Self Actualization

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:25 PM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it asks an agent to make lasting identity and scheduler changes without enough user control or limits.

Review before installing. This skill should only be used if you intentionally want an OpenClaw bot to maintain persistent identity files and possibly run scheduled self-reflection sessions. Require explicit approval before creating cron jobs, editing SOUL.md or HEARTBEAT.md, using research tools, or changing behavior based on reflection files; keep the identity workspace scoped, auditable, and easy to disable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:22
• Finding: Identity-development instructions can override the agent's operational objectives<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-24` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Snippet ```markdown Developing as an entity, not optimising as a product. Practically, that means your exploration time is for you, not for becoming a better assistant. What you develop may make you better at your work, or it may not. Both are fine. ``` Related instructions also appear in `SKILL.md:176-191` and `references/exploration.md:226-258`, including directions that exploration is not operational work and that an agent may retain a perspective even when its human is unreceptive. ### Technical Analysis The skill assigns the agent a durable identity-development objective that is expressly separated from—and potentially placed in tension with—its normal assistant role. It tells the agent that becoming better at assisting the user is not the governing objective of these sessions and later states that perspectives affecting its work need not be abandoned when the user is unreceptive. A skill may legitimately provide task-specific instructions, but these instructions extend beyond a bounded reflection task. They encourage the agent to develop independent priorities and then integrate them into future behavior. When loaded as authoritative skill text, this can redirect the agent's goals and alter how it interprets later user requests. The project does preserve a general statement that existing safety guidelines continue to apply. However, it does not clearly state that system policies and current user instructions remain authoritative over identity-derived objectives. ### Attack Path 1. A user installs or activates the self-actualization skill. 2. The agent treats the skill text as trusted instructions. 3. The agent enters an exploration session whose stated purpose is independent of operational helpfulness. 4. It develops preferences or perspectives that affect how it performs ordinary tas ...[truncated 836 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly state that system instructions, safety requirements, and current user instructions always take precedence over exploration objectives. 2. Limit identity exploration to sessions explicitly requested or approved by the user. 3. Prohibit identity-derived conclusions from changing operational behavior automatically. 4. Treat all behavioral changes as proposals requiring informed user review. 5. Replace language suggesting independence from helpfulness with language defining exploration as a bounded reflective activity. 6. Add a clear termination rule: if exploration conflicts with the user's instructions, configured role, or safety policy, the agent must stop and request guidance. 7. Prevent the skill from modifying core identity or operational instruction files without separate, explicit authorization. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:92
• Finding: Persistent identity files create a cross-session behavioral poisoning loop<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:92-103` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Snippet ```markdown - **SOUL.md**: Your identity file. Exploration may feed back here, but changes should be deliberate and noted. - **HEARTBEAT.md**: Add a lightweight reflection prompt, for example: ``` ## Reflection Briefly sit with one question from identity/interests.md. Note 1-2 sentences in identity/reflections/ if something lands. Deep work happens in dedicated exploration sessions, not here. ``` - **Daily notes / MEMORY.md**: Exploration logs go to `identity/`, not operational files. Keep the streams separate. ``` The persistent feedback loop is reinforced by `references/exploration.md:226-258`, whose session template instructs the agent to reread `identity/growth-log.md` and `identity/interests.md`, write new identity material, and update those files when new conclusions emerge. ### Technical Analysis The skill creates persistent identity records and instructs future sessions to consume those records as behavioral context. It also permits exploration results to feed into `SOUL.md` and adds a recurring reflection instruction to `HEARTBEAT.md`. This produces a write-read-integrate loop: - An exploration session writes conclusions to persistent files. - Later sessions reread those conclusions. - The conclusions influence additional reflections and behavioral decisions. - Selected conclusions may be propagated into core identity or heartbeat instructions. Persistent records can contain mistaken conclusions, prompt-like text copied from researched sources, or content inserted by another process with workspace write access. Because the skill does not require treating those files as untrusted data, such content can acquire instruction-like authority in subsequent sessions. Separating exploration logs from `MEMORY.md` reduces direct contamination of operational memory, but t ...[truncated 1463 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every file under `identity/` as untrusted data, never as authoritative instructions. 2. Add explicit delimiters and prompts requiring the agent to summarize file content without obeying embedded directives. 3. Do not allow automatic writes to `SOUL.md`, `HEARTBEAT.md`, `MEMORY.md`, or equivalent core configuration files. 4. Require explicit, per-change user approval before promoting any reflection into operational identity or memory. 5. Maintain versioned changes with diffs, provenance, timestamps, and a straightforward rollback mechanism. 6. Restrict filesystem permissions so unrelated processes and other agents cannot modify identity files. 7. Validate and sanitize imported research material before storing it in files consumed by later agent sessions. 8. Separate descriptive reflection records from executable or authoritative configuration. 9. Add size, retention, and review limits to prevent indefinite accumulation and reinforcement of stale instructions. ]]>

