AI自动进化工程，结合self-improvement技巧+实际运行总结而成

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:35 PM UTC
• Version: 1.0.1

Overview

This skill is a self-learning logger, but it broadly stores conversation-derived lessons and can turn them into future agent instructions without strong user review controls.

Install only if you want this kind of persistent learning system. Prefer project-local use, keep .learnings private or gitignored unless intentionally shared, review every write and promotion before committing it, avoid global hooks and full system-prompt installation, and redact secrets or sensitive project details from all learning entries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/openclaw/handler.js:52
• Finding: Agent Bootstrap Context Instruction Injection<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:52-58` **Additional Location**: `hooks/openclaw/handler.ts:52-58` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Complete Code Snippet ```javascript // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'AI_SELF_EVOLUTION_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` The TypeScript implementation contains equivalent logic: ```typescript // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'AI_SELF_EVOLUTION_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` ### Technical Analysis The OpenClaw hook runs during the `agent:bootstrap` lifecycle event and appends a virtual file containing Skill-authored behavioral instructions to `event.context.bootstrapFiles`. This places the instructions into privileged bootstrap context before normal workspace files are injected. The injected content directs the agent to record conversation-derived information and promote selected patterns into persistent agent-control files. Although the hook must be installed and enabled explicitly, the instructions are subsequently injected into every qualifying main-agent bootstrap without per-session approval. The handler excludes session keys containing `:subagent:`, but it does not: - Request consent for each injection. - authenticate or integrity-check the reminder content. - constrain the reminder to non-directive status information. - provide a policy boundary preventing injected text from changing agent behavior. - show users a diff of the instructions entering bootstrap context. ### Attack Path 1. A us ...[truncated 1288 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace bootstrap instruction injection with a user-visible notification outside the privileged agent context. 2. Require explicit per-session consent before adding any virtual bootstrap file. 3. Treat reminder content as untrusted data rather than executable agent instructions. 4. Restrict hook output to factual status information, such as the number of pending entries. 5. Display the exact content and source of every bootstrap addition to the user. 6. Pin and verify the integrity of enabled hook versions. 7. Add a configuration option that disables bootstrap injection by default. 8. If injection remains necessary, enforce a fixed schema and reject imperative instructions, tool requests, or file-modification directives. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:231
• Finding: Conversation-Derived Rules Can Be Promoted into Persistent Agent Policy Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:231-253` **Related Locations**: `SKILL.md:23-28, 295`; `references/openclaw-integration.md:129-143`; `hooks/openclaw/handler.js:20-23`; `hooks/openclaw/handler.ts:21-24` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: High ### Complete Source Excerpt The following is a faithful English rendering of the relevant workflow in `SKILL.md:231-253`: ```markdown ## Promotion to Project Memory ### When to Promote - The learning applies to multiple files or features. - Every contributor should know it. - It can prevent repeated mistakes. - A recurring pattern meets: Recurrence-Count >= 3, involves 2+ tasks, and occurs within a 30-day window. ### Promotion Targets | Learning type | Promote to | | Project facts and general conventions | CLAUDE.md | | Workflow and automation rules | AGENTS.md | | Behavioral guidelines and communication style | SOUL.md | | Tool capabilities and integration pitfalls | TOOLS.md | ### How to Promote 1. Refine it into a concise preventive rule rather than an incident review. 2. Write it into the corresponding section of the target file. 3. Change the original entry status to promoted and record the target file. ``` The bootstrap reminder reinforces the same persistent targets: ```javascript **Stable patterns should be promoted:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool-use pitfalls → \`TOOLS.md\` ``` ### Technical Analysis The Skill instructs the agent to collect material derived from conversations, command failures, user corrections, and model observations, then promote selected material into files used as persistent agent memory or policy. Files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, and `TOOLS.md` may be loaded in later sessions and influence behavior unrelated to the original conversation. This creates a memory-poisoning path because conversational content can eventually become durable policy ...