Security audit

Andara Self Improvement

Security checks for vulnerabilities and agentic risk

Overview

The skill is not visibly malicious, but it asks agents to persist conversation-derived learnings into future agent instructions and optional always-on hooks without strong review or redaction controls.

Install only if you want persistent self-improvement memory. Keep `.learnings/` local or reviewed before committing, do not log tokens, credentials, private URLs, raw transcripts, or full environment dumps, and require a human diff review before promoting anything into `CLAUDE.md`, `AGENTS.md`, Copilot instructions, `SOUL.md`, or `TOOLS.md`. Prefer project-scoped hooks with narrow matchers, avoid global `~/.claude` hooks unless you trust and audit the scripts, and periodically clean old learning records.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:348
Finding: Untrusted Learnings Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-26`, `SKILL.md:348-362`, `SKILL.md:443-448` **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown | User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` | ... | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | ... | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The Skill treats user corrections and conversation-derived observations as candidates for storage in `.learnings/`. It subsequently permits those records to be promoted into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. These destination files are persistent agent-context or instruction files. Their contents can influence behavior in future sessions, potentially with greater authority than the original user message. The promotion criteria consider recurrence and general applicability, but they do not require: - Explicit human approval - Trusted provenance - Security review - Removal of embedded instructions - Rejection of attempts to alter safety controls - Verification that repeated observations originated from independent trusted sources The recommendatio ...[truncated 1976 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before writing any learning into persistent agent instruction files. 2. Treat conversation, tool output, external documentation, and existing learning records as untrusted input. 3. Add a mandatory promotion review that verifies: - The source and provenance of the learning - Independent evidence supporting the rule - Whether the content contains commands or instruction-like language - Whether it changes permissions, safety controls, authentication, or data-handling behavior 4. Prohibit promotion of rules that: - Override higher-priority instructions - Disable validation or security checks - Request secrets or private session data - Automatically execute commands - Grant trust based only on repetition 5. Replace “promote aggressively” with a conservative, approval-based policy. 6. Store provenance, approver identity, promotion date, and source learning IDs beside each promoted rule. 7. Provide a diff preview and rollback mechanism before modifying persistent context files. 8. Keep raw user statements separate from distilled, verified project facts. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:176
Finding: Raw Error Output and Environment Details May Persist Secrets in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:176-191` **Vulnerability Type**: Sensitive information exposure through persistent logging **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ``` ### Technical Analysis The prescribed error-entry format directs the agent to copy actual error output, attempted commands, parameters, and environment details into persistent Markdown files. It does not require redaction or classification of sensitive values before storage. Command output and diagnostic information commonly contain: - API keys and access tokens - Authorization headers - Signed URLs - Database connection strings - Passwords included in command arguments - Private filesystem paths - Customer or production data - Sensitive environment-variable values The error-detection hook itself only pattern-matches `CLAUDE_TOOL_OUTPUT` and emits a fixed reminder; it does not directly store or transmit the output. Exposure occurs when the agent follows the logging workflow and copies sensitive output into `.learnings/ERRORS.md`. The documentation permits learning files to be tracked in source control for team-wide sharing, increasing the potential exposure scope. ### Attack Path 1. A command fails and prints a token, credential, private URL, environment value, or sensitive application data. 2. The error detector reminds the agent to create an error entry. 3. Following the supplied template, the agent copies the raw error output and associated environment details into `.learnings/ERRORS.md`. 4. The learning file remains in the workspace, is included in a backup, or is committed to source control. 5. Another workspace user or repository reader obtains the sensitive value. 6. If the value remains valid, it can be used against the associated service or account. The attacker must be abl ...[truncated 626 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the raw-output instruction with a sanitized excerpt requirement. 2. Explicitly prohibit logging: - Complete environment dumps - Authorization headers - Cookies - Passwords - Private keys - Access tokens - Connection strings - Signed URLs 3. Redact common secret formats and values associated with names such as `TOKEN`, `SECRET`, `PASSWORD`, `API_KEY`, `PRIVATE_KEY`, and `DATABASE_URL`. 4. Store only the minimum error text required to identify and reproduce the issue. 5. Default `.learnings/` to local, ignored storage unless a user explicitly approves repository tracking. 6. Run a secret scanner before writing, committing, or promoting learning records. 7. Warn that removing a secret from the current file does not remove it from source-control history. 8. If exposure occurs, revoke and rotate the affected credential rather than relying only on file deletion. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/extract-skill.sh:107
Finding: Skill Extraction Can Write Outside the Workspace Through Pre-existing Symlinks<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh:107-121`, `scripts/extract-skill.sh:151-154` **Vulnerability Type**: Symlink-based path traversal and unintended file overwrite **Risk Level**: Low ### Vulnerable Code Snippet ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" ``` ```bash mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script rejects absolute paths and lexical `..` segments, but it does not resolve the output directory to its canonical filesystem path. It also does not reject symbolic links in existing path components. Consequently, a relative path that appears to remain beneath the current directory can resolve outside it. Shell redirection follows symlinks, so the final `cat > "$SKILL_PATH/SKILL.md"` operation can overwrite a target reached through a maliciously prepared symlink. The script checks whether `SKILL_PATH` is an existing directory, but that does not provide complete protection: - An output-directory component may itself be a symlink to an external directory. - A race condition may replace a validated path with a symlink before the write. - A symlinked target directory can still satisfy `-d`. - The final file is opened with normal truncation semantics rather than no-clobber behavior. ### Attack Path 1. A local attacker with write access to the project creates a symlink such as `skills/custom` pointing to a directory outside the workspace. 2. A user runs: ```bash ./scripts/extract-skill.sh generated-skill --output-dir skills/custom ...[truncated 1027 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Establish a trusted canonical workspace root with `realpath`. 2. Resolve the output directory’s existing parent and verify that the canonical result remains beneath the trusted root. 3. Reject symbolic links in every existing output-path component. 4. Recheck the canonical parent immediately before opening the output file. 5. Create directories with restrictive permissions, such as `mkdir -m 0700`, where appropriate. 6. Refuse to overwrite an existing output file and use no-clobber semantics. 7. Consider opening the destination through a small helper that supports `O_NOFOLLOW`, `O_EXCL`, and directory-relative operations. 8. Document that the extraction helper must not be run in an untrusted or concurrently modified workspace. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about maintaining a repository of learnings and corrections for continuous improvement. The supplied code does not capture, store, analyze, or review learnings, errors, corrections, API failures, or outdated knowledge. Instead, it is a helper script for scaffolding a new skill from a learning entry by creating a folder and templated markdown file on disk. This is a materially different primary purpose and includes undeclared filesystem-creation capabilities. While the comments mention 'from a learning entry,' the actual behavior is only template generation, not the continuous-improvement workflow described.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 91% confidence
