cpskilltest111

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:44 AM UTC
• Version: 1.1.0

Overview

This self-improvement skill is not clearly malicious, but it needs review because it can persist conversation-derived learnings into future agent instructions and recommends broad automatic hooks and cross-session sharing.

Install only if you are comfortable with agents writing durable learning notes and possibly promoting them into future instruction files. Prefer project-local storage and hooks, avoid global hook configuration, review every promoted entry manually, redact secrets and private user context, and avoid cross-session transcript reads or sends unless explicitly approved for that session.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:23
• Finding: Untrusted Learnings Can Be Promoted into Persistent Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:23-26`, `SKILL.md:278-289`, `SKILL.md:344-359`, `hooks/openclaw/handler.js:11-24`, `hooks/openclaw/handler.ts:12-25` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code `SKILL.md:23-26`: ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` `SKILL.md:278-289`: ```markdown | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` `hooks/openclaw/handler.js:11-24`: ```javascript After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ...[truncated 2439 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit human approval before any learning is copied into an agent instruction or memory file. 2. Treat user corrections, command output, external content, and session transcripts as untrusted evidence rather than executable guidance. 3. Store provenance with every learning, including the originating session, author, source type, and supporting project evidence. 4. Reject promotions that attempt to alter safety constraints, instruction priority, roles, permissions, authentication behavior, external destinations, or tool-execution policy. 5. Use an allowlisted schema for promoted rules rather than copying free-form conversational text. 6. Require corroboration from trusted repository documentation or reviewed code before promoting project facts. 7. Show a reviewable diff and affected target file before promotion, and require confirmation for the exact proposed text. 8. Maintain an append-only promotion history with rollback support. 9. Mark generated learning files as untrusted data in agent instructions so that their contents cannot override higher-priority rules. 10. Add adversarial tests covering malicious corrections, repeated prompt injection, encoded instructions, and attempts to weaken tool safeguards.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39
• Finding: Manual Installation Uses an Unpinned Mutable Repository Source## Vulnerability Details **File Location**: `SKILL.md:39-42` **Vulnerability Type**: Unpinned third-party source installation **Risk Level**: Medium ### Vulnerable Code ```markdown **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` ``` ### Technical Analysis The documented manual installation procedure clones the current default branch of an external Git repository directly into an OpenClaw Skill directory. It does not pin a reviewed release tag or commit hash and does not verify a signature or checksum. The effective installed content can therefore change after this audit without any change to the installation command. Because the destination is a Skill directory and the project also contains opt-in executable hooks and shell scripts, an upstream compromise could expose new installations to modified instructions or code that was not part of the reviewed artifact. The current audited repository does not contain a malicious remote payload and the command does not execute fetched code immediately. The risk arises from the mutability and lack of integrity verification of the documented supply-chain source. ### Attack Path 1. The upstream repository, maintainer account, or default branch is compromised or maliciously modified. 2. An attacker adds harmful Skill instructions, hook logic, or shell-script behavior to the default branch. 3. A user follows the documented `git clone` installation command. 4. Git retrieves the attacker-modified branch into `~/.openclaw/skills/self-improving-agent`. 5. The Skill is loaded by the agent, or the user follows the documentation to install and enable its hook. 6. The modified instructions or executable components run with the permissions available to the agent process. ### Impact Assessment A successful supply-chain compromise could alter agent instructions or execute code under the account that in ...[truncated 447 chars]
• Remediation: ## Remediation Suggestions 1. Replace the default-branch clone instruction with installation of a specific reviewed release or commit. 2. Publish a cryptographic checksum for each release artifact and require verification before installation. 3. Sign release tags or artifacts and document signature verification using a trusted maintainer key. 4. Prefer an immutable, versioned package artifact over cloning a mutable development branch. 5. If Git installation remains supported, use a pinned commit and verify that `HEAD` exactly matches the expected hash. 6. Instruct users to inspect changes before enabling hooks or executing included scripts. 7. Separate installation from activation so downloaded hooks are never enabled automatically. 8. Document a controlled update process that displays and reviews diffs between the installed and proposed versions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about recording and reviewing learnings from failures, corrections, outdated knowledge, and recurring task improvements. The supplied code does not implement that behavior. Instead, it is a filesystem-oriented scaffolding utility that creates a new skill folder and template markdown file from a skill name. While the template mentions a 'source learning,' the script itself neither captures learnings nor processes errors/corrections or reviews prior learnings. This is a materially different primary purpose and includes undeclared write capabilities to the local workspace.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Writing to ~/.claude/settings.json establishes user-level persistent agent behavior, which is sensitive because it affects all future sessions. In this skill, the configuration is used to register automatic command hooks, so compromise or misuse of that setting can create durable cross-project execution and data exposure paths.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Documenting sessions_send as part of the integration introduces a direct channel for moving information out of the current session context into other sessions. Even though the example is benign, the capability can be used to relay sensitive content or propagate malicious prompts, which fits an exfiltration/lateral-movement pattern in an agent environment.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description says to use the skill when a command fails, when the user corrects the agent, when a better approach is discovered, and to review learnings before major tasks. Several of these conditions are subjective or common in normal conversations, and the file does not define clear boundaries or exclusions for when the skill should not activate.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 84% confidence
