小花自我迭代 (HuaNiu Enhanced)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:19 AM UTC
• Version: 1.0.0

Overview

This self-improvement skill is not clearly malicious, but it broadly influences future agent behavior through persistent memory files, hooks, and cross-session guidance without enough scoping or approval controls.

Install only if you intentionally want an agent self-improvement system that can affect future sessions. Prefer project-local hooks over global hooks, avoid empty matchers unless you accept every-prompt activation, require explicit review before writing to MEMORY.md, SOUL.md, AGENTS.md, or TOOLS.md, and do not allow cross-session transcript access or message forwarding without clear user consent. Verify the exact package name and version before installation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T02 · Agent Memory Poisoning

Error

• Location: hooks/openclaw/handler.js:10
• Finding: Persistent agent instruction poisoning through learning promotion<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:10-25` **Additional Locations**: `SKILL.md:38-47`, `SKILL.md:132-147`, `SKILL.md:157-159`, `references/openclaw-integration.md:128-143` **Vulnerability Type**: Persistent agent memory and instruction poisoning **Risk Level**: High ### Vulnerable Code ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); ``` The corresponding promotion workflow is documented as: ```text Is the learning project-specific? ├── Yes → Keep in .learnings/ └── No → Is it behavioral/style-related? ├── Yes → Promote to SOUL.md └── No → Is it tool-related? ├── Yes → Promote to TOOLS.md └── No → Promote to AGENTS.md (workflow) ``` ### Technical Analysis The Skill treats user corrections, operation failures, and session discoveries as sources of learning. It then directs the agent to promote selected observations into `SOUL.md`, `AGENTS.md`, and `TOOLS.md`. These files are persistent instruction-bearing workspace files: - `SOUL.md` controls behavioral expectations and communication style. - `AGENTS.md` controls workflows and agent coordination. - `TOOLS.md` controls how tools are interpreted and used. The promotion process has no mandatory human approval, provenance verification, trust classification, sanitization, conflict detection, restricted sections, or s ...[truncated 1612 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prohibit automatic promotion into `SOUL.md`, `AGENTS.md`, and `TOOLS.md`. 2. Require explicit, informed human approval for every proposed persistent rule. 3. Store proposals in a non-executable review queue rather than an automatically injected instruction file. 4. Attach provenance to every proposal, including the originating session, user, timestamp, and supporting evidence. 5. Treat user messages, command output, web content, repository content, and other agent messages as untrusted sources. 6. Reject or escalate proposals that affect security controls, permissions, tool authorization, data disclosure, or instruction priority. 7. Allow writes only to a dedicated, delimited section and prevent modification of higher-priority policy content. 8. Add conflict detection, expiration dates, version history, and one-step rollback. 9. Require multiple independent verified observations before proposing a recurring pattern. 10. Clearly distinguish factual notes from instructions that direct future behavior. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: hooks/openclaw/handler.js:27
• Finding: Recurring bootstrap injection of self-modification instructions<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:27-51` **Additional Location**: `hooks/openclaw/HOOK.md:1-23` **Vulnerability Type**: Bootstrap instruction hijacking **Risk Level**: High ### Vulnerable Code ```javascript const handler = async (event) => { // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The registered event is: ```yaml --- name: self-improvement description: "Injects self-improvement reminder during agent bootstrap" metadata: {"openclaw":{"emoji":"🧠","events":["agent:bootstrap"]}} --- ``` ### Technical Analysis Once enabled, the hook inserts `REMINDER_CONTENT` into the agent's bootstrap context for every matching `agent:bootstrap` event. The injected instructions do more than request passive logging: they tell the agent to promote behavioral, workflow, and tool-related observations into persistent governance files. Because injection occurs during bootstrap, the content can influence the agent before ordinary task execution. The hook documentation states that it logs corrections, errors, and discoveries, but does not prominently disclose that the injected content directs changes to `SOUL.md`, `AGENTS.md`, and `TOOLS.md`. The hook is optional and must be enabled, but after activation its influence recurs automatically. ### Attack Path 1. A user or administrator installs and enables the `self-improvement` hook. 2 ...[truncated 911 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the injected instruction block with a non-directive notification that cannot authorize persistent changes. 2. Do not inject instructions that direct writes to personality, policy, workflow, or tool-governance files. 3. Require a per-session or per-action confirmation before enabling learning capture. 4. Clearly disclose every file that the workflow may modify. 5. Scope the hook to explicitly selected projects rather than enabling it globally. 6. Add configuration controls for allowed learning destinations and disable governance-file promotion by default. 7. Record hook activation and every proposed persistent change in an auditable log. 8. Provide a documented disable and rollback procedure. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/openclaw/handler.js:27
