ClawHub
Back to skill

Security audit

Self Improving Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed self-improvement logger, but it can persist conversation-derived guidance into files that steer future agent sessions and offers broad automatic hooks, so it needs careful review before installation.

Install only if you want persistent self-improvement memory. Prefer project-local setup, avoid global hooks unless you have reviewed the scripts, keep .learnings out of version control when it may contain private details, and require human review before promoting any learning into CLAUDE.md, AGENTS.md, Copilot instructions, SOUL.md, or TOOLS.md.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:23
Finding

Untrusted learnings can be promoted into persistent agent instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-26, 262-289, 350-361, 443-448; references/openclaw-integration.md:103-142
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: Medium

Vulnerable Code and Instructions

SKILL.md:23-26 defines persistent agent-context files as promotion targets:

markdown
| Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` |
| Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) |
| Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) |
| Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) |

SKILL.md:262-289 instructs the agent to transfer learnings into those files:

markdown
## Promoting to Project Memory

When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory.

### When to Promote

- Learning applies across multiple files/features
- Knowledge any contributor (human or AI) should know
- Prevents recurring mistakes
- Documents project-specific conventions

### Promotion Targets

| Target | What Belongs There |
|--------|-------------------|
| `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions |
| `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules |
| `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot |
| `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) |
| `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) |

### How to Promote

1. **Distill** the learning into a concise rule or fact
2. **Add** to appropriate section in target file (create file if needed)
3. **Update** original entry:
   - Change `**Status**: pending` → `**Status**: promoted`
   - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructi
...[truncated 2748 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat every conversation-derived learning as untrusted data, even when labeled as a correction or best practice.
  2. Require explicit, informed user approval immediately before writing to persistent agent-context files.
  3. Add a mandatory security review that rejects rules which:
    • Override safety or authorization constraints.
    • Request secrets, credentials, or unrelated private data.
    • Change tool routing or command-execution policy.
    • Authorize external communication or data transfer.
    • Instruct the agent to ignore higher-priority instructions.
  4. Preserve structured provenance, including the originating session, author, timestamp, supporting evidence, and reviewer.
  5. Never copy raw user text directly into instruction files. Convert validated facts into narrowly scoped declarative statements.
  6. Keep unreviewed entries in .learnings/ as quoted data rather than active instructions.
  7. Remove the “promote aggressively” recommendation and default to no promotion when trust or applicability is uncertain.
  8. Require separate approval for shared or globally injected files such as SOUL.md, AGENTS.md, and TOOLS.md.
  9. Add tests using prompt-injection examples to ensure malicious learning content cannot be promoted automatically.

T09 · Insecure Skill Coding Practices

Note
Location
hooks/openclaw/handler.js:28
Finding

Runtime JavaScript hook omits the documented sub-agent exclusion

Content
View full analysis

Vulnerability Details

File Location: hooks/openclaw/handler.js:28-53; comparison with hooks/openclaw/handler.ts:28-55
Vulnerability Type: Source/runtime security-control divergence
Risk Level: Low

Vulnerable Code

The shipped runtime JavaScript handles every qualifying bootstrap event without checking whether the session is a sub-agent:

javascript
const handler = async (event) => {
  // Safety checks for event structure
  if (!event || typeof event !== 'object') {
    return;
  }

  // Only handle agent:bootstrap events
  if (event.type !== 'agent' || event.action !== 'bootstrap') {
    return;
  }

  // Safety check for context
  if (!event.context || typeof event.context !== 'object') {
    return;
  }

  // Inject the reminder as a virtual bootstrap file
  // Check that bootstrapFiles is an array before pushing
  if (Array.isArray(event.context.bootstrapFiles)) {
    event.context.bootstrapFiles.push({
      path: 'SELF_IMPROVEMENT_REMINDER.md',
      content: REMINDER_CONTENT,
      virtual: true,
    });
  }
};

By contrast, the TypeScript source contains an exclusion that is absent from the JavaScript artifact:

typescript
// Skip sub-agent sessions to avoid bootstrap issues
// Sub-agents have sessionKey patterns like "agent:main:subagent:..."
const sessionKey = event.sessionKey || '';
if (sessionKey.includes(':subagent:')) {
  return;
}