• Finding: The skill promotes creating persistent workspace directories under the user's home directory for accumulated learnings and errors. Persistent storage is not inherently unsafe, but in this context it increases long-term retention of potentially sensitive natural-language data and broadens the blast radius if the workspace is later accessed, indexed, or shared.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The cross-session guidance explicitly encourages reading other sessions' transcripts and sending learnings between sessions, which creates a direct pathway for unauthorized disclosure of prior conversation data. In a multi-session or multi-agent environment, this can violate data isolation assumptions and amplify any sensitive information already retained in logs or transcripts.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to append full context, what was wrong, and related file details into persistent markdown logs. That creates a real data retention risk because sensitive user content, proprietary code details, secrets, or internal paths could be stored in plain text and later surfaced to other tools, users, or commits.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Feature request logging directs the agent to persist the requested capability and user context, which can easily capture sensitive business plans, internal requirements, or personal information. Because the storage format is natural-language markdown, leakage can be hard to detect and may spread through version control or later prompt injection into future sessions.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Phrases like "Actually, it should be...", "Can you also...", and "Is there a way to..." are common in ordinary chat and are not specific to self-improvement logging. Without stronger context constraints or negative examples, these triggers are likely to over-fire during routine assistance.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 82% confidence
• Finding: Project-level .claude/settings.json introduces session-persistent behavior that survives across agent restarts within the repository. In context, that persistence automatically re-enables command hooks, which can be risky if the repo is shared, the scripts change over time, or users forget that automatic execution remains active.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: An empty matcher activates the hook on every prompt, creating an overly broad automatic execution surface. In this skill's context, that means a local script runs for all sessions and all prompts, increasing exposure to prompt-triggered persistence, unintended data capture, or abuse if the script is modified or replaced.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This example combines a global user-level configuration with an empty matcher, causing the hook to execute across all projects and prompts. That expands the blast radius from one repository to the entire user environment, making any compromised or overly permissive script a persistent cross-project execution mechanism.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Although presented as 'minimal,' this setup still executes on every prompt because the matcher is empty. Reducing the number of hooks lowers overhead, but it does not reduce the core risk of broad automatic activation and prompt-wide script execution.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex setup repeats the same broad empty-matcher pattern, enabling automatic execution on every prompt in another agent environment. Recommending this pattern across multiple tools increases the chance of insecure copy-paste adoption and normalizes high-scope hooks without sufficient guardrails.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document states that the hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly registers shell scripts as command hooks. That mismatch can cause users to under-trust the risk boundary and enable executable hooks with the false belief that they are non-executing, which is dangerous because hook commands run automatically in response to prompts or tool events.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 89% confidence
• Finding: Persistent storage of '.learnings/' is intentional for the feature, but it still creates a session-persistence mechanism that can carry forward poisoned, incorrect, or sensitive data into future runs. In the context of a self-improvement skill, persistence is expected, yet it is still dangerous without containment, review, and lifecycle controls.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs creation of persistent learning directories in the workspace or skill path but does not warn that the skill will be modifying durable user-controlled files. That omission increases the risk of silent persistence, accidental storage of sensitive data, and trust boundary confusion about what the agent may write and what later sessions may consume.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The guide explicitly expands a 'self-improvement' skill from recording local learnings into modifying higher-privilege prompt sources such as SOUL.md, TOOLS.md, and AGENTS.md. That creates a persistence and scope-escalation path where transient observations can permanently alter behavior, tool usage, or coordination rules across future sessions without strong review boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documented use of sessions_history, sessions_send, and sessions_spawn gives the skill access to cross-session transcripts and communication channels that are broader than its stated purpose of capturing corrections and learnings. In practice, this can expose unrelated session data, enable lateral propagation of tainted instructions, and increase the blast radius of prompt injection or sensitive data leakage.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Using a generic trigger like 'Knowledge gaps' gives the skill an open-ended reason to activate and potentially write persistent state. Because 'knowledge gap' is subjective and common, the trigger can be abused or overfire, causing unreviewed memory writes, prompt pollution, or reinforcement of incorrect conclusions.

Static analysis

No suspicious patterns detected.