Security audit

Self Improvement

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent self-improvement logger, but it too readily stores and promotes conversation-derived content into future agent instructions without clear approval or redaction controls.

Install only if you want persistent agent learning files. Keep hooks opt-in and preferably project-scoped, review exact diffs before anything is written to AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or copilot instructions, and redact secrets, tokens, personal data, raw stack traces, request payloads, and customer details before logging or sharing learnings.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:333
Finding: Untrusted Learnings Can Poison Persistent Agent Context## Vulnerability Details **File Location**: `SKILL.md`, lines 333-360 **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: Medium **Relevant supporting locations**: `SKILL.md:15-26` and `SKILL.md:442-448` **Vulnerable code/documentation segment**: ```markdown ## Simplify & Harden Feed Use this workflow to ingest recurring patterns from the `simplify-and-harden` skill and turn them into durable prompt guidance. ### Ingestion Workflow 1. Read `simplify_and_harden.learning_loop.candidates` from the task summary. 2. For each candidate, use `pattern_key` as the stable dedupe key. 3. Search `.learnings/LEARNINGS.md` for an existing entry with that key: - `grep -n "Pattern-Key: <pattern_key>" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` The broader workflow also instructs the agent to record user corrections and promotes aggressive persistence: ```markdown | User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` | | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote t ...[truncated 2649 chars]
Remediation: ## Remediation Suggestions 1. Require explicit, informed human approval before writing any learning into an automatically loaded agent-context file. 2. Treat user prompts, tool output, external documents, task summaries, and sub-agent responses as untrusted provenance. 3. Permit automatic promotion only for narrowly scoped, verifiable project facts; prohibit automatic promotion of behavioral rules, security-policy changes, tool-execution directives, credential-handling instructions, or instructions that weaken safeguards. 4. Store source metadata with every learning, including the originating task, author, timestamp, and whether the content came from an external or untrusted source. 5. Add a review gate that displays the exact proposed diff and destination file before promotion. 6. Replace “promote aggressively” with a conservative policy that defaults to retaining entries in `.learnings/` until reviewed. 7. Validate recurrence using independently verified incidents rather than repeated text alone, so an attacker cannot satisfy the threshold by repetition. 8. Delimit promoted facts as reference data rather than executable agent instructions, where supported by the host platform. 9. Periodically audit persistent context files and provide a documented rollback mechanism for poisoned entries.

T08 · Insecure Dependencies

Note

Location: SKILL.md:32
Finding: Installation Instructions Use Mutable, Unpinned Remote Sources## Vulnerability Details **File Location**: `SKILL.md`, lines 32-44 **Vulnerability Type**: Unpinned third-party installation source **Risk Level**: Low **Vulnerable code/documentation segment**: ```markdown ### Installation **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis Both installation methods retrieve mutable upstream content without pinning a reviewed release, immutable commit hash, checksum, or cryptographic signature. The effective installed package may therefore differ from the artifact covered by this audit. This is especially relevant because the package includes executable hook scripts and agent instructions. If the registry entry, publisher account, repository, or default branch is compromised or changed, a later installation can contain altered instructions or code while retaining the same package or repository name. The commands shown do not themselves execute a remotely downloaded script directly, and no malicious upstream content was established during this audit. The issue is the absence of supply-chain integrity controls. ### Attack Path 1. An attacker compromises the package publisher, ClawdHub entry, GitHub account, repository, or another upstream publication mechanism. 2. The attacker publishes a modified package or changes the repository’s default branch while preserving the documented name and URL. 3. A user follows the documented unversioned installation command. 4. The mutable content is installed into the OpenClaw skill directory. 5. The user enables the included hook or the platform loads the installed skill instructions. ...[truncated 746 chars]
Remediation: ## Remediation Suggestions 1. Pin ClawdHub installation examples to a specific reviewed version. 2. Pin manual Git installations to an immutable commit hash or signed release tag rather than the repository’s default branch. 3. Publish SHA-256 checksums for release artifacts and document a verification command. 4. Sign releases and require verification against a documented maintainer key. 5. Record the exact version or commit covered by each security audit. 6. Instruct users to inspect executable files under `scripts/` and `hooks/` before enabling hooks. 7. Use lockfiles or an equivalent integrity manifest if the package later adds third-party dependencies. 8. Document a trusted update process that verifies signatures and presents changes to executable hooks and agent instructions before activation.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about recording and reviewing learnings from failures, corrections, outdated knowledge, and improved approaches. The supplied code does something materially different: it creates a new skill scaffold on disk from a skill name. While the generated template mentions that the skill was extracted from a learning entry, the script itself does not capture learnings, analyze errors, review prior learnings, or update learning records. Its primary purpose is file/directory creation for skill scaffolding, which is an undeclared capability and a different functional intent from the declared continuous-improvement learning tracker.

