the log files a high-value target and a likely source of accidental disclosure through backups, repos, or later prompts.

Ssd 3

Low

Confidence: 90% confidence
Finding: The feature request template asks for user context and problem details, which can easily capture personal, business, or project-sensitive information in long-lived files. Even if less acute than raw error logs, this still creates unnecessary persistence of potentially private user data.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The documented ability to read session history and send learnings to other sessions semantically enables information flow across contexts that may not share the same need-to-know boundary. If transcript-derived content includes sensitive data, this creates a straightforward path for cross-session leakage and overexposure.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 76% confidence
Finding: Create Learning Files Create the `.learnings/` directory in your workspace: ```bash mkdir -p ~/.openclaw/workspace/.learnings ``` Or in the skill directory: ```bash mkdir -p ~/.openclaw

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.