Andara Self Improvement

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:16 AM UTC
• Version: 1.0.0

Overview

The skill is not visibly malicious, but it asks agents to persist conversation-derived learnings into future agent instructions and optional always-on hooks without strong review or redaction controls.

Install only if you want persistent self-improvement memory. Keep `.learnings/` local or reviewed before committing, do not log tokens, credentials, private URLs, raw transcripts, or full environment dumps, and require a human diff review before promoting anything into `CLAUDE.md`, `AGENTS.md`, Copilot instructions, `SOUL.md`, or `TOOLS.md`. Prefer project-scoped hooks with narrow matchers, avoid global `~/.claude` hooks unless you trust and audit the scripts, and periodically clean old learning records.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:348

Finding

Untrusted Learnings Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The Skill treats user corrections and conversation-derived observations as candidates for storage in `.learnings/`. It subsequently permits those records to be promoted into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. These destination files are persistent agent-context or instruction files. Their contents can influence behavior in future sessions, potentially with greater authority than the original user message. The promotion criteria consider recurrence and general applicability, but they do not require: - Explicit human approval - Trusted provenance - Security review - Removal of embedded instructions - Rejection of attempts to alter safety controls - Verification that repeated observations originated from independent trusted sources The recommendatio ...[truncated 1976 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:176

Finding

Raw Error Output and Environment Details May Persist Secrets in Plaintext

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/extract-skill.sh:107

Finding

Skill Extraction Can Write Outside the Workspace Through Pre-existing Symlinks

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script rejects absolute paths and lexical `..` segments, but it does not resolve the output directory to its canonical filesystem path. It also does not reject symbolic links in existing path components. Consequently, a relative path that appears to remain beneath the current directory can resolve outside it. Shell redirection follows symlinks, so the final `cat > "$SKILL_PATH/SKILL.md"` operation can overwrite a target reached through a maliciously prepared symlink. The script checks whether `SKILL_PATH` is an existing directory, but that does not provide complete protection: - An output-directory component may itself be a symlink to an external directory. - A race condition may replace a validated path with a symlink before the write. - A symlinked target directory can still satisfy `-d`. - The final file is opened with normal truncation semantics rather than no-clobber behavior. ### Attack Path 1. A local attacker with write access to the project creates a symlink such as `skills/custom` pointing to a directory outside the workspace. 2. A user runs: ```bash ./scripts/extract-skill.sh generated-skill --output-dir skills/custom ...[truncated 1027 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about maintaining a repository of learnings and corrections for continuous improvement. The supplied code does not capture, store, analyze, or review learnings, errors, corrections, API failures, or outdated knowledge. Instead, it is a helper script for scaffolding a new skill from a learning entry by creating a folder and templated markdown file on disk. This is a materially different primary purpose and includes undeclared filesystem-creation capabilities. While the comments mention 'from a learning entry,' the actual behavior is only template generation, not the continuous-improvement workflow described.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 91% confidence

Finding

Writing persistent command hooks into ~/.claude/settings.json leverages a sensitive agent configuration directory that affects future sessions. In this skill context, that is more dangerous because the feature is explicitly about self-modifying behavior and continuous improvement, so persistence can silently normalize long-lived automatic execution.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The invocation guidance is broad enough that the skill may activate during many routine interactions, causing unnecessary logging, persistence, or promotion of incidental conversation content. In a coding-agent environment, over-triggering increases the chance of collecting sensitive data or polluting long-term memory without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 71% confidence

Finding

The skill directs creation of persistent learning directories under the user's home workspace, establishing durable storage for session-derived content. Persistence itself is not always unsafe, but in this context it becomes risky because the skill also encourages broad logging and promotion without strong data-handling controls.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages use of session-history and cross-session messaging capabilities without warning that transcripts may contain secrets, personal data, or unrelated project content. In multi-session environments this can lead to unauthorized lateral exposure of sensitive information beyond the current task scope.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The inter-session communication guidance explicitly promotes sharing learnings across sessions and reading transcript history, but provides no safeguards for minimizing, redacting, or filtering sensitive content. Because transcripts often contain secrets, proprietary code, credentials, or user data, persistent cross-session sharing materially raises confidentiality risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The logging format asks for full context, including what happened, what was wrong, and user context, which can easily capture secrets, prompts, tokens, internal URLs, stack traces, or personal data in persistent markdown files. Persistent local or repo-tracked storage of raw operational context is a common source of secondary leakage and accidental commit exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are common conversational expressions and are not bounded by context, so the agent may treat normal discussion as a signal to persist learnings or feature requests. That creates avoidable privacy and integrity risks because casual user corrections or exploratory questions can be written into durable files and influence future sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The advice to 'promote aggressively' conversation-derived learnings into wider memory files increases the blast radius of any mistaken, sensitive, or low-quality content captured earlier. Once propagated into persistent agent context, such data can influence unrelated future tasks and be surfaced to other users or sessions.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The guide instructs users to create persistent hook configuration in project settings, which can cause behavior to survive across sessions and repeatedly influence agent operation. Persistence is especially relevant here because the skill's purpose is to inject reminders and error-detection automatically, making the modification ongoing rather than one-time.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

An empty matcher causes the hook to run on every prompt, creating broad, always-on execution with no scope constraints. In a self-improvement skill, this increases exposure because any future change to the hooked script affects all prompts and all sessions using the config.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-level configuration enables global activation from the agent config directory, causing the hook to execute across all repositories and contexts. This magnifies blast radius: if the script is modified, replaced, or behaves unexpectedly, every future session inherits the behavior automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The minimal setup still uses an empty matcher, so it remains an always-triggered hook despite being presented as a lower-overhead option. Reduced frequency of different hooks does not remove the core risk of unconstrained automatic execution on every prompt.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Codex CLI example repeats the empty matcher pattern, extending unconstrained prompt-triggered execution to another agent environment. Reproducing the same broad hook design across tools increases the chance of unsafe adoption and persistent unintended behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document's security section states the scripts only output text and do not run commands, but the setup config explicitly registers shell scripts as command hooks. That contradiction can mislead users into underestimating execution risk and granting trust to code that runs automatically with the agent's permissions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The file directs users to create a persistent .learnings/ directory in the workspace or skill directory, enabling durable retention of model errors, user corrections, and operational details. In this skill's context, those records may later be re-used or promoted into injected context, increasing the chance of retaining sensitive information or attacker-supplied prompt content across sessions.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs promoting learnings into persistent workspace files such as SOUL.md, TOOLS.md, and AGENTS.md without any warning about secrets, personal data, or untrusted content persistence. In a prompt-injection-based system, storing unsanitized operational notes in injected prompt files can create long-lived leakage, privacy exposure, and prompt-poisoning risks across future sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The 'Standard Triggers' list uses broad conditions such as 'Knowledge gaps' and generic user corrections like 'No, that's wrong...' without clarifying scope, exclusions, or how these differ from ordinary conversation. In a markdown skill/integration guide, this ambiguity can lead to the skill being invoked or logging learnings in many normal interactions that were not intended as triggers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The example promotion target for SOUL.md includes the rule "Be concise, avoid disclaimers," which imposes a communication-style constraint in natural language without indicating user choice or context. While not a language restriction, it is a policy-like behavioral instruction that could shape responses globally without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.