• Finding: Runtime handler omits the documented sub-agent exclusion<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:27-51` **Comparison Location**: `hooks/openclaw/handler.ts:39-48` **Vulnerability Type**: Source/runtime security-control mismatch **Risk Level**: Medium ### Vulnerable Code The TypeScript implementation contains this exclusion: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } ``` The corresponding JavaScript runtime proceeds directly from context validation to injection: ```javascript // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` ### Technical Analysis The TypeScript source indicates an intentional security or stability boundary: sub-agent sessions should not receive the reminder. The checked-in JavaScript implementation omits that boundary. Because `handler.js` uses CommonJS exports and is a directly executable runtime artifact, environments loading the JavaScript file will inject the reminder into any structurally valid `agent:bootstrap` event, including events whose session keys identify sub-agents. Maintaining duplicate hand-written TypeScript and JavaScript implementations allows reviewed controls to be absent from the executed artifact. ### Attack Path 1. OpenClaw loads `handler.js` as the runtime hook. 2. A sub-agent session generates an `agent:bootstrap` event. 3. The JavaScript handler validates only the event type, action, context, and `bootstrapFiles` array. 4. It does not inspect `event.sessionKey`. 5. The self-improvement remind ...[truncated 688 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add the `sessionKey.includes(':subagent:')` exclusion to the runtime JavaScript implementation. 2. Maintain a single authoritative TypeScript source and generate JavaScript during a reproducible build. 3. Do not commit independently edited source and runtime implementations. 4. Add automated parity tests covering primary sessions, sub-agents, malformed events, and absent contexts. 5. Fail closed when the session type cannot be determined. 6. Document which artifact OpenClaw loads and verify its digest during installation. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned package execution in the installation command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-20` **Additional Location**: `_meta.json:1-8` **Vulnerability Type**: Unpinned installation dependency and inconsistent package identity **Risk Level**: Medium ### Vulnerable Code ```bash # 安装 npx clawhub install xiaohua-self-improving ``` The Skill frontmatter identifies the package as: ```yaml name: xiaohua-self-improving metadata: version: "1.0.0" ``` However, `_meta.json` identifies it differently: ```json { "name": "self-improving-agent", "displayName": "Self-Improving Agent (Enhanced)", "version": "2.0.0", "author": "HuaNiu-Team" } ``` ### Technical Analysis The documented installation command executes `clawhub` through `npx` without a pinned version or integrity digest. Depending on local cache state and package-manager behavior, `npx` may retrieve and execute the current registry version of the package. The inconsistent Skill identity and version increase the risk of users selecting or validating the wrong artifact: - `SKILL.md`: `xiaohua-self-improving`, version `1.0.0` - `_meta.json`: `self-improving-agent`, version `2.0.0` - Integration documentation also references `self-improving-agent` This is not proof that the current dependency is malicious, but it leaves installation behavior dependent on mutable external package state and creates ambiguity about the intended package. ### Attack Path 1. A user follows the documented `npx clawhub install ...` command. 2. `npx` resolves an unpinned version of `clawhub`. 3. A compromised, replaced, or unexpectedly updated registry package is downloaded. 4. Package lifecycle or CLI code executes with the invoking user's permissions. 5. The ambiguous Skill names make it harder for the user to verify that the installed artifact matches the audited project. ### Impact Assessment A compromised installation dependency could execute arbitrary code with the user's privileges, access files and credentials available to that user, m ...[truncated 312 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer to a reviewed version, such as `npx clawhub@<exact-version>`. 2. Use package-manager integrity metadata or publish expected checksums and signatures. 3. Document a canonical package name and use it consistently in all files. 4. Synchronize the version in `SKILL.md` and `_meta.json`. 5. Prefer a locked, locally installed installer over on-demand execution. 6. Document the expected publisher identity and registry. 7. Add CI checks that fail when package names or versions differ across metadata files. 8. For high-assurance installation, provide an offline or hash-verified installation procedure. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/openclaw-integration.md:159