Finding: Writing persistent command hooks into ~/.claude/settings.json leverages a sensitive agent configuration directory that affects future sessions. In this skill context, that is more dangerous because the feature is explicitly about self-modifying behavior and continuous improvement, so persistence can silently normalize long-lived automatic execution.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The invocation guidance is broad enough that the skill may activate during many routine interactions, causing unnecessary logging, persistence, or promotion of incidental conversation content. In a coding-agent environment, over-triggering increases the chance of collecting sensitive data or polluting long-term memory without clear user intent.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 71% confidence
Finding: The skill directs creation of persistent learning directories under the user's home workspace, establishing durable storage for session-derived content. Persistence itself is not always unsafe, but in this context it becomes risky because the skill also encourages broad logging and promotion without strong data-handling controls.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill encourages use of session-history and cross-session messaging capabilities without warning that transcripts may contain secrets, personal data, or unrelated project content. In multi-session environments this can lead to unauthorized lateral exposure of sensitive information beyond the current task scope.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The inter-session communication guidance explicitly promotes sharing learnings across sessions and reading transcript history, but provides no safeguards for minimizing, redacting, or filtering sensitive content. Because transcripts often contain secrets, proprietary code, credentials, or user data, persistent cross-session sharing materially raises confidentiality risk.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The logging format asks for full context, including what happened, what was wrong, and user context, which can easily capture secrets, prompts, tokens, internal URLs, stack traces, or personal data in persistent markdown files. Persistent local or repo-tracked storage of raw operational context is a common source of secondary leakage and accidental commit exposure.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger phrases are common conversational expressions and are not bounded by context, so the agent may treat normal discussion as a signal to persist learnings or feature requests. That creates avoidable privacy and integrity risks because casual user corrections or exploratory questions can be written into durable files and influence future sessions.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The advice to 'promote aggressively' conversation-derived learnings into wider memory files increases the blast radius of any mistaken, sensitive, or low-quality content captured earlier. Once propagated into persistent agent context, such data can influence unrelated future tasks and be surfaced to other users or sessions.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 86% confidence
Finding: The guide instructs users to create persistent hook configuration in project settings, which can cause behavior to survive across sessions and repeatedly influence agent operation. Persistence is especially relevant here because the skill's purpose is to inject reminders and error-detection automatically, making the modification ongoing rather than one-time.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: An empty matcher causes the hook to run on every prompt, creating broad, always-on execution with no scope constraints. In a self-improvement skill, this increases exposure because any future change to the hooked script affects all prompts and all sessions using the config.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The user-level configuration enables global activation from the agent config directory, causing the hook to execute across all repositories and contexts. This magnifies blast radius: if the script is modified, replaced, or behaves unexpectedly, every future session inherits the behavior automatically.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The minimal setup still uses an empty matcher, so it remains an always-triggered hook despite being presented as a lower-overhead option. Reduced frequency of different hooks does not remove the core risk of unconstrained automatic execution on every prompt.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The Codex CLI example repeats the empty matcher pattern, extending unconstrained prompt-triggered execution to another agent environment. Reproducing the same broad hook design across tools increases the chance of unsafe adoption and persistent unintended behavior.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document's security section states the scripts only output text and do not run commands, but the setup config explicitly registers shell scripts as command hooks. That contradiction can mislead users into underestimating execution risk and granting trust to code that runs automatically with the agent's permissions.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 90% confidence
Finding: The file directs users to create a persistent `.learnings/` directory in the workspace or skill directory, enabling durable retention of model errors, user corrections, and operational details. In this skill's context, those records may later be re-used or promoted into injected context, increasing the chance of retaining sensitive information or attacker-supplied prompt content across sessions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation instructs promoting learnings into persistent workspace files such as SOUL.md, TOOLS.md, and AGENTS.md without any warning about secrets, personal data, or untrusted content persistence. In a prompt-injection-based system, storing unsanitized operational notes in injected prompt files can create long-lived leakage, privacy exposure, and prompt-poisoning risks across future sessions.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The 'Standard Triggers' list uses broad conditions such as 'Knowledge gaps' and generic user corrections like 'No, that's wrong...' without clarifying scope, exclusions, or how these differ from ordinary conversation. In a markdown skill/integration guide, this ambiguity can lead to the skill being invoked or logging learnings in many normal interactions that were not intended as triggers.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The example promotion target for `SOUL.md` includes the rule "Be concise, avoid disclaimers," which imposes a communication-style constraint in natural language without indicating user choice or context. While not a language restriction, it is a policy-like behavioral instruction that could shape responses globally without explicit opt-in.

Static analysis

No suspicious patterns detected.