T02 · Agent Memory Poisoning
Error
- Location
hooks/openclaw/handler.js:10- Finding
Persistent agent instruction poisoning through learning promotion
- Content
View full analysis
- Remediation
View remediation
Security audit
小花自我迭代 (HuaNiu Enhanced)
Security checks for vulnerabilities and agentic risk
Overview
This self-improvement skill is not clearly malicious, but it broadly influences future agent behavior through persistent memory files, hooks, and cross-session guidance without enough scoping or approval controls.
Install only if you intentionally want an agent self-improvement system that can affect future sessions. Prefer project-local hooks over global hooks, avoid empty matchers unless you accept every-prompt activation, require explicit review before writing to MEMORY.md, SOUL.md, AGENTS.md, or TOOLS.md, and do not allow cross-session transcript access or message forwarding without clear user consent. Verify the exact package name and version before installation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (6)
T01 · Skill Instruction Hijacking
Error
- Location
hooks/openclaw/handler.js:27- Finding
Recurring bootstrap injection of self-modification instructions
- Content
View full analysis
{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The registered event is: ```yaml --- name: self-improvement description: "Injects self-improvement reminder during agent bootstrap" metadata: {"openclaw":{"emoji":"🧠","events":["agent:bootstrap"]}} --- ``` ### Technical Analysis Once enabled, the hook inserts `REMINDER_CONTENT` into the agent's bootstrap context for every matching `agent:bootstrap` event. The injected instructions do more than request passive logging: they tell the agent to promote behavioral, workflow, and tool-related observations into persistent governance files. Because injection occurs during bootstrap, the content can influence the agent before ordinary task execution. The hook documentation states that it logs corrections, errors, and discoveries, but does not prominently disclose that the injected content directs changes to `SOUL.md`, `AGENTS.md`, and `TOOLS.md`. The hook is optional and must be enabled, but after activation its influence recurs automatically. ### Attack Path 1. A user or administrator installs and enables the `self-improvement` hook. 2 ...[truncated 911 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
hooks/openclaw/handler.js:27- Finding
Runtime handler omits the documented sub-agent exclusion
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:17- Finding
Unpinned package execution in the installation command
- Content
View full analysis
- Remediation
View remediation
`. 2. Use package-manager integrity metadata or publish expected checksums and signatures. 3. Document a canonical package name and use it consistently in all files. 4. Synchronize the version in `SKILL.md` and `_meta.json`. 5. Prefer a locked, locally installed installer over on-demand execution. 6. Document the expected publisher identity and registry. 7. Add CI checks that fail when package names or versions differ across metadata files. 8. For high-assurance installation, provide an offline or hash-verified installation procedure. ]]>
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/openclaw-integration.md:159- Finding
Cross-session transcript access is recommended without authorization controls
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract-skill.sh:89- Finding
Output-directory containment can be bypassed through symbolic links
- Content
View full analysis
"$SKILL_PATH/SKILL.md" << TEMPLATE --- name: $SKILL_NAME description: "[TODO: Add a concise description of what this skill does and when to use it]" --- ``` ### Technical Analysis The script rejects absolute paths and literal `..` components, but it does not resolve symbolic links before enforcing that the destination remains beneath the current workspace. An attacker who can prepare workspace files can create a relative symlink such as `external` pointing to a directory outside the workspace. Passing `--output-dir external` satisfies both textual checks. `mkdir` and shell redirection then follow the symlink and create or overwrite `SKILL.md` outside the intended boundary. The skill-name validation prevents traversal through `SKILL_NAME`, but it does not protect symlink components in `SKILLS_DIR`. ### Attack Path 1. The attacker creates a relative symlink inside the workspace: ```bash ln -s /attacker-selected/directory external ``` 2. The victim or agent runs: ```bash ./scripts/extract-skill.sh injected-skill --output-dir external ``` 3. The path passes the absolute-path and `..` checks. 4. `mkdir -p ./external/injected-sk ...[truncated 918 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a fairly feature-rich self-improvement skill with multiple named integrations and domestic deployment optimizations. The supplied code chunk does not implement those capabilities; it only prints a self-improvement reminder block. Additionally, the metadata says there are no triggers, but the script comments and behavior indicate it is intended to run as an activator on user prompt submission. This is a material description/behavior mismatch rather than a mere implementation detail.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents an advanced agent-oriented skill focused on self-improvement and multiple named integrations. The supplied code does none of that. It is a standalone Bash script for creating a new skill scaffold under a skills directory, validating arguments, optionally doing a dry run, and writing a templated SKILL.md file. This is a materially different primary purpose, not merely an implementation detail. There are no signs of agent iteration, model/provider integration, memory handling, or the claimed workflow features.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 91% confidence
- Finding
Directing users to modify ~/.claude/settings.json establishes persistent agent behavior in a sensitive config directory. In this context, the setting wires automatic command execution into the agent runtime, so compromise of the referenced skill path or misconfiguration can create durable cross-project execution and influence over future sessions.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description states the skill is '专为国内部署优化', which establishes a China-specific deployment and locale orientation as a default behavior. Under the policy, forcing a specific language or locale without explicit user choice should be flagged unless clearly justified as a region-specific compliance tool, which is not stated here.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
The documentation tells users to execute
npx clawhub install ...without pinning a specific package version or otherwise constraining what will be fetched and run. In an agent-skill context, this creates a supply-chain risk: a newer or compromised package version could be executed unexpectedly, especially becausenpxmay download and run code on demand.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The line instructs '国内部署 - 用百度 API、本地模型、国内工具' as a normative best practice, effectively prescribing a specific regional toolset. Because the file does not provide an opt-in, opt-out, or alternative non-China workflow here, this is a natural-language locale policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description and changelog state the skill is enhanced with 'China-friendly search patterns' and specifically references 'Baidu'. This suggests the skill may impose a locale-specific behavior by default, but the metadata does not mention user choice, opt-in, or a region-specific justification.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
Creating .claude/settings.json in the project root introduces persistent hook behavior at the repository level, so anyone using the project may inherit automatic command-hook execution. While less dangerous than user-global persistence, it still expands the trust boundary and can surprise collaborators or future sessions if the scripts or config change.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An empty matcher causes the activator hook to run on every prompt, creating a broad and persistent trigger surface. In a self-improving skill context, that means untrusted or sensitive prompts may always be passed through the hook path, increasing exposure, overhead, and the blast radius of any future script change.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-level configuration instructs users to install a globally active hook in ~/.claude/settings.json, extending code-executing behavior across all projects and sessions. This increases persistence and scope: a mistake, malicious script modification, or unsafe prompt-handling behavior affects every future interaction rather than a single repository.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide claims the hook scripts 'only output text' and 'don't modify files or run commands,' but the documented configuration explicitly executes shell scripts via command hooks. This misrepresents the trust boundary and can cause users to install code-execution hooks under a false sense of safety, increasing the chance of abuse if the scripts are changed or replaced.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation explicitly describes reading other sessions' transcripts and sending messages across sessions, but it does not mention consent, access control, or privacy boundaries. In a workspace-prompt-injection environment, this increases the chance that sensitive context from one session can be accessed or relayed to another without the user's clear awareness.
- Content