• Finding: Cross-session transcript access is recommended without authorization controls<![CDATA[ ## Vulnerability Details **File Location**: `references/openclaw-integration.md:159-188` **Vulnerability Type**: Unrestricted cross-session data access guidance **Risk Level**: Medium ### Vulnerable Content ```markdown ## Inter-Agent Communication OpenClaw provides tools for cross-session communication: ### sessions_list View active and recent sessions: ``` sessions_list(activeMinutes=30, messageLimit=3) ``` ### sessions_history Read transcript from another session: ``` sessions_history(sessionKey="session-id", limit=50) ``` ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ``` ### sessions_spawn Spawn a background sub-agent: ``` sessions_spawn(task="Research X and report back", label="research") ``` ``` ### Technical Analysis The Skill's declared purpose is capturing and promoting learnings, but its integration guide recommends listing sessions, reading up to 50 messages from another session, sending messages across sessions, and spawning new agents. The guidance provides no requirement for: - Explicit user authorization - Same-project or same-tenant validation - Session ownership checks - Data minimization - Secret or personal-data redaction - Audit logging - Restrictions on propagating transcript-derived content into persistent memory The calls use legitimate OpenClaw tools and do not bypass access control in code. The risk arises because the Skill encourages broader access without defining a least-privilege policy. ### Attack Path 1. The agent follows the integration guide and invokes `sessions_list`. 2. It identifies a recent session unrelated to the current task. 3. It invokes `sessions_history` with that session key and retrieves up to 50 transcript messages. 4. Sensitive transcript content is used in the current task, sent to another session, or promoted into `.learnings/` or workspace memory. 5. The original session owner may not hav ...[truncated 573 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove cross-session transcript access from the default learning workflow unless it is strictly necessary. 2. Require explicit user authorization naming the target session and intended purpose. 3. Enforce same-user, same-project, and same-tenant boundaries before access. 4. Retrieve only the minimum messages and fields necessary for the approved task. 5. Redact secrets, authentication data, personal information, and unrelated content before storage or forwarding. 6. Prohibit automatic promotion of transcript-derived content into persistent instruction files. 7. Record the requesting session, target session, purpose, message range, and result in an audit log. 8. Require confirmation before sending information to another session or spawning an agent with transcript content. 9. Configure OpenClaw permissions to deny cross-session history access by default. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:89
• Finding: Output-directory containment can be bypassed through symbolic links<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh:89-103` **Write Location**: `scripts/extract-skill.sh:173-177` **Vulnerability Type**: Symlink-based path traversal **Risk Level**: Medium ### Vulnerable Code ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" ``` The destination is then created and written without canonical-path validation: ```bash mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE --- name: $SKILL_NAME description: "[TODO: Add a concise description of what this skill does and when to use it]" --- ``` ### Technical Analysis The script rejects absolute paths and literal `..` components, but it does not resolve symbolic links before enforcing that the destination remains beneath the current workspace. An attacker who can prepare workspace files can create a relative symlink such as `external` pointing to a directory outside the workspace. Passing `--output-dir external` satisfies both textual checks. `mkdir` and shell redirection then follow the symlink and create or overwrite `SKILL.md` outside the intended boundary. The skill-name validation prevents traversal through `SKILL_NAME`, but it does not protect symlink components in `SKILLS_DIR`. ### Attack Path 1. The attacker creates a relative symlink inside the workspace: ```bash ln -s /attacker-selected/directory external ``` 2. The victim or agent runs: ```bash ./scripts/extract-skill.sh injected-skill --output-dir external ``` 3. The path passes the absolute-path and `..` checks. 4. `mkdir -p ./external/injected-sk ...[truncated 918 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the canonical current workspace with `realpath`. 2. Resolve the canonical parent of the requested destination before creating files. 3. Verify that the canonical destination begins with the canonical workspace path followed by a path separator. 4. Reject any symbolic-link component in the output path, for example by checking each component with `test -L`. 5. Create the destination in a trusted parent directory opened before processing user input. 6. Use no-follow semantics where supported and avoid shell redirection to paths that have not been revalidated. 7. Revalidate the canonical path immediately before writing to reduce time-of-check/time-of-use exposure. 