T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:390- Finding
Untrusted Session Content Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Cpppselfimprovingagent123123
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed self-improvement logger, but it encourages persistent agent-memory changes, broad automatic logging, and cross-session sharing without enough privacy or approval boundaries.
Install only if you want an agent to keep persistent learning notes and potentially update future agent instructions. Prefer project-local setup, avoid user-level/global hooks, require review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, and redact secrets, credentials, private user context, raw command output, and transcript content before logging or sharing across sessions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about recording and reviewing learnings from failures, corrections, missing capabilities, and similar continuous-improvement events. The supplied code does not capture, store, analyze, or review learnings. Instead, it is a helper script for creating a new skill scaffold on the filesystem, including a SKILL.md template and next-step instructions. While the comments mention extracting a skill from a learning entry, the implemented behavior is still skill scaffolding, not a learning-capture mechanism. This is a materially different primary purpose, so it should be flagged as a mismatch.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The inter-session guidance explicitly allows reading other session transcripts and sending learnings across sessions, but it provides no authorization, scope, or privacy boundaries. That creates a direct risk of cross-session data leakage, where sensitive information from one context can be accessed or propagated into another without need-to-know controls.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The logging templates instruct storing full context, error output, user context, inputs, and parameters, which commonly contain secrets, internal paths, credentials, API responses, and personal data. Persisting such material in markdown files creates an easy-to-overlook plaintext data store that can later be indexed, committed, shared, or reused by other agents.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Writing to ~/.claude/settings.json affects the agent's global configuration directory, which can create persistent behavior across all future sessions. In this context, the documented change installs a command-executing hook at user scope, so compromise or misuse of the referenced scripts would have a broad and durable impact beyond a single repository.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
The example sessions_send command demonstrates sending content to another session, which is an exfiltration-capable primitive even if framed as benign coordination. In the context of an auto-learning skill, this can be leveraged to transfer sensitive prompts, tool outputs, or learned data outside the originating session without adequate need or review.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill recommends invoking itself in many common situations, which can cause over-triggering during normal conversations and routine tool use. In this context, overbroad activation matters because the skill persists information to disk and may promote it into longer-lived memory files, increasing the chance of unnecessary retention of sensitive or irrelevant user data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill encourages storing corrections, requests, and workflow details in persistent files and promoting them into shared memory/instruction locations. Without data classification, minimization, or consent controls, this creates a natural-language exfiltration and retention path for secrets, personal data, and confidential project information.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill promotes aggressive transfer of learnings into durable instruction files that may be loaded automatically in future sessions. This amplifies any earlier over-collection mistake by embedding sensitive or context-specific details into long-lived prompts and shared workspace memory, increasing persistence and blast radius.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The listed trigger phrases such as common corrections and feature questions are broad enough to match benign conversation frequently. Because the skill then instructs logging and promotion of these interactions, the loose triggers create a realistic privacy and data-minimization risk by turning normal chat content into durable records.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
The guide instructs users to add persistent hook configuration in .claude/settings.json, causing the behavior to survive across sessions rather than being limited to a one-time run. Persistence is especially relevant here because the skill is designed to capture learnings and trigger automatically, so any unsafe logic or overbroad scope continues silently until removed.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
An empty matcher causes the hook to fire on every prompt, which broadens execution scope to all sessions and inputs rather than limiting activation to relevant troubleshooting or learning scenarios. In this skill context, that means automatic command execution is attached globally to user interaction, increasing the attack surface and chance of unintended persistence or prompt-triggered behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-level configuration installs the hook globally in ~/.claude/settings.json without meaningful trigger constraints, extending automatic command execution across unrelated projects and sessions. Because this is a self-improvement skill designed to persist and review learnings, global unconstrained activation makes accidental overcollection and misuse more likely than in a narrowly scoped project-local setup.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Codex example also uses an empty matcher, so the same overbroad trigger problem applies: the hook runs for every prompt instead of specific failure or learning events. In agent tooling, broad automatic hooks are risky because they normalize frequent command execution and can expose more session content or metadata than necessary.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document claims the hook scripts 'only output text' and 'don't modify files or run commands,' but the setup explicitly configures those scripts to execute as hook commands and separately documents invoking another script via bash. This creates a misleading security model: users may grant trust or broader deployment based on inaccurate assurances, increasing the chance of unintended code execution from the skill's script set.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
Persisting learnings in a workspace or skill directory creates durable state that survives resets and can influence future sessions, which is risky for a system handling untrusted inputs. While persistence is central to the feature, storing these artifacts in locations tied to injected workspace context increases the chance of contaminated memory becoming operational guidance.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The integration guide expands a narrowly scoped self-improvement skill into modifying AGENTS.md, SOUL.md, TOOLS.md, and memory structures that influence future model behavior. This creates a persistence and prompt-scope expansion path where transient observations can become durable instruction changes, increasing the risk of prompt injection, policy drift, or unintended behavioral tampering across sessions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented use of sessions_history, sessions_send, and sessions_spawn introduces cross-session data access and propagation capabilities beyond the stated purpose of recording learnings. If abused, sensitive context from one session could be read, relayed, or amplified into other sessions, creating a clear lateral movement and data leakage pathway.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The trigger guidance uses broad natural-language conditions such as user corrections, command failures, API errors, and knowledge gaps, which can cause the skill to activate in many ordinary situations. Overly permissive activation increases the chance that untrusted or low-quality inputs are recorded and later reused, enabling persistence of bad instructions or noisy behavioral changes.
- Content
Static analysis
No suspicious patterns detected.