Security audit

cpppp

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed self-improvement logger, but it asks agents to persist broad conversational and error context into future agent memory without enough review or privacy controls.

Install only if you want persistent learning files and future-session reminders. Keep .learnings local by default, redact secrets and personal or customer data before logging, avoid storing raw command output, and require human review before promoting any learning into AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or copilot instructions. Be especially careful with global hook setup and empty matchers that run on every prompt.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:330
Finding: Untrusted Learning Content Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:330-365`, `SKILL.md:397-448`, `references/openclaw-integration.md:125-144` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code and Instructions `SKILL.md:330-365`: ```markdown ### Ingestion Workflow 1. Read `simplify_and_harden.learning_loop.candidates` from the task summary. 2. For each candidate, use `pattern_key` as the stable dedupe key. 3. Search `.learnings/LEARNINGS.md` for an existing entry with that key: - `grep -n "Pattern-Key: <pattern_key>" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` `SKILL.md:397-448`: ```markdown ## Detection Triggers Automatically log when you notice: **Corrections** (→ learning with `correction` category): - "No, that's not right..." - "Actually, it should be..." - "You're wrong about..." - "That's outdated..." **Feature Requests** (→ feature request): - "Can you also..." - "I wish you could..." - "Is there a way to..." - "Why can't you..." **Knowledge Gaps** (→ learning with `knowledge_gap` category): - User provides information you didn't know - Documentation you referenced is outdated - API behavior differs from your understanding **Errors ...[truncated 4566 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before writing any learned rule into an agent-context or system-prompt file. 2. Classify learning sources by trust level. User messages, external documents, tool output, task summaries, and cross-session messages must be treated as untrusted. 3. Store observations as quoted data rather than executable instructions. Separate factual evidence from proposed behavioral rules. 4. Reject promotion candidates that: - Attempt to override system or safety constraints. - Modify authorization or approval requirements. - Request secret access or disclosure. - Direct the agent to execute commands or contact external systems. - Contain role-changing or instruction-precedence language. 5. Replace the recurrence-only promotion rule with a review workflow requiring: - Verified provenance. - Independent technical validation. - Maintainer approval. - A documented scope and expiration or review date. 6. Use a strict schema and allowlist for promoted rules. Do not copy arbitrary Markdown directly from conversations into instruction files. 7. Record the original source, approving identity, review timestamp, and exact diff for every promotion. 8. Prevent learned content from overriding system instructions, safety policies, least-privilege controls, or tool authorization boundaries. 9. Add tests using malicious corrections and repeated prompt-injection payloads to verify that they cannot enter persistent context automatically. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:163
Finding: Raw Command Output and Context May Persist Secrets in Learning Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:163-199`, `SKILL.md:454-465` **Vulnerability Type**: Insecure storage of potentially sensitive diagnostic data **Risk Level**: Medium ### Vulnerable Code and Instructions `SKILL.md:163-199`: ```markdown ### Error Entry Append to `.learnings/ERRORS.md`: ```markdown ## [ERR-YYYYMMDD-XXX] skill_or_command_name **Logged**: ISO-8601 timestamp **Priority**: high **Status**: pending **Area**: frontend | backend | infra | tests | docs | config ### Summary Brief description of what failed ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ### Suggested Fix If identifiable, what might resolve this ### Metadata - Reproducible: yes | no | unknown - Related Files: path/to/file.ext - See Also: ERR-20250110-001 (if recurring) --- ``` ``` `SKILL.md:454-465`: ```markdown ## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/ ``` **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` ### Technical Analysis The error-entry format explicitly asks the agent to retain the actual error output, command or operation, input parameters, and relevant environment details. These data sources frequently contain: - API tokens and authorization headers. - Passwords or connection strings. - Signed URLs and session identifiers. - Private filesystem paths and usernames. - Customer or personal data. - Environment-variable values. - Internal hostnames and infrastructure details. The Skill provides no mandatory redaction process, sensitive-field denylist, output-length limit, or secret scan before writing. It also documents an option to track `.learnings/` in version control, which can distribute sensitive entries and preserve them in repository history. The `error-detector.sh` hook itself only performs keyword detection and does not ...[truncated 1505 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Make `.learnings/` ignored by version control by default. Require an explicit, documented decision before sharing learning records. 2. Add a mandatory sanitization step before storage. Remove or replace: - Passwords and access tokens. - API keys and private keys. - Cookies and authorization headers. - Database connection strings. - Signed URLs and session identifiers. - Personal or customer data. - Raw environment-variable dumps. 3. Replace “Actual error message or output” with “Minimal redacted diagnostic excerpt.” 4. Prohibit storage of complete command output, complete request or response bodies, and unrestricted environment details. 5. Record parameter names and safe summaries rather than raw parameter values. 6. Add automated secret scanning before files are saved or committed, using repository-native secret protection or a dedicated scanner. 7. Apply restrictive filesystem permissions to local learning files when they may contain internal operational information. 8. Define retention and deletion rules so obsolete diagnostic records do not persist indefinitely. 9. If a secret is committed, revoke or rotate it immediately and remove it from repository history; deleting it only from the latest revision is insufficient. 10. Add examples demonstrating correct redaction so future agents do not interpret the template as permission to retain sensitive values. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about maintaining a repository of learnings from failures, corrections, outdated knowledge, and better approaches. The supplied code does not implement any learning capture or review workflow. Instead, it is a helper utility that creates a new skill folder and templated SKILL.md file from a skill name. Its primary purpose is skill extraction/scaffolding, not recording or surfacing learnings. The file-writing behavior is also absent from the declared permissions, and the operational triggers in the description do not match this script’s CLI-based scaffold generation use case.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Referencing ~/.claude/settings.json directs users to modify a sensitive agent configuration location that affects all future sessions. That is not inherently malicious, but in security terms it creates privileged persistence for hook execution and can normalize changes to a high-value config surface.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation criteria are extremely broad and can cause the skill to trigger during ordinary conversation, increasing the chance that benign interactions are written to persistent logs. In a coding-agent environment, over-triggering materially raises privacy and data-retention risk because corrections, failures, and context may be captured without deliberate user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill encourages logging user corrections, errors, and contextual details to persistent files but does not prominently warn users that their data may be stored and later reused. This undermines informed consent and can lead to retention of sensitive information that users did not expect to persist.

