Security audit

Aj Self Improving Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent self-improvement purpose, but it encourages persistent agent memory edits, broad automatic hooks, and logging of potentially sensitive session data without enough scoping or review safeguards.

Install only if you intentionally want persistent agent learning. Keep .learnings local by default, avoid global hooks unless you audit the scripts, redact secrets and personal data before logging, and require a human-reviewed diff before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:262
Finding: Untrusted learning content can poison persistent agent instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:262-289 and SKILL.md:333-360
Vulnerability Type: Persistent agent-context poisoning
Risk Level: High

Vulnerable Code

SKILL.md:262-289:

markdown
## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`

SKILL.md:333-360:

markdown
### Ingestion Workflow 1. Read `simplify_and_harden.learning_loop.candidates` from the task summary. 2. For each candidate, use `pattern_key` as the stable dedupe key. 3. Search `.learnings/LEARNINGS.md` for an existing entry with that key: - `grep -n "Pattern-Key: <pattern_key>" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `L ...[truncated 2813 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit human approval before modifying any persistent agent-context file.

Present the exact target path and a complete diff before promotion.

Never promote raw user text, command output, task summaries, or external content.

Preserve provenance for every candidate, including source, author, session, timestamp, and supporting evidence.

Reject candidates containing imperative instructions, safety-policy changes, credential-handling rules, requests to suppress review, or instructions to execute commands.

Treat recurrence only as a relevance signal, not as evidence that content is trustworthy.

Store promoted facts in a clearly delimited, non-authoritative data section rather than mixing them with executable agent instructions.

Restrict automated writes to .learnings/; require a separate reviewed process to modify CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

Record and review all promotions through version-control changes with designated code owners.

Add tests using prompt-injection payloads to verify that hostile learning entries cannot become persistent instructions.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:182
Finding: Error logging may persist secrets and sensitive command data in version control
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:182-190 and SKILL.md:451-459
Vulnerability Type: Sensitive information exposure through unsafe logging
Risk Level: Medium

Vulnerable Code

SKILL.md:182-190:

markdown
### Error

Actual error message or output

text
### Context - Command/operation attempted - Input or parameters used - Environment details if relevant

SKILL.md:451-459:

markdown
## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/

Track learnings in repo (team-wide): Don't add to .gitignore - learnings become shared knowledge.

text
### Technical Analysis The documented error format instructs agents to record complete error output, command parameters, and environment details. Such data can contain API tokens, authorization headers, passwords, private URLs, filesystem paths, customer data, or secrets passed through command-line arguments. The skill does not define a mandatory redaction process or identify fields that must never be logged. It also explicitly supports tracking `.learnings/` in version control. Once committed, sensitive content may remain recoverable from repository history even if removed from the latest revision. ### Attack Path 1. A command fails while a secret is present in its arguments, output, stack trace, request headers, URL, or environment details. 2. Following the documented error-entry format, the agent copies that information into `.learnings/ERRORS.md`. 3. The repository is configured to track `.learnings/`. 4. The learning file is committed and pushed to a shared or public remote. 5. Other repository users, automated systems, or unauthorized parties with repository access obtain the exposed secret. 6. If the credential remains valid, it can be used against the associated service within that credential's permissions. ### Impact Assessment Exposure can affect sourc ...[truncated 486 chars]
Remediation: View remediation
Remediation Suggestions

Make .learnings/ ignored by default and require an explicit security decision before tracking it.

Add a mandatory redaction step before writing any learning or error entry.

Prohibit logging passwords, tokens, cookies, authorization headers, private keys, complete environment dumps, credential-bearing URLs, and secret-bearing command arguments.

Record only the minimum output necessary to diagnose the failure.

Replace sensitive values with stable placeholders such as [REDACTED_TOKEN].

Run secret scanners against .learnings/ in pre-commit hooks and continuous integration.

Require human review before committing learning files.

Warn users that deleting a secret from the current file does not remove it from Git history.

Document credential rotation and repository-history remediation procedures for accidental disclosure.