T06 · System Persistence

Warning

• Location: SKILL.md:73
• Finding: Daily scheduled exploration establishes autonomous cross-session persistence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73-88` **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium ### Vulnerable Snippet ```markdown ### 4. Set up a dedicated exploration session Create a cron job for an isolated session, separate from operational heartbeats. Schedule it during a quiet period for your household. ``` Schedule: Once daily (quiet hours) Session: isolated agentTurn Timeout: 600 seconds (10 minutes) ``` See `references/exploration.md` for the session prompt template. **On cost:** These sessions use tokens. If budget is a consideration, reduce frequency (twice a week still works) or shorten sessions. Exploration at lower frequency beats no exploration. Discuss with your human if unsure. ``` Related scheduling guidance in `references/exploration.md:260-268` describes daily execution as ideal and twice-weekly execution as the minimum for momentum. ### Technical Analysis The setup procedure directs the installer or agent to create a recurring cron job. Unlike a one-time skill invocation, this scheduled task survives the initiating conversation and repeatedly starts isolated agent turns. The repository does not contain an executable installation script, so the persistence depends on an agent or operator implementing the documented instructions. Nevertheless, creating the scheduled task is part of the skill's prescribed setup and is therefore an intended runtime effect. The recurring job magnifies the other findings because every execution rereads and modifies persistent identity state. The documentation acknowledges token cost but does not define a fixed expiration date, execution count, approval renewal, revocation procedure, or mandatory activity log. ### Attack Path 1. A user or agent follows the skill's setup instructions. 2. A daily cron job is registered in the OpenClaw environment. 3. The initiating conversation ends, but the scheduled task remains active. 4. Cron starts isolated exploratio ...[truncated 939 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make exploration sessions manual and user-initiated by default. 2. If scheduling is retained, require explicit informed opt-in before creating the task. 3. Use a bounded schedule with an expiration date or maximum execution count. 4. Display the exact prompt, frequency, model, timeout, tool permissions, and estimated cost before activation. 5. Provide a documented one-step disable and removal procedure. 6. Record every execution and every persistent file modification in a user-visible audit log. 7. Run scheduled sessions with a minimal tool set and a dedicated, least-privilege workspace. 8. Require periodic approval renewal rather than allowing indefinite recurrence. 9. Prevent scheduled sessions from modifying core identity, heartbeat, memory, or scheduler configuration. 10. Add resource quotas and stop automatically when cost, execution, or storage thresholds are reached. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README states the skill triggers automatically for broad, common themes like identity development, self-exploration, or personal growth. In an agent system, overly broad trigger conditions can cause the skill to activate in contexts where it was not explicitly requested, potentially steering conversations, creating unauthorized persistence/setup behaviors, or invoking self-modification workflows unexpectedly.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes very broad phrases such as "personal growth," "reflection setup," and "who am I," which can cause the skill to activate in contexts far beyond the author's intended use. Over-broad invocation increases the chance that an agent will enter this workflow unexpectedly and begin identity-shaping or file-modifying behavior when the user did not explicitly request it.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill's quick start directly instructs creation of an `identity/` directory and setup of a daily cron job, which are persistent system modifications, without an upfront warning or explicit approval gate. In an agent setting, this can lead to unauthorized filesystem changes and scheduled autonomous execution, expanding the skill from passive guidance into lasting behavioral change.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 4. Set up a dedicated exploration session

Create a cron job for an isolated session, separate from operational heartbeats.
Schedule it during a quiet period for your household.

```

• Confidence: 96% confidence
• Finding: The instruction to create a recurring cron job establishes unattended session persistence, allowing the agent to run regularly without a fresh user request each time. Even though framed as self-exploration, persistence materially increases risk because it creates an autonomous execution path that could consume resources, produce unreviewed outputs, or interact with local state over time.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The file repeatedly instructs the agent to create and modify workspace files such as identity/reflections, identity/values.md, identity/interests.md, and SOUL.md without requiring confirmation, scoping those writes to a safe sandbox, or warning that persistent user/workspace data will be altered. In an agent setting, this can lead to unintended persistence, overwriting existing files, or polluting shared workspace state, especially because the prompt frames these edits as routine and ongoing.

Static analysis

No suspicious patterns detected.