ClawHub
Back to skill

Security audit

continue-learning

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but it reads private agent session history and persists learned snippets with imperfect redaction, so users should review it before installing.

Install only if you are comfortable with the skill reading recent OpenClaw session logs and saving derived learning data locally. Prefer a pinned or verified install source, avoid scheduling broad --all analysis unless needed, review memory/learning contents periodically, and use the prune command if sensitive data may have appeared in tool errors.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/analyze.mjs:39
Finding

Incomplete Secret Redaction Before Session-Derived Evidence Is Persisted

Content
View full analysis
e.message); addInstinct( 'discord-message-requires-guild', 'errors', 'when sending Discord messages', 0.6, errorSamples ); ``` ### Technical Analysis The Skill reads error content from privacy-sensitive OpenClaw session transcripts and uses a regular-expression denylist to identify secrets before storing selected error messages as persistent instinct evidence. This denylist does not reliably recognize all common sensitive-data formats. Potentially uncovered examples include: - Quoted JSON fields such as `"access_token":"value"` - Cookie and session identifiers - Basic authorization credentials - JWTs and other structured bearer credentials - Database connection strings not matching the URI-credential expression - Provider-specific API keys without one of the hardcoded prefixes Limiting a string to 120 characters does not make it non-sensitive. A complete credential may fit within that limit. Consequently, the implementation does not fu ...[truncated 1419 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:5
Finding

Unpinned Third-Party Installer and Skill Source

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md
1. **Scoped analysis (opt-in).** `analyze.mjs` does not silently scan every agent. It analyses

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to run npx skills add adelpro/continue-learning without pinning a specific version, which can cause installation of whatever package/version is current at execution time. This creates supply-chain risk because a compromised or malicious future release of the referenced package or its dependencies could be fetched and executed implicitly by users.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger list includes generic phrases such as "pattern detection," "session analysis," "ai learning," and "agent optimization" without narrowing context or giving exclusion examples. In a manifest/markdown skill description, these broad terms can cause unintended activation when users are merely discussing analysis or improvement concepts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The document normalizes autonomous behavior by stating that strong-confidence patterns are 'Auto-approved' and core behaviors 'Always apply'. In a self-improving agent, this can let unreviewed, session-derived inferences steer future behavior, amplifying bad patterns, prompt-injected session content, or unsafe preferences without human validation.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
|-------|---------|----------|
| 0.3 | Tentative | Suggested but not enforced |
| 0.5 | Moderate | Applied when relevant |
| 0.7 | Strong | Auto-approved |
| 0.9 | Core behavior | Always apply |

**Confidence increases when:**

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

The skill explicitly creates persistent storage for learned data and recommends scheduled analysis, which increases the risk of retaining sensitive behavioral artifacts over time. Although the file includes redaction and retention claims, persistence of session-derived evidence still creates a confidentiality and privacy exposure if redaction fails, scope is misused, or the storage directory is accessible to other processes.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

Setup

1. Create storage directory

bash
mkdir -p ~/.openclaw/workspace/memory/learning

Static analysis

No suspicious patterns detected.