T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:157- Finding
Persistent Poisoning of Authoritative Agent Instructions and Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
IceCube Evolution
Security checks for vulnerabilities and agentic risk
Overview
This skill is not shown to contain malicious code, but it asks an agent to persistently change its own rules, memory, configuration, and installed capabilities without clear human approval controls.
Install only if you deliberately want a self-modifying agent workflow. Before use, require explicit review for every change to agent instructions, memory, config, skills, or tools; forbid logging secrets or personal data; keep generated improvements in a review queue; and use versioned rollback for approved changes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:157- Finding
Unreviewed Skill Installation and Runtime Configuration Mutation
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:124- Finding
Unbounded Unattended Self-Modification Through Scheduled Improvement Processing
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly promotes continuous, automatic evolution and file updates, but the description does not warn that it may autonomously modify durable agent/system artifacts such as AGENTS.md, MEMORY.md, SOUL.md, and config files. In a self-improvement skill, omission of that warning is materially risky because operators may install it without understanding that it changes long-lived behavior outside the current task.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to log every mistake and every success pattern to persistent memory files, but provides no privacy, minimization, or retention guidance. Because those logs can naturally capture user prompts, corrections, task content, and contextual details, this creates a durable data-retention risk and increases the chance of sensitive information being stored and later reused or exposed.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The setup creates persistent memory files under the user's workspace to store mistakes, successes, queues, and evolution history across sessions. Persistent state is not inherently unsafe, but in this skill it materially increases risk because the stored content directly drives later autonomous behavior changes and may retain sensitive operational or user-derived information indefinitely.
- Content
Setup
1. Create Evolution Files
bash mkdir -p ~/.openclaw/workspace/memory/system
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs automatic logging of mistakes, successes, user corrections, praise, failures, and context-loss events into persistent files, which creates a clear natural-language retention channel. That is dangerous because it can capture sensitive user content or inferred metadata and preserve it beyond the session, where it may later be surfaced, reused, or incorporated into new rules.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section normalizes autonomous generation, queuing, and application of improvements to AGENTS.md, SOUL.md, MEMORY.md, SKILL.md, and configuration based on prior interactions. In context, that is more dangerous than a generic workflow note because it establishes a self-modifying control loop that can drift behavior, entrench mistakes, amplify prompt-injected content, or silently weaken safeguards over time without human approval.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Using broad natural-language cues like user saying 'good' or 'thanks' as an automatic trigger for success capture is too loose and will over-collect routine interactions. In this skill, that broad trigger feeds a persistent self-improvement pipeline, so casual politeness can become logged behavioral evidence and influence future autonomous changes without meaningful signal quality.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ❌ **Don't:** - Wait for user to notice mistakes - Log mistakes without fixes - Apply improvements without verification - Let improvement queue grow unbounded - Skip evolution during busy periods