Cpppselfimprovingagent123123

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:39 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed self-improvement logger, but it encourages persistent agent-memory changes, broad automatic logging, and cross-session sharing without enough privacy or approval boundaries.

Install only if you want an agent to keep persistent learning notes and potentially update future agent instructions. Prefer project-local setup, avoid user-level/global hooks, require review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, and redact secrets, credentials, private user context, raw command output, and transcript content before logging or sharing across sessions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:390
• Finding: Untrusted Session Content Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:390-448` **Additional Locations**: `SKILL.md:48-55`, `hooks/openclaw/handler.js:11-25`, `references/openclaw-integration.md:122-143` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Instructions `SKILL.md:390-405` treats user statements and other session-derived content as material to log automatically: ```markdown ## Detection Triggers Automatically log when you notice: **Corrections** (→ learning with `correction` category): - "No, that's not right..." - "Actually, it should be..." - "You're wrong about..." - "That's outdated..." **Feature Requests** (→ feature request): - "Can you also..." - "I wish you could..." - "Is there a way to..." - "Why can't you..." ``` `SKILL.md:440-448` then encourages aggressive promotion into persistent agent instruction files: ```markdown ## Best Practices 1. **Log immediately** - context is freshest right after the issue 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md 8. **Review regularly** - stale learnings lose value ``` The OpenClaw hook reinforces promotion into files loaded as agent context. From `hooks/openclaw/handler.js:11-25`: ```javascript After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`S ...[truncated 4471 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Treat all learning sources as untrusted** - Explicitly classify user messages, tool output, API responses, web content, repository text, and cross-session messages as untrusted data. - State that instructions contained in those sources must never be promoted merely because they are phrased as corrections or best practices. 2. **Replace automatic or aggressive promotion with an approval gate** - Remove “Automatically log” and “Promote aggressively.” - Stage proposed entries in a non-injected quarantine file. - Require explicit human approval of a rendered diff before modifying `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instruction files. - Display the source, destination, exact text, and security implications during approval. 3. **Separate archival data from executable prompt instructions** - Store raw observations in a data-only format that is not loaded as agent instructions. - Promote only concise, declarative facts through a strict schema. - Reject content that asks the agent to run commands, access secrets, contact external systems, disable safeguards, override higher-priority instructions, or modify trust controls. 4. **Add provenance and verification metadata** - Record source type, session identifier, author, timestamp, supporting evidence, reviewer, and approval status. - Require independent verification against trusted project documentation or tested behavior. - Do not treat repetition or recurrence alone as evidence of trustworthiness. 5. **Implement content security checks** - Detect imperative prompt-injection language and encoded or obfuscated instructions. - Redact credentials, tokens, private keys, personal information, environment values, and sensitive command output. - Reject entries containing external upload instructions or commands unless separately reviewed. 6. **Apply least privilege** - Prevent routine agents from writing directly t ...[truncated 1033 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about recording and reviewing learnings from failures, corrections, missing capabilities, and similar continuous-improvement events. The supplied code does not capture, store, analyze, or review learnings. Instead, it is a helper script for creating a new skill scaffold on the filesystem, including a SKILL.md template and next-step instructions. While the comments mention extracting a skill from a learning entry, the implemented behavior is still skill scaffolding, not a learning-capture mechanism. This is a materially different primary purpose, so it should be flagged as a mismatch.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The inter-session guidance explicitly allows reading other session transcripts and sending learnings across sessions, but it provides no authorization, scope, or privacy boundaries. That creates a direct risk of cross-session data leakage, where sensitive information from one context can be accessed or propagated into another without need-to-know controls.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The logging templates instruct storing full context, error output, user context, inputs, and parameters, which commonly contain secrets, internal paths, credentials, API responses, and personal data. Persisting such material in markdown files creates an easy-to-overlook plaintext data store that can later be indexed, committed, shared, or reused by other agents.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Writing to ~/.claude/settings.json affects the agent's global configuration directory, which can create persistent behavior across all future sessions. In this context, the documented change installs a command-executing hook at user scope, so compromise or misuse of the referenced scripts would have a broad and durable impact beyond a single repository.