T01 · Skill Instruction Hijacking
Warning
- Location
hooks/openclaw/handler.js:52- Finding
Agent Bootstrap Context Instruction Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
AI自动进化工程，结合self-improvement技巧+实际运行总结而成
Security checks for vulnerabilities and agentic risk
Overview
This skill is a self-learning logger, but it broadly stores conversation-derived lessons and can turn them into future agent instructions without strong user review controls.
Install only if you want this kind of persistent learning system. Prefer project-local use, keep .learnings private or gitignored unless intentionally shared, review every write and promotion before committing it, avoid global hooks and full system-prompt installation, and redact secrets or sensitive project details from all learning entries.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:231- Finding
Conversation-Derived Rules Can Be Promoted into Persistent Agent Policy Files
- Content
View full analysis
= 3, involves 2+ tasks, and occurs within a 30-day window. ### Promotion Targets | Learning type | Promote to | | Project facts and general conventions | CLAUDE.md | | Workflow and automation rules | AGENTS.md | | Behavioral guidelines and communication style | SOUL.md | | Tool capabilities and integration pitfalls | TOOLS.md | ### How to Promote 1. Refine it into a concise preventive rule rather than an incident review. 2. Write it into the corresponding section of the target file. 3. Change the original entry status to promoted and record the target file. ``` The bootstrap reminder reinforces the same persistent targets: ```javascript **Stable patterns should be promoted:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool-use pitfalls → \`TOOLS.md\` ``` ### Technical Analysis The Skill instructs the agent to collect material derived from conversations, command failures, user corrections, and model observations, then promote selected material into files used as persistent agent memory or policy. Files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, and `TOOLS.md` may be loaded in later sessions and influence behavior unrelated to the original conversation. This creates a memory-poisoning path because conversational content can eventually become durable policy ...[truncated 1998 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
references/agent-setup.md:25- Finding
Documentation Recommends Installing Skill Instructions as Privileged System Prompts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (41)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
This variant includes undeclared local file access to
.learnings/*.md, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
This variant includes undeclared local file access to
.learnings/*.md, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
This variant includes undeclared local file access to
.learnings/*.md, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
This variant includes undeclared local file access to
.learnings/*.md, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant includes undeclared local file access to
.learnings/*.md, which is more than a harmless description mismatch. Undisclosed reading of persistent local history can expose prior conversation-derived content or project information to the model context without clear user awareness, increasing confidentiality risk.- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Recording used inputs or parameters and full error/context details in persistent files is especially dangerous because failures often contain credentials, API keys, personal data, environment variables, command lines, or internal endpoints. In a self-learning skill, that data may then be repeatedly read back into future sessions, compounding exposure.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
Documenting installation into ~/.claude/settings.json encourages persistence in an agent configuration directory that affects future sessions globally. In the context of a self-evolution skill that auto-triggers and may record experience across sessions, this materially increases risk by creating a durable, wide-scope execution path for local shell hooks.
- Content
方案 2：用户级配置
将配置写入
~/.claude/settings.json，全局生效：json {
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Using an empty matcher in the user-level configuration makes the hook trigger globally across all sessions and projects, greatly expanding the blast radius. Because the hook runs shell commands from a user-controlled config directory, this setup can expose unrelated prompts and environments to the script and makes any later script modification immediately effective everywhere.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Ambiguous statements such as reviewing at session start and summarizing at session end can result in uncontrolled automatic execution boundaries. Because those actions may read or persist local history without clear user initiation, ambiguity increases the risk of silent data handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Ambiguous statements such as reviewing at session start and summarizing at session end can result in uncontrolled automatic execution boundaries. Because those actions may read or persist local history without clear user initiation, ambiguity increases the risk of silent data handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
文件中的名称、描述和操作说明均以中文固定呈现，没有表明用户可选择其他语言，也没有说明这是面向特定中文环境的限定技能。按规则，这构成可能的语言/locale 强制约束。
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs automatic writing of experience and session-derived content into
.learnings/without warning about retention of user content or project-sensitive information. Persistent storage of conversational material can create a durable privacy and secret-exposure channel, especially in shared repos or synced home directories.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly encourages logging full conversation-derived details and reusing them across sessions, which can persist sensitive user inputs, project context, and mistakes far beyond the original interaction. Cross-session summarization amplifies the risk by repeatedly re-exposing stored content to the model context and potentially to other users or collaborators.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Using generic phrases like corrections or requests as triggers, without guardrails, makes false positives likely. In this skill, such false positives can cascade into unnecessary persistent logging of normal user messages, which raises confidentiality and consent concerns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The templates instruct retention of full context, inputs, parameters, and user needs, but do not require minimization or redaction. This creates a substantial risk of storing secrets, personal data, internal URLs, access tokens, or proprietary prompts in long-lived files that may later be read, committed, or shared.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents all instructional content in Chinese, but does not indicate that the language choice is optional, configurable, or justified as a region-specific requirement. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown template is written as the standard skill template and uses Chinese throughout, including the title and instructional text, which implies a default mandated language for derived skills. The file does not offer an opt-in language choice or explain a region-specific reason for the locale restriction, matching the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language content of the hook documentation is presented entirely in Chinese, which can force a specific language on users or maintainers who do not read it. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language content injected into every qualifying bootstrap session is entirely in Chinese, which imposes a specific language on users without any opt-in or fallback. This matches the policy category for language or locale constraints because the file applies the reminder broadly and does not indicate that the skill is intended only for Chinese-speaking users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The injected reminder text is entirely in Chinese, which imposes a specific language on all users of the hook during agent bootstrap. The file does not offer a language choice or explain a region-specific reason for this locale constraint, so it violates the language/locale policy criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document explicitly instructs automatic writes to project files under
.learnings/based on runtime events, but it does not require user consent, visibility, or repository-scope safeguards. This creates an integrity and privacy risk because conversational content, mistakes, and inferred requirements may be persisted into a repo automatically, including in shared repositories.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The system-prompt guidance tells the model to persist user corrections and new capability requests into project files, creating a retention channel for user-provided natural-language content. In shared repos or synced workspaces, this can leak sensitive prompts, proprietary requirements, or personal data beyond the original interaction and normalize unreviewed prompt-to-file propagation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guidance states that errors or user corrections should be recorded into shared learning files, which can propagate conversation-derived content into durable project artifacts. This is dangerous because it expands the blast radius of sensitive or incorrect user input, and in team settings can expose internal information to other collaborators through the repository.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An empty matcher causes the UserPromptSubmit hook to run on every prompt, creating a very broad trigger surface for arbitrary user input. In a self-evolution skill, this is especially risky because all conversations become inputs to a privileged local script, increasing the chance of prompt-data capture, unintended persistence, or abuse if the script behavior changes.
- Content