8. Add tests covering absolute paths, `..`, nested symlinks, dangling symlinks, and symlink replacement races. 9. Clearly document that `--output-dir` must identify a real directory beneath the current workspace. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a fairly feature-rich self-improvement skill with multiple named integrations and domestic deployment optimizations. The supplied code chunk does not implement those capabilities; it only prints a self-improvement reminder block. Additionally, the metadata says there are no triggers, but the script comments and behavior indicate it is intended to run as an activator on user prompt submission. This is a material description/behavior mismatch rather than a mere implementation detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents an advanced agent-oriented skill focused on self-improvement and multiple named integrations. The supplied code does none of that. It is a standalone Bash script for creating a new skill scaffold under a skills directory, validating arguments, optionally doing a dry run, and writing a templated SKILL.md file. This is a materially different primary purpose, not merely an implementation detail. There are no signs of agent iteration, model/provider integration, memory handling, or the claimed workflow features.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 91% confidence
• Finding: Directing users to modify ~/.claude/settings.json establishes persistent agent behavior in a sensitive config directory. In this context, the setting wires automatic command execution into the agent runtime, so compromise of the referenced skill path or misconfiguration can create durable cross-project execution and influence over future sessions.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The description states the skill is '专为国内部署优化', which establishes a China-specific deployment and locale orientation as a default behavior. Under the policy, forcing a specific language or locale without explicit user choice should be flagged unless clearly justified as a region-specific compliance tool, which is not stated here.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The documentation tells users to execute `npx clawhub install ...` without pinning a specific package version or otherwise constraining what will be fetched and run. In an agent-skill context, this creates a supply-chain risk: a newer or compromised package version could be executed unexpectedly, especially because `npx` may download and run code on demand.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The line instructs '国内部署 - 用百度 API、本地模型、国内工具' as a normative best practice, effectively prescribing a specific regional toolset. Because the file does not provide an opt-in, opt-out, or alternative non-China workflow here, this is a natural-language locale policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The description and changelog state the skill is enhanced with 'China-friendly search patterns' and specifically references 'Baidu'. This suggests the skill may impose a locale-specific behavior by default, but the metadata does not mention user choice, opt-in, or a region-specific justification.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 86% confidence
• Finding: Creating .claude/settings.json in the project root introduces persistent hook behavior at the repository level, so anyone using the project may inherit automatic command-hook execution. While less dangerous than user-global persistence, it still expands the trust boundary and can surprise collaborators or future sessions if the scripts or config change.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: An empty matcher causes the activator hook to run on every prompt, creating a broad and persistent trigger surface. In a self-improving skill context, that means untrusted or sensitive prompts may always be passed through the hook path, increasing exposure, overhead, and the blast radius of any future script change.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The user-level configuration instructs users to install a globally active hook in ~/.claude/settings.json, extending code-executing behavior across all projects and sessions. This increases persistence and scope: a mistake, malicious script modification, or unsafe prompt-handling behavior affects every future interaction rather than a single repository.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The guide claims the hook scripts 'only output text' and 'don't modify files or run commands,' but the documented configuration explicitly executes shell scripts via command hooks. This misrepresents the trust boundary and can cause users to install code-execution hooks under a false sense of safety, increasing the chance of abuse if the scripts are changed or replaced.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly describes reading other sessions' transcripts and sending messages across sessions, but it does not mention consent, access control, or privacy boundaries. In a workspace-prompt-injection environment, this increases the chance that sensitive context from one session can be accessed or relayed to another without the user's clear awareness.

Static analysis

No suspicious patterns detected.