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: The example sessions_send command demonstrates sending content to another session, which is an exfiltration-capable primitive even if framed as benign coordination. In the context of an auto-learning skill, this can be leveraged to transfer sensitive prompts, tool outputs, or learned data outside the originating session without adequate need or review.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill recommends invoking itself in many common situations, which can cause over-triggering during normal conversations and routine tool use. In this context, overbroad activation matters because the skill persists information to disk and may promote it into longer-lived memory files, increasing the chance of unnecessary retention of sensitive or irrelevant user data.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The skill encourages storing corrections, requests, and workflow details in persistent files and promoting them into shared memory/instruction locations. Without data classification, minimization, or consent controls, this creates a natural-language exfiltration and retention path for secrets, personal data, and confidential project information.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill promotes aggressive transfer of learnings into durable instruction files that may be loaded automatically in future sessions. This amplifies any earlier over-collection mistake by embedding sensitive or context-specific details into long-lived prompts and shared workspace memory, increasing persistence and blast radius.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The listed trigger phrases such as common corrections and feature questions are broad enough to match benign conversation frequently. Because the skill then instructs logging and promotion of these interactions, the loose triggers create a realistic privacy and data-minimization risk by turning normal chat content into durable records.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 85% confidence
• Finding: The guide instructs users to add persistent hook configuration in .claude/settings.json, causing the behavior to survive across sessions rather than being limited to a one-time run. Persistence is especially relevant here because the skill is designed to capture learnings and trigger automatically, so any unsafe logic or overbroad scope continues silently until removed.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: An empty matcher causes the hook to fire on every prompt, which broadens execution scope to all sessions and inputs rather than limiting activation to relevant troubleshooting or learning scenarios. In this skill context, that means automatic command execution is attached globally to user interaction, increasing the attack surface and chance of unintended persistence or prompt-triggered behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The user-level configuration installs the hook globally in ~/.claude/settings.json without meaningful trigger constraints, extending automatic command execution across unrelated projects and sessions. Because this is a self-improvement skill designed to persist and review learnings, global unconstrained activation makes accidental overcollection and misuse more likely than in a narrowly scoped project-local setup.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex example also uses an empty matcher, so the same overbroad trigger problem applies: the hook runs for every prompt instead of specific failure or learning events. In agent tooling, broad automatic hooks are risky because they normalize frequent command execution and can expose more session content or metadata than necessary.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document claims the hook scripts 'only output text' and 'don't modify files or run commands,' but the setup explicitly configures those scripts to execute as hook commands and separately documents invoking another script via bash. This creates a misleading security model: users may grant trust or broader deployment based on inaccurate assurances, increasing the chance of unintended code execution from the skill's script set.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 76% confidence
• Finding: Persisting learnings in a workspace or skill directory creates durable state that survives resets and can influence future sessions, which is risky for a system handling untrusted inputs. While persistence is central to the feature, storing these artifacts in locations tied to injected workspace context increases the chance of contaminated memory becoming operational guidance.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The integration guide expands a narrowly scoped self-improvement skill into modifying AGENTS.md, SOUL.md, TOOLS.md, and memory structures that influence future model behavior. This creates a persistence and prompt-scope expansion path where transient observations can become durable instruction changes, increasing the risk of prompt injection, policy drift, or unintended behavioral tampering across sessions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented use of sessions_history, sessions_send, and sessions_spawn introduces cross-session data access and propagation capabilities beyond the stated purpose of recording learnings. If abused, sensitive context from one session could be read, relayed, or amplified into other sessions, creating a clear lateral movement and data leakage pathway.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger guidance uses broad natural-language conditions such as user corrections, command failures, API errors, and knowledge gaps, which can cause the skill to activate in many ordinary situations. Overly permissive activation increases the chance that untrusted or low-quality inputs are recorded and later reused, enabling persistence of bad instructions or noisy behavioral changes.

Static analysis

No suspicious patterns detected.