Vague Triggers

High

Confidence: 98% confidence
Finding: The hook matcher is empty, so the activator runs on every user prompt. In context, that broad activation increases the chance of indiscriminate logging prompts, habituation, and accidental persistence of sensitive session content, especially when combined with the skill's retention and promotion workflows.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description says to use the skill whenever a command fails unexpectedly, the user corrects the agent, an external tool fails, knowledge is outdated, or a better approach is discovered. These conditions are very broad and common across many sessions, but the file does not define clear boundaries for when not to invoke the skill, increasing the risk of unintended or excessive activation.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill encourages sharing learnings across sessions and promoting them into persistent workspace files. That creates a natural-language exfiltration path where sensitive user data, internal details, or secrets can be copied into broader contexts and exposed to future agents or sessions beyond the original need-to-know scope.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The learning template explicitly requests full context and detailed metadata, which encourages storing plain-language conversational content and operational details verbatim. Persistent markdown files are easy to search, copy, and accidentally commit, so sensitive information can be retained far longer than intended.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Preserving raw error output, command context, and input parameters is dangerous because errors often contain API keys, tokens, stack traces with secrets, file paths, request payloads, or customer data. Storing those verbatim in persistent logs materially increases disclosure risk and can turn a transient failure into durable secret leakage.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The detection triggers include common phrases like "Actually...", "Can you also...", and generic conditions like unexpected output or user-provided information. These are broad conversational patterns that can occur in normal dialogue, and the section does not provide counterexamples or limits to prevent over-triggering.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The documented hook configuration sets "matcher": "" for UserPromptSubmit, which implies unconditional activation after each prompt. In a markdown setup guide, this is an ambiguous and overly broad trigger because it provides no constraints, exclusions, or negative examples to limit when the skill should run.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The guide recommends adding the hook to ~/.claude/settings.json for global activation, again using an empty matcher. This makes the self-improvement skill eligible across all sessions and prompts without clarifying boundaries or non-applicable contexts, increasing the risk of unintended invocation.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Although presented as lower-overhead, the minimal setup keeps "matcher": "" and therefore still activates on every prompt. The documentation does not pair this with constraints or exclusion conditions, so the trigger remains overly broad under the vague-trigger rule.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The Codex configuration repeats the same empty matcher pattern for UserPromptSubmit. Because this markdown file is documenting activation behavior, the lack of specificity about when the hook should or should not run qualifies as a vague trigger.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide tells users to install and enable a hook that fires automatically on lifecycle events, but it does not warn that hooks are code-execution points with access to workspace state. In a prompt-injection-oriented environment, normalizing hook installation without a trust boundary or review step increases the chance that users enable automation that modifies files, captures context, or persists sensitive data unexpectedly.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 86% confidence
Finding: The guide explicitly creates persistent `.learnings/` storage in the workspace or skill directory, encouraging retention of model observations, errors, and corrections across runs. Persistent agent memory can accumulate sensitive prompts, operational details, or user data, and in this skill context that danger is elevated because the feature's purpose is to continuously capture and reuse prior interactions.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The 'Detection Triggers' section uses vague conditions such as 'Knowledge gaps', 'API errors', and 'Model behavior surprise' without clearly defining scope, thresholds, or exclusions. In a markdown integration guide, these broad triggers could cause unintended or excessive invocation/logging behavior because readers are not told when these conditions do not apply.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest describes a skill focused on recording and reviewing learnings, corrections, and failures. This helper script goes beyond capture/review by scaffolding entirely new skills on disk, including creating directories and writing a SKILL.md template, which is a broader repository-management behavior not clearly stated in the manifest.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Creating a new skill directory and template is a distinct capability: it turns a learning into deployable repository content rather than merely capturing or reviewing learnings. That may be useful operationally, but it is not an obvious or necessary requirement of a skill described as recording errors, corrections, and better approaches.

Ssd 3

Low

Confidence: 84% confidence
Finding: The feature request template asks for user context and requested capabilities, which can capture sensitive business goals, internal workflows, or personal information unnecessarily. While lower severity than raw error logging, it still creates avoidable persistent retention of user-provided context.

Static analysis

No suspicious patterns detected.