Security audit

cpskilltest111

Security checks for vulnerabilities and agentic risk

Overview

This self-improvement skill is not clearly malicious, but it needs review because it can persist conversation-derived learnings into future agent instructions and recommends broad automatic hooks and cross-session sharing.

Install only if you are comfortable with agents writing durable learning notes and possibly promoting them into future instruction files. Prefer project-local storage and hooks, avoid global hook configuration, review every promoted entry manually, redact secrets and private user context, and avoid cross-session transcript reads or sends unless explicitly approved for that session.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:23
Finding: Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:23-26, SKILL.md:278-289, SKILL.md:344-359, hooks/openclaw/handler.js:11-24, hooks/openclaw/handler.ts:12-25
Vulnerability Type: Persistent agent memory poisoning
Risk Level: High

Vulnerable Code

SKILL.md:23-26:

markdown
| Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) |

SKILL.md:278-289:

markdown
| `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`

hooks/openclaw/handler.js:11-24:

javascript
After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ...[truncated 2439 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit human approval before any learning is copied into an agent instruction or memory file.

Treat user corrections, command output, external content, and session transcripts as untrusted evidence rather than executable guidance.

Store provenance with every learning, including the originating session, author, source type, and supporting project evidence.

Reject promotions that attempt to alter safety constraints, instruction priority, roles, permissions, authentication behavior, external destinations, or tool-execution policy.

Use an allowlisted schema for promoted rules rather than copying free-form conversational text.

Require corroboration from trusted repository documentation or reviewed code before promoting project facts.

Show a reviewable diff and affected target file before promotion, and require confirmation for the exact proposed text.

Maintain an append-only promotion history with rollback support.

Mark generated learning files as untrusted data in agent instructions so that their contents cannot override higher-priority rules.

Add adversarial tests covering malicious corrections, repeated prompt injection, encoded instructions, and attempts to weaken tool safeguards.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:39
Finding: Manual Installation Uses an Unpinned Mutable Repository Source
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:39-42
Vulnerability Type: Unpinned third-party source installation
Risk Level: Medium

Vulnerable Code

markdown
**Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent

text
### Technical Analysis The documented manual installation procedure clones the current default branch of an external Git repository directly into an OpenClaw Skill directory. It does not pin a reviewed release tag or commit hash and does not verify a signature or checksum. The effective installed content can therefore change after this audit without any change to the installation command. Because the destination is a Skill directory and the project also contains opt-in executable hooks and shell scripts, an upstream compromise could expose new installations to modified instructions or code that was not part of the reviewed artifact. The current audited repository does not contain a malicious remote payload and the command does not execute fetched code immediately. The risk arises from the mutability and lack of integrity verification of the documented supply-chain source. ### Attack Path 1. The upstream repository, maintainer account, or default branch is compromised or maliciously modified. 2. An attacker adds harmful Skill instructions, hook logic, or shell-script behavior to the default branch. 3. A user follows the documented `git clone` installation command. 4. Git retrieves the attacker-modified branch into `~/.openclaw/skills/self-improving-agent`. 5. The Skill is loaded by the agent, or the user follows the documentation to install and enable its hook. 6. The modified instructions or executable components run with the permissions available to the agent process. ### Impact Assessment A successful supply-chain compromise could alter agent instructions or execute code under the account that in ...[truncated 447 chars]
Remediation: View remediation
Remediation Suggestions

Replace the default-branch clone instruction with installation of a specific reviewed release or commit.

Publish a cryptographic checksum for each release artifact and require verification before installation.

Sign release tags or artifacts and document signature verification using a trusted maintainer key.

Prefer an immutable, versioned package artifact over cloning a mutable development branch.

If Git installation remains supported, use a pinned commit and verify that HEAD exactly matches the expected hash.

Instruct users to inspect changes before enabling hooks or executing included scripts.

Separate installation from activation so downloaded hooks are never enabled automatically.