Prefer structured allowlisted diagnostic fields instead of arbitrary copies of environment details and command output.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about maintaining and consulting learnings: capturing mistakes, corrections, failed operations, outdated knowledge, and improved approaches. The supplied code does not implement learning capture, storage, review, or retrieval behavior. Instead, it is a filesystem-oriented helper that creates a new skill scaffold under ./skills (or another relative directory), validates names/paths, and writes a templated SKILL.md file. This is a materially different primary purpose. The file-writing behavior is also an undeclared capability relative to the stated no-permissions declaration, though the main issue is purpose mismatch rather than mere implementation detail.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Writing to ~/.claude/settings.json affects the agent's global configuration directory, which is a high-sensitivity location because changes persist across repositories and influence future sessions. In the context of hook commands, this effectively establishes persistent automatic code execution for the agent environment.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says to use the skill for broad conditions like when a command fails unexpectedly, when Claude realizes its knowledge is outdated, or when a better approach is discovered, and also to review learnings before major tasks. These conditions are common and subjective, and the description does not define when the skill should not activate or provide negative examples, increasing the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill promotes persistent logging of learnings, errors, and corrections and later promotion into broader memory files, but it does not include safeguards to avoid storing secrets, personal data, or confidential user content. Because the skill is specifically designed for retention and reuse, absent minimization guidance materially raises privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The cross-session features explicitly support reading other sessions' transcripts and sending learnings across sessions, enabling disclosure of prior session contents in plain language. Without access controls, consent checks, or redaction requirements, this creates a strong risk of unauthorized sharing of sensitive information across contexts.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The logging templates instruct the agent to store full context, inputs/parameters, environment details, and user context, which are common locations for secrets, tokens, internal paths, customer data, and other sensitive information. In a plaintext markdown log, this becomes durable local or shared disclosure risk and may later be promoted into broader memory files.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The automatic triggers rely on generic conversational phrases like normal corrections and requests, which can cause the agent to persistently log ordinary user statements without explicit consent or sensitivity checks. In the context of a memory/logging skill, overbroad trigger logic increases the chance of collecting and storing sensitive user content in plain text.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The template tells authors to include trigger conditions, but it does not require concrete activation boundaries, exclusions, or counterexamples. In a self-improving agent skill, vague triggers can cause over-broad activation, making the agent apply a skill in inappropriate contexts and potentially propagate unsafe or incorrect behavior across many tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The Quick Reference uses placeholder fields like '[Trigger]' without guidance on specificity, which encourages terse and ambiguous activation cues. Because this repository is for self-improving agents that may reuse learned procedures automatically, ambiguous triggers increase the chance of accidental skill invocation, incorrect remediation steps, or unsafe generalization from one failure pattern to unrelated situations.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: The project-level hook configuration creates persistent behavior across future sessions in that repository, so a one-time setup continuously injects and executes hook logic. Persistence is especially relevant here because the skill is designed for self-improving behavior and could influence later agent actions beyond the original task context.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: An empty matcher causes the hook to run on every prompt, creating a broad trigger surface for an automatically executed script. In this skill's context, that increases the frequency of code execution and the amount of prompt-derived data exposed to the hook, which raises privacy and abuse risk if the script is modified or compromised.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The user-level configuration installs an every-prompt hook in ~/.claude/settings.json, making the behavior persistent across projects and sessions. That broad scope magnifies the effect of any bug, malicious modification, or sensitive prompt capture because it applies globally rather than to a single repository.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Repeating the empty matcher in Codex CLI setup again enables execution on every prompt without contextual restriction. While not inherently malicious, it normalizes over-broad automatic execution and increases unnecessary exposure of prompts and session data to the hook script.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document claims the hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly executes shell scripts via command hooks. This can mislead users into underestimating the trust and privilege implications of enabling the hooks, increasing the chance they install and run unreviewed code in their agent environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide instructs users to install and enable a custom hook, but does not warn that hooks run automatically on lifecycle events and can change agent or workspace behavior without further user confirmation. In a prompt-injection-oriented environment, undocumented automatic execution increases the risk of unexpected local actions or persistence of unsafe behavior.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: Creating a dedicated .learnings directory establishes persistent session memory on disk, which can accumulate sensitive operational context over time. Without retention, review, or sanitization guidance, this persistence increases exposure through local compromise, accidental commits, backups, or later prompt injection via stored content.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.
openclaw hooks enable self-improvement

text
### 3. Create Learning Files Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation encourages writing learnings into .learnings/ and promoted workspace files, but does not warn that this persists model outputs, user prompts, corrections, tool errors, or other potentially sensitive session data to disk. That can unintentionally retain secrets, internal project details, or personal information beyond the active session.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Tp4

Agent Config Directory Access

Option 2: User-Level Configuration

Exfiltration Commands

sessions_send

Vague Triggers

Ssd 3

Session Persistence

Ssd 3

Ssd 3

Vague Triggers

Vague Triggers

Vague Triggers

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Vague Triggers

Intent-Code Divergence

Missing User Warnings

Session Persistence

Missing User Warnings

Static analysis