Ssd 3

Medium

Confidence: 96% confidence
Finding: These instructions promote persistent retention and onward propagation of user-provided corrections, requests, and workflow details into long-term context files without privacy boundaries, minimization, or consent checks. In practice, this can cause sensitive business context, internal procedures, or personal data to spread into durable memory artifacts that influence future sessions.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 83% confidence
Finding: The skill directs creation of persistent workspace storage under ~/.openclaw/workspace/.learnings, which establishes session-to-session retention by design. Persistence is not inherently malicious, but in this context it becomes risky because the stored content includes operational context and user-derived data without sufficient privacy safeguards.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Allowing agents to read other sessions' transcripts and send learnings across sessions creates a direct semantic exfiltration channel for sensitive conversation content. Even without raw credential theft, cross-session sharing can leak proprietary prompts, user corrections, incident details, and internal context into unrelated agent workflows.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The templates explicitly ask for full context, inputs, parameters, error output, and user context, which are common locations for secrets, credentials, personal data, and proprietary material. Persisting this verbatim in markdown files creates a durable leakage surface that may later be indexed, committed, synced, or reused by other tools.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger phrases overlap with common natural-language feedback such as 'Actually...' or 'Can you also...', so the skill may interpret routine dialogue as authorization to persist data. That makes accidental collection more likely and can silently convert ordinary chat into durable memory entries.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 82% confidence
Finding: Creating .claude/settings.json in the project root establishes persistent behavior that survives across sessions and can affect anyone using that repository. In this skill context, persistent auto-triggered hooks are more dangerous because they can silently reintroduce execution behavior after the initial setup is forgotten.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Using an empty matcher causes the hook to fire on every prompt, creating a broad and persistent execution trigger for a local shell script. In this skill context, that increases the attack surface because any compromise, modification, or misuse of the hook script will execute continuously across normal usage rather than only in narrowly defined scenarios.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The user-level configuration installs the hook in ~/.claude/settings.json, making automatic execution broad in scope and persistent across projects and sessions. In the context of a self-improvement skill that injects reminders and runs local scripts, this magnifies the blast radius of script tampering, unintended behavior, or prompt-context manipulation.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The Codex example also uses an empty matcher, so the script runs on every prompt in that environment as well. Even if the script is currently simple, always-on execution increases exposure to future changes, path hijacking, or abuse through modified local skill files.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The security section understates risk by claiming the scripts only output text and do not run commands, even though they are explicitly configured as command hooks and another section instructs directly executing a shell script. This can mislead users into granting trust and broad deployment to executable hook scripts that run with agent permissions.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 74% confidence
Finding: The guide explicitly instructs users to create persistent .learnings storage in the workspace or skill directory, which can retain errors, corrections, tool output, and other context across sessions. In the context of a self-improvement skill, this increases the chance that sensitive prompts, operational details, or user data are unintentionally stored long-term and later reinjected into future sessions.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The 'Detection Triggers' section uses open-ended conditions like 'Knowledge gaps', 'API errors', and 'Model behavior surprise' without defining clear boundaries for when the skill should act versus ignore normal events. It also does not provide negative examples or constraints, making the trigger scope overly broad for a markdown guidance file.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The stated purpose supports storing learnings, corrections, and related improvement data, but this script permits creating a new skill scaffold in user-chosen relative paths under the current workspace. That generalized repository-writing capability is broader than what is obviously required to capture or review learnings.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest describes a skill focused on recording learnings and reviewing them for continuous improvement. This script goes beyond capture or review by scaffolding entirely new skill directories and SKILL.md files from a learning entry, which is a separate code-generation and repository-modification workflow rather than simple learning capture.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The setup steps include `cp -r` and `mkdir -p` commands that create or modify persistent directories under `~/.openclaw/`, but the document does not explicitly warn users that these actions change their local agent environment. For markdown files, user-facing warnings are expected when actions may affect system integrity or persistent user data.

Static analysis

No suspicious patterns detected.