// Inject the reminder as a virtual bootstrap file
// Check that bootstrapFiles is an array before pushing
if (Array.isArray(event.context.bootstrapFiles)) {
  event.context.bootstrapFiles.push({
    path: 'SELF_IMPROVEMENT_REMINDER.md',
    content: REMINDER_CONTENT,
    virtual: true,
  });
}

Technical Analysis

OpenClaw installations may execute handler.js, while reviewers and maintainers may rely on handler.ts as the authoritative source. The two implementations enforce di ...[truncated 1799 chars]

Remediation
View remediation

Remediation Suggestions

  1. Regenerate handler.js from handler.ts so the sub-agent exclusion is present in the runtime artifact.
  2. Establish one authoritative implementation and avoid manually maintaining equivalent JavaScript and TypeScript files.
  3. Add CI checks that compile TypeScript and fail if committed runtime output differs from the generated artifact.
  4. Add a unit test asserting that session keys containing :subagent: do not modify event.context.bootstrapFiles.
  5. Add tests for malformed events, absent session keys, non-array bootstrap files, and main-agent bootstrap events.
  6. Document which file OpenClaw executes so reviewers can evaluate the effective runtime behavior.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about maintaining and consulting learnings for continuous improvement after failures, corrections, outdated knowledge, or discovered better approaches. The supplied code does not implement that behavior. Instead, it is a filesystem-writing utility that scaffolds a new skill directory and template markdown file. While the comments mention creating a skill from a learning entry, the script neither captures learnings nor reviews them; it only creates a placeholder skill structure. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The guidance directs users to modify ~/.claude/settings.json, an agent configuration file that controls hook execution behavior. Changing agent-wide config is security-sensitive because it can establish persistent command execution across future sessions, making this more dangerous in the context of a skill that self-installs automation.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use the skill whenever a command fails, the user corrects the agent, an API/tool fails, knowledge is outdated, or a better approach is discovered. Several of these conditions are broad and common in ordinary conversations, and the file does not provide exclusion conditions or boundaries for when the skill should not activate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill explicitly encourages creating persistent files under the user's home workspace and repeatedly promoting session-derived content into long-lived memory files. In agent environments, persistent memory can retain sensitive prompts, credentials, internal paths, stack traces, or user corrections longer than intended, creating privacy and cross-session data exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The listed triggers include phrases like "Actually, it should be...", "Can you also...", and "Is there a way to...", which are common conversational phrases not unique to self-improvement logging. Without tighter constraints, these examples could make the skill activate on routine discussion rather than genuine learning events.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

Creating .claude/settings.json introduces persistent behavior that survives beyond the immediate session, causing hooks to continue executing automatically in later interactions. Persistence is especially relevant here because the skill is about continuous self-improvement and proactively injects reminders, so retained configuration can have ongoing effects users may forget about.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

An empty matcher causes the activator hook to run on every prompt, creating pervasive execution with no scope restriction. In a self-improvement skill, this broad trigger increases exposure to prompt-driven side effects, performance overhead, and accidental capture or processing of sensitive context across all interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Installing the hook in ~/.claude/settings.json enables automatic command execution across all sessions and repositories, extending the effect far beyond a single trusted project. This broad scope increases the blast radius if the scripts are modified, misconfigured, or used in contexts containing sensitive code or data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document claims the scripts 'only output text' and 'don't modify files or run commands', but they are explicitly configured as command hooks and therefore execute shell commands when triggered. This mismatch can cause operators to underestimate the trust boundary and grant broad execution to hook scripts they have not adequately reviewed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The guidance creates a durable .learnings/ store intended to survive beyond the current interaction, which introduces session persistence of model-derived content. That becomes risky when the stored content can later influence behavior or preserve sensitive operational details, especially in a system that already relies on injected workspace context.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation instructs the agent/operator to create persistent learning directories in the workspace or skill path without clearly warning that this modifies local state and may retain sensitive prompts, errors, or user content across sessions. In a prompt-injection-heavy environment, silent persistence increases the chance of unintended retention of sensitive or adversarially influenced data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The 'Detection Triggers' section lists very general conditions such as user corrections, command failures, API errors, and knowledge gaps without defining thresholds, exclusions, or concrete activation boundaries. In a markdown skill/integration guide, these broad triggers can overlap with normal interaction patterns and make it unclear when the skill should act versus ignore routine events.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.