Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent and not malicious, but it should be reviewed because it encourages persistent agent memory and guidance changes without enough approval, redaction, or scoping safeguards.
Install only if you want persistent self-optimization records and are willing to review them. Do not store secrets, tokens, private customer data, or raw sensitive logs in .learnings; review any promotion into agent guidance files before it is used; consider narrowing or skipping the all-prompt hooks; and run the extraction helper only in trusted workspaces without attacker-controlled symlinks.
SKILL.md:24Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
scripts/extract-skill.sh:91Symlink Traversal Bypasses Skill Output Directory Containment
The declared description is about a higher-level capability: turning lessons from work into durable improvements, potentially including agent memory, workflow guidance, or reusable skills. The supplied code does something narrower and different: it parses CLI arguments and creates a new skill folder with a templated SKILL.md file. While this could support one part of the described process (creating a reusable skill scaffold), it does not actually analyze mistakes, corrections, dead ends, recurring failures, or learning entries, nor does it update memory or workflow guidance. Its primary behavior is filesystem scaffolding, which is a materially different and more limited function than the declared purpose. Therefore this is a description/behavior mismatch.
Referenced artifact was not completely inspected
Then customize the generated `SKILL.md` and update the original learning entry with:
This skill explicitly sets up a persistent workspace inbox under ~/.openclaw/workspace/.learnings to store corrections, failures, and feature requests across sessions. While framed as a productivity feature, cross-session persistence can retain sensitive prompts, operational mistakes, internal conventions, or user-provided data, and the README does not describe consent, retention limits, or redaction safeguards.
cp -r self-optimization ~/.openclaw/skills/
### Create The Learning Inbox
```bash
mkdir -p ~/.openclaw/workspace/.learnings
The skill instructs the agent to append user corrections, missing facts, and requests directly into persistent workspace files without any consent, minimization, or sensitivity screening. That creates a durable record of user-supplied content that may contain secrets, internal project details, personal data, or other information the user did not intend to retain.
These instructions broadly encourage recording user-provided facts and corrections into local memory, which can unintentionally retain sensitive information across sessions. Because the skill is explicitly about durable improvement and promotion into guidance files, the context makes over-retention more dangerous by normalizing persistence as the default response.
The error template explicitly asks for raw error output, relevant inputs, and environment details, all of which commonly contain secrets, file paths, API keys, tokens, query contents, or internal infrastructure information. Persisting that data into durable markdown files creates a local disclosure risk and can later propagate sensitive material into version control or shared workspaces.
The feature-request template preserves what the user wanted and why, which can capture sensitive business priorities, internal roadmaps, personal circumstances, or customer-specific context. Since the skill frames persistence as a routine practice, it increases the likelihood that unnecessary sensitive context will be stored long-term.
The empty matcher causes the activation hook to run for every user prompt, which broadens the skill's reach beyond situations where it is needed. In this skill's context, that can repeatedly trigger persistence-oriented behavior and increase the chance of indiscriminate logging of prompts, corrections, or sensitive workflow details.
This markdown file documents a hook configuration with an empty matcher, which effectively matches all prompts. That is an overly broad activation condition that can collide with ordinary usage and cause unintended invocation of the skill reminder on any prompt.
The user-level activation example also sets matcher to an empty string, which provides no specificity about when the hook should run. In a setup guide, this creates an ambiguous and overly broad trigger that may activate during normal everyday prompting.
The Codex settings example again uses an empty matcher, so the documented trigger condition is effectively unrestricted. This lacks clear constraints and can lead to unintended skill activation during routine interaction.
The guide instructs users to copy and enable a persistent hook in ~/.openclaw/hooks/ without clearly warning that this changes future OpenClaw behavior across sessions. Persistent hooks increase risk because they can automatically influence later runs, and users may not fully appreciate that they are installing ongoing logic rather than a one-time command.
The skill explicitly directs users to create durable learning storage so information can survive across sessions, which introduces intentional session persistence. In a self-optimization skill, this context makes persistence expected, but it still carries security and privacy risk because sensitive task details, credentials, or operational patterns could be retained and later reused or exposed unintentionally.
└── self-optimization/
## Create Learning Files
```bash
mkdir -p ~/.openclaw/workspace/.learnings
This markdown file explains that the skill captures information in .learnings/ and promotes rules into guidance files, which are file-modifying behaviors. The README does not include any user warning or disclosure that using the skill may create or update workspace documentation and guidance files.
The markdown includes commands that copy files into ~/.openclaw/skills/, which changes the user's local agent configuration. Although this is part of installation, the document does not explicitly warn that these commands write into persistent configuration locations under the home directory.
The mkdir -p commands create new directories inside ~/.openclaw, which modifies persistent local state. The guide presents these operations as routine setup but does not explicitly disclose that they create files/directories in the user's home directory.
The file's own workspace layout at L45-L60 lists AGENTS.md, SOUL.md, TOOLS.md, and MEMORY.md, but L80 instructs users to promote repo conventions into CLAUDE.md. This is an active documentation contradiction within the integration guide and could misdirect users to persist lessons in a file outside the documented OpenClaw layout.
No suspicious patterns detected.