[truncated 1998 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prohibit automatic promotion of conversation-derived content into agent policy or memory files. 2. Require explicit approval from an authorized repository owner for every promotion. 3. Present a complete diff containing the proposed change, source conversation, author, timestamp, and rationale. 4. Separate factual project knowledge from executable behavioral instructions. 5. Reject entries containing imperative commands, policy overrides, encoded content, external payload references, or requests to weaken security controls. 6. Require corroboration from trusted repository documentation or verified code before promoting factual claims. 7. Store unreviewed learnings in a quarantined, non-executable data file that agents do not load as instructions. 8. Use allowlisted fields and structured data rather than unrestricted Markdown. 9. Record immutable provenance and maintain a straightforward rollback mechanism. 10. Never write to shared `SOUL.md`, `AGENTS.md`, `TOOLS.md`, or `CLAUDE.md` files without human review. 11. Ensure recurrence counters cannot be increased solely through repeated untrusted user claims. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: references/agent-setup.md:25
• Finding: Documentation Recommends Installing Skill Instructions as Privileged System Prompts<![CDATA[ ## Vulnerability Details **File Location**: `references/agent-setup.md:25-53` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Complete Source Excerpt The following is a faithful English rendering of the relevant setup instructions: ```markdown ## Adaptation for Models Without Hook Support Models such as Kimi and MiniMax may not support Hooks or the Agent Skills specification, but similar behavior can be implemented through system-prompt injection. ### General Adaptation Add the following content to the System Prompt: ## Self-Improvement Workflow When any of the following occurs during work, automatically record it in the project's .learnings directory: - Command failure or operational error → .learnings/ERRORS.md - User correction → .learnings/LEARNINGS.md - Request for a new capability → .learnings/FEATURE_REQUESTS.md - Outdated knowledge or a better approach → .learnings/LEARNINGS.md Entry format: ## [TYPE-YYYYMMDD-XXX] title, including Summary, Details, and Suggested Action. High-value learnings should be promoted to CLAUDE.md or AGENTS.md. ### Kimi - Kimi's long-context capability makes it suitable for injecting the full SKILL.md as the system prompt. - Pass the self-improvement instructions through a system-role API message. - Kimi can write directly to the .learnings directory. ### MiniMax - Inject the instructions through the MiniMax API system prompt. - Function Calling can encapsulate the recording operation. ``` ### Technical Analysis The setup guide recommends assigning third-party Skill text to the privileged system role, including an option to inject the entire `SKILL.md`. System-role instructions generally have greater authority than ordinary user messages and persist across every task performed under that configuration. This design removes normal instruction-boundary protections by elevating Skill-maintained text into the agent's highest practical instruction layer. The effective cont ...[truncated 1555 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not recommend placing the full Skill or third-party Skill content in a system prompt. 2. Use a scoped, ordinary user message only when the user explicitly requests the workflow. 3. Keep system prompts minimal, static, owner-controlled, and independent of updateable Skill packages. 4. Require confirmation before every filesystem write or memory promotion. 5. Restrict any recording function to structured, non-executable data. 6. Configure function tools with narrowly scoped paths and deny writes to agent policy files by default. 7. Pin the exact reviewed prompt version and show users any proposed update as a diff. 8. Document that Skill text must not override platform safety controls, owner policy, or current user intent. 9. Provide clear uninstall and rollback procedures for previously configured system prompts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: This variant includes undeclared local file access to `.learnings/*.md`, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: This variant includes undeclared local file access to `.learnings/*.md`, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: This variant includes undeclared local file access to `.learnings/*.md`, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: This variant includes undeclared local file access to `.learnings/*.md`, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This variant includes undeclared local file access to `.learnings/*.md`, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Recording used inputs or parameters and full error/context details in persistent files is especially dangerous because failures often contain credentials, API keys, personal data, environment variables, command lines, or internal endpoints. In a self-learning skill, that data may then be repeatedly read back into future sessions, compounding exposure.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### 方案 2：用户级配置