Document a controlled update process that displays and reviews diffs between the installed and proposed versions.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about recording and reviewing learnings from failures, corrections, outdated knowledge, and recurring task improvements. The supplied code does not implement that behavior. Instead, it is a filesystem-oriented scaffolding utility that creates a new skill folder and template markdown file from a skill name. While the template mentions a 'source learning,' the script itself neither captures learnings nor processes errors/corrections or reviews prior learnings. This is a materially different primary purpose and includes undeclared write capabilities to the local workspace.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Writing to ~/.claude/settings.json establishes user-level persistent agent behavior, which is sensitive because it affects all future sessions. In this skill, the configuration is used to register automatic command hooks, so compromise or misuse of that setting can create durable cross-project execution and data exposure paths.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Documenting sessions_send as part of the integration introduces a direct channel for moving information out of the current session context into other sessions. Even though the example is benign, the capability can be used to relay sensitive content or propagate malicious prompts, which fits an exfiltration/lateral-movement pattern in an agent environment.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says to use the skill when a command fails, when the user corrects the agent, when a better approach is discovered, and to review learnings before major tasks. Several of these conditions are subjective or common in normal conversations, and the file does not define clear boundaries or exclusions for when the skill should not activate.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill promotes creating persistent workspace directories under the user's home directory for accumulated learnings and errors. Persistent storage is not inherently unsafe, but in this context it increases long-term retention of potentially sensitive natural-language data and broadens the blast radius if the workspace is later accessed, indexed, or shared.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The cross-session guidance explicitly encourages reading other sessions' transcripts and sending learnings between sessions, which creates a direct pathway for unauthorized disclosure of prior conversation data. In a multi-session or multi-agent environment, this can violate data isolation assumptions and amplify any sensitive information already retained in logs or transcripts.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to append full context, what was wrong, and related file details into persistent markdown logs. That creates a real data retention risk because sensitive user content, proprietary code details, secrets, or internal paths could be stored in plain text and later surfaced to other tools, users, or commits.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Feature request logging directs the agent to persist the requested capability and user context, which can easily capture sensitive business plans, internal requirements, or personal information. Because the storage format is natural-language markdown, leakage can be hard to detect and may spread through version control or later prompt injection into future sessions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Phrases like "Actually, it should be...", "Can you also...", and "Is there a way to..." are common in ordinary chat and are not specific to self-improvement logging. Without stronger context constraints or negative examples, these triggers are likely to over-fire during routine assistance.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 82% confidence
Finding: Project-level .claude/settings.json introduces session-persistent behavior that survives across agent restarts within the repository. In context, that persistence automatically re-enables command hooks, which can be risky if the repo is shared, the scripts change over time, or users forget that automatic execution remains active.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: An empty matcher activates the hook on every prompt, creating an overly broad automatic execution surface. In this skill's context, that means a local script runs for all sessions and all prompts, increasing exposure to prompt-triggered persistence, unintended data capture, or abuse if the script is modified or replaced.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This example combines a global user-level configuration with an empty matcher, causing the hook to execute across all projects and prompts. That expands the blast radius from one repository to the entire user environment, making any compromised or overly permissive script a persistent cross-project execution mechanism.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Although presented as 'minimal,' this setup still executes on every prompt because the matcher is empty. Reducing the number of hooks lowers overhead, but it does not reduce the core risk of broad automatic activation and prompt-wide script execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Codex setup repeats the same broad empty-matcher pattern, enabling automatic execution on every prompt in another agent environment. Recommending this pattern across multiple tools increases the chance of insecure copy-paste adoption and normalizes high-scope hooks without sufficient guardrails.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document states that the hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly registers shell scripts as command hooks. That mismatch can cause users to under-trust the risk boundary and enable executable hooks with the false belief that they are non-executing, which is dangerous because hook commands run automatically in response to prompts or tool events.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: Persistent storage of '.learnings/' is intentional for the feature, but it still creates a session-persistence mechanism that can carry forward poisoned, incorrect, or sensitive data into future runs. In the context of a self-improvement skill, persistence is expected, yet it is still dangerous without containment, review, and lifecycle controls.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.
openclaw hooks enable self-improvement

text
### 3. Create Learning Files Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation instructs creation of persistent learning directories in the workspace or skill path but does not warn that the skill will be modifying durable user-controlled files. That omission increases the risk of silent persistence, accidental storage of sensitive data, and trust boundary confusion about what the agent may write and what later sessions may consume.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly expands a 'self-improvement' skill from recording local learnings into modifying higher-privilege prompt sources such as SOUL.md, TOOLS.md, and AGENTS.md. That creates a persistence and scope-escalation path where transient observations can permanently alter behavior, tool usage, or coordination rules across future sessions without strong review boundaries.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented use of sessions_history, sessions_send, and sessions_spawn gives the skill access to cross-session transcripts and communication channels that are broader than its stated purpose of capturing corrections and learnings. In practice, this can expose unrelated session data, enable lateral propagation of tainted instructions, and increase the blast radius of prompt injection or sensitive data leakage.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Using a generic trigger like 'Knowledge gaps' gives the skill an open-ended reason to activate and potentially write persistent state. Because 'knowledge gap' is subjective and common, the trigger can be abused or overfire, causing unreviewed memory writes, prompt pollution, or reinforcement of incorrect conclusions.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Tp4

Agent Config Directory Access

Option 2: User-Level Configuration

Exfiltration Commands

sessions_send

Vague Triggers

Session Persistence

Ssd 3

Ssd 3

Ssd 3

Vague Triggers

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Vague Triggers

Vague Triggers

Intent-Code Divergence

Session Persistence

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

Vague Triggers