Self Improving Agent Jarvis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 3.0.11

Overview

This skill is a disclosed self-improvement logger, but it encourages persistent agent-memory changes, broad hooks, and cross-session transcript use without enough privacy or approval controls.

Install only if you want a persistent learning/memory workflow and are prepared to review what gets written. Keep hooks project-scoped, avoid global activation, redact secrets and personal data, require explicit approval before promoting anything into agent prompt files, and do not use cross-session transcript tools unless the session owner and confidentiality boundary are clear.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:346

Finding

Conversation-Derived Content Can Poison Persistent Agent Instructions

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` Related promotion guidance includes: ```markdown | Behavioral patterns | `SOUL.md` | | Workflow improvements | `AGENTS.md` | | Tool gotchas | `TOOLS.md` | ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The Skill accepts user corrections, conversation-derived observations, command failures, and model behavior as learning sources. It then recommends promoting recurring or broadly applicable entries into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. These files are persistent agent-context or prompt files that can be loaded into future sessions. The promotion criteria measure recurrence and task frequency, but do not establish whether the source is trusted. There is no mandatory human approval, provenance validation, security-policy check, or filter preventing a learning from containing imperative instructions. Consequently, attacker-controlled content presented as a correction, best practice, behavioral preference, or recurring lesson can cross the boundary from ...[truncated 1504 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:86

Finding

Output-Directory Validation Can Be Bypassed Through Symbolic Links

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE --- name: $SKILL_NAME description: "[TODO: Add a concise description of what this skill does and when to use it]" --- # $(echo "$SKILL_NAME" | sed 's/-/ /g' | awk '{for(i=1;i<=NF;i++) $i=toupper(substr($i,1,1)) tolower(substr($i,2))}1') [TODO: Brief introduction explaining the skill's purpose] ## Quick Reference | Situation | Action | |-----------|--------| | [Trigger condition] | [What to do] | ## Usage [TODO: Detailed usage instructions] ## Examples [TODO: Add concrete examples] ## Source Learning This skill was extracted from a learning entry. - Learning ID: [TODO: Add original learning ID] - Original File: .learnings/LEARNINGS.md TEMPLATE ``` ### Technical Analysis The script attempts to constrain writes to the current workspace by rejecting absolute paths and lexical `..` path segments. This validation does not resolve the path ...[truncated 1970 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/openclaw-integration.md:159

Finding

Cross-Session Transcript Access Is Recommended Without Consent or Data-Boundary Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about operationally capturing and reviewing learnings, errors, corrections, API/tool failures, and updated knowledge. The supplied code does not implement logging, storing, reviewing, or managing learnings. Instead, it is a helper script for extracting/promoting a learning into a new skill by creating a scaffold on disk. This is a materially different primary purpose. While related at a high level to a learnings workflow, the actual behavior is focused on filesystem-based skill generation, which is an undeclared capability relative to the stated description.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 92% confidence

Finding

Directing users to modify ~/.claude/settings.json establishes persistent control in the agent's configuration directory, which is a sensitive location because entries there affect future sessions. In the context of command hooks, this becomes more dangerous because it creates durable, broad-scope code execution behavior tied to the user's agent environment.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs logging of corrections, errors, and contextual details but provides no privacy boundary, redaction guidance, or prohibition on storing secrets. That creates a realistic risk that prompts, credentials, tokens, personal data, or proprietary context will be persisted in plaintext.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The core workflow normalizes persistent retention of user corrections and session details, creating a data-retention channel in natural language files. Even without malicious intent, such logs can accumulate sensitive information and later be surfaced to other agents or users.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

Creating persistent directories under the user's home/workspace establishes a durable storage location for accumulated session data. By itself this is not malicious, but in combination with the skill's logging behavior it increases retention risk and the chance that sensitive data survives beyond the active session.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inter-session features encourage reading other sessions' transcripts and sending learnings across sessions without privacy restrictions. This can expose unrelated users' or tasks' sensitive conversation data across boundaries, especially in shared or multi-tenant environments.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Reading transcripts from other sessions and sending learnings between sessions semantically enables cross-session disclosure. In practice, this can defeat conversation isolation and leak sensitive operational, personal, or proprietary details beyond the original session context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prescribed logging format explicitly asks for full context, parameters, environment details, and user context in persistent markdown entries. Those fields materially increase the chance of storing secrets, internal paths, tokens, personal data, or business-sensitive details in durable plaintext.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough to activate logging behavior during ordinary conversation, which can cause unintended persistence of user content. In a skill that writes to durable files, over-triggering increases the chance that sensitive or irrelevant information is captured without clear user intent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Encouraging aggressive promotion of learnings into long-lived context files broadens the blast radius of any sensitive information that was logged earlier. Once propagated into agent memory/context files, accidental disclosure becomes more persistent and harder to contain.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manual activation phrases are generic and could prompt the agent to create records or inspect prior learnings in contexts where the user did not intend persistence or retrospective data use. Because the skill is designed to retain information, ambiguous activation expands the risk of accidental data capture and propagation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The provided manifest description says the skill is a 'self-improving AI agent' that 'learns from errors and continuously optimizes code,' which is broader than the stated purpose of capturing learnings, errors, and corrections for future improvement. That wording shifts the skill from a reflection/logging aid into an autonomous code-optimization agent, creating a semantic mismatch with the declared self-improvement support role.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Placing hook configuration in .claude/settings.json creates persistent behavior that survives across the session and can repeatedly trigger command execution. While project-local persistence is less severe than user-level installation, it still increases the chance that future prompts unknowingly invoke the hooks and that collaborators inherit risky behavior if the configuration is shared.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

An empty matcher activates the hook on every prompt, creating an always-on execution path for the script. In this skill's context, that broad trigger increases the exposure of any unsafe behavior in the hooked scripts and can leak more prompt/context-derived data into the hook than necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-level configuration installs the hook globally in ~/.claude/settings.json with an unconstrained matcher, causing automatic execution across all sessions and repositories. This expands blast radius substantially: any bug, data over-collection, or later script modification affects every use of the agent rather than one project.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document states the hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly invokes shell scripts via a command hook. This is a misleading security claim that can cause users to underestimate the execution risk of enabling the hooks, especially because shell scripts can perform arbitrary actions with the agent's permissions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Creating a persistent .learnings directory in the workspace or skill path encourages long-lived retention of model-generated observations, including error traces, user corrections, and potentially sensitive environment details. Because OpenClaw injects workspace content into sessions, stored learnings can survive resets and influence future runs, amplifying accidental disclosure, stale instruction persistence, and prompt-poisoning risks.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Creating a new reusable skill from a learning entry is a broader repository-maintenance capability than the manifest's stated role of capturing learnings, errors, and corrections. While related conceptually, generating filesystem structures for new skills is not an obvious direct requirement of the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill focused on recording learnings and reviewing them for future tasks. This script scaffolds entirely new skill directories and markdown files, which is a development/authoring capability rather than merely capturing or reviewing learnings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description is presented only in Chinese, which can indicate a language-specific experience without any opt-in or explanation that the skill is intended solely for a Chinese-speaking audience. Under the policy, locale or language restrictions should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation explicitly instructs users to persist 'learnings' into workspace and skill directories, but it does not warn that these files may contain sensitive prompts, failures, credentials, internal paths, or user data that can be re-injected into future sessions. In a prompt-injection-oriented system like OpenClaw, persistent notes are part of the model context, so unsafe logging can create durable privacy leakage and secondary prompt-injection risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.