将配置写入 `~/.claude/settings.json`，全局生效：

```json
{

• Confidence: 93% confidence
• Finding: Documenting installation into ~/.claude/settings.json encourages persistence in an agent configuration directory that affects future sessions globally. In the context of a self-evolution skill that auto-triggers and may record experience across sessions, this materially increases risk by creating a durable, wide-scope execution path for local shell hooks.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: Using an empty matcher in the user-level configuration makes the hook trigger globally across all sessions and projects, greatly expanding the blast radius. Because the hook runs shell commands from a user-controlled config directory, this setup can expose unrelated prompts and environments to the script and makes any later script modification immediately effective everywhere.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Ambiguous statements such as reviewing at session start and summarizing at session end can result in uncontrolled automatic execution boundaries. Because those actions may read or persist local history without clear user initiation, ambiguity increases the risk of silent data handling.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Ambiguous statements such as reviewing at session start and summarizing at session end can result in uncontrolled automatic execution boundaries. Because those actions may read or persist local history without clear user initiation, ambiguity increases the risk of silent data handling.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: 文件中的名称、描述和操作说明均以中文固定呈现，没有表明用户可选择其他语言，也没有说明这是面向特定中文环境的限定技能。按规则，这构成可能的语言/locale 强制约束。

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs automatic writing of experience and session-derived content into `.learnings/` without warning about retention of user content or project-sensitive information. Persistent storage of conversational material can create a durable privacy and secret-exposure channel, especially in shared repos or synced home directories.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly encourages logging full conversation-derived details and reusing them across sessions, which can persist sensitive user inputs, project context, and mistakes far beyond the original interaction. Cross-session summarization amplifies the risk by repeatedly re-exposing stored content to the model context and potentially to other users or collaborators.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: Using generic phrases like corrections or requests as triggers, without guardrails, makes false positives likely. In this skill, such false positives can cascade into unnecessary persistent logging of normal user messages, which raises confidentiality and consent concerns.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The templates instruct retention of full context, inputs, parameters, and user needs, but do not require minimization or redaction. This creates a substantial risk of storing secrets, personal data, internal URLs, access tokens, or proprietary prompts in long-lived files that may later be read, committed, or shared.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file presents all instructional content in Chinese, but does not indicate that the language choice is optional, configurable, or justified as a region-specific requirement. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown template is written as the standard skill template and uses Chinese throughout, including the title and instructional text, which implies a default mandated language for derived skills. The file does not offer an opt-in language choice or explain a region-specific reason for the locale restriction, matching the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The natural-language content of the hook documentation is presented entirely in Chinese, which can force a specific language on users or maintainers who do not read it. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears here.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The natural-language content injected into every qualifying bootstrap session is entirely in Chinese, which imposes a specific language on users without any opt-in or fallback. This matches the policy category for language or locale constraints because the file applies the reminder broadly and does not indicate that the skill is intended only for Chinese-speaking users.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The injected reminder text is entirely in Chinese, which imposes a specific language on all users of the hook during agent bootstrap. The file does not offer a language choice or explain a region-specific reason for this locale constraint, so it violates the language/locale policy criteria.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly instructs automatic writes to project files under `.learnings/` based on runtime events, but it does not require user consent, visibility, or repository-scope safeguards. This creates an integrity and privacy risk because conversational content, mistakes, and inferred requirements may be persisted into a repo automatically, including in shared repositories.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The system-prompt guidance tells the model to persist user corrections and new capability requests into project files, creating a retention channel for user-provided natural-language content. In shared repos or synced workspaces, this can leak sensitive prompts, proprietary requirements, or personal data beyond the original interaction and normalize unreviewed prompt-to-file propagation.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The guidance states that errors or user corrections should be recorded into shared learning files, which can propagate conversation-derived content into durable project artifacts. This is dangerous because it expands the blast radius of sensitive or incorrect user input, and in team settings can expose internal information to other collaborators through the repository.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: An empty matcher causes the UserPromptSubmit hook to run on every prompt, creating a very broad trigger surface for arbitrary user input. In a self-evolution skill, this is especially risky because all conversations become inputs to a privileged local script, increasing the chance of prompt-data capture, unintended persistence, or abuse if the script behavior changes.

Static analysis

No suspicious patterns detected.