cpskilltest222

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:45 AM UTC
• Version: 1.1.0

Overview

The skill is coherent as a self-improvement logger, but it asks agents to persist conversation-derived details into long-lived instruction files with broad automatic hooks and limited privacy guardrails.

Install only if you are comfortable with persistent learning logs and hook reminders. Keep .learnings local by default, redact secrets and personal or customer data, avoid copying raw error output or full transcripts, review every promotion into CLAUDE.md/AGENTS.md/SOUL.md/TOOLS.md, and prefer project-scoped hooks with narrow matchers over global always-on settings.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:262
• Finding: Untrusted conversational content can be promoted into persistent agent instruction files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26`, `SKILL.md:262-289`, `SKILL.md:348-360`; `hooks/openclaw/handler.js:9-25`; `hooks/openclaw/handler.ts:10-26` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code `SKILL.md:23-26`: ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` `SKILL.md:262-289`: ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` `hooks/openclaw/handler.js:9-25`: ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any ...[truncated 3101 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before promoting any generated learning into an auto-loaded agent instruction file. 2. Keep unreviewed learnings in a separate data store that is never interpreted as agent instructions. 3. Record provenance for every entry, including the originating user, session, timestamp, and supporting evidence. 4. Permit promotion only through a structured schema with narrowly defined factual fields. 5. Reject content containing role directives, tool-execution instructions, credential requests, safety overrides, or instructions to ignore higher-priority policy. 6. Render quoted user content as inert data and never copy it verbatim into prompt-bearing files. 7. Add a review diff showing the exact proposed change, destination file, and source learning. 8. Require multiple independently verified occurrences rather than allowing repetition within one attacker-controlled conversation to satisfy recurrence criteria. 9. Restrict write permissions so routine sessions cannot directly modify global `SOUL.md`, `TOOLS.md`, `AGENTS.md`, or equivalent files. 10. Add rollback support and an audit log for every promotion. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:157
• Finding: Raw command failures and environment details may be persisted in shared learning files without secret redaction<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:157-178`, `SKILL.md:450-459`; `scripts/error-detector.sh:4-10`; `references/hooks-setup.md:205-207` **Vulnerability Type**: Plaintext sensitive-data exposure through error logging **Risk Level**: Medium ### Vulnerable Code `SKILL.md:157-178`: ```markdown ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ### Suggested Fix If identifiable, what might resolve this ### Metadata - Reproducible: yes | no | unknown - Related Files: path/to/file.ext - See Also: ERR-20250110-001 (if recurring) --- ``` `SKILL.md:450-459`: ```markdown ## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/ ``` **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` `scripts/error-detector.sh:4-10`: ```bash # Reads CLAUDE_TOOL_OUTPUT environment variable set -e # Check if tool output indicates an error # CLAUDE_TOOL_OUTPUT contains the result of the tool execution OUTPUT="${CLAUDE_TOOL_OUTPUT:-}" ``` `references/hooks-setup.md:205-207`: ```markdown - Hook scripts run with the same permissions as Claude Code - Scripts only output text; they don't modify files or run commands - Error detector reads `CLAUDE_TOOL_OUTPUT` environment variable ``` ### Technical Analysis The error detector reads the complete Bash tool output and emits a reminder when common error strings are detected. The documented error-entry format then asks the agent to record the actual error output, attempted command, parameters, and relevant environment details. Command failures frequently expose secrets accidentally. Examples include authorization headers, API tokens embedded in command arguments, environment-variable values, signed URLs, database connection strings, private filesystem paths, internal hostnames, and customer data. The Skill defines no mandat ...[truncated 1999 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace “actual error message or output” with a sanitized summary by default. 2. Explicitly prohibit recording passwords, API keys, access tokens, cookies, authorization headers, private keys, connection strings, signed URLs, personal data, and raw environment-variable values. 3. Add automated redaction for common secret formats before any output is displayed for logging. 4. Apply entropy-based and provider-specific secret scanning to proposed learning entries. 5. Never record complete command lines when arguments may contain secrets; store only the executable and sanitized parameter names. 6. Default `.learnings/` to local, ignored storage rather than repository tracking. 7. If team sharing is required, use a reviewed export process that strips sensitive fields before committing. 8. Display a confirmation prompt containing the exact sanitized text before writing an error record. 9. Define retention and deletion rules for learning files. 10. If a secret has already been committed, revoke or rotate it immediately and purge it from repository history and downstream copies. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Unpinned external repository can supply executable OpenClaw hook code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-44`, `SKILL.md:94-103`; `references/openclaw-integration.md:31-54` **Vulnerability Type**: Unpinned executable supply-chain dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:32-44`: ```markdown ### Installation **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` `SKILL.md:94-103`: ```markdown ### Optional: Enable Hook For automatic reminders at session start: ```bash # Copy hook to OpenClaw hooks directory cp -r hooks/openclaw ~/.openclaw/hooks/self-improvement # Enable it openclaw hooks enable self-improvement ``` ``` `references/openclaw-integration.md:31-54`: ```markdown ### 1. Install the Skill ```bash clawdhub install self-improving-agent ``` Or copy manually: ```bash cp -r self-improving-agent ~/.openclaw/skills/ ``` ### 2. Install the Hook (Optional) Copy the hook to OpenClaw's hooks directory: ```bash cp -r hooks/openclaw ~/.openclaw/hooks/self-improvement ``` Enable the hook: ```bash openclaw hooks enable self-improvement ``` ``` ### Technical Analysis The manual installation command clones the default branch of an external personal GitHub repository without pinning a release tag or commit hash. No checksum, signature, provenance attestation, or content verification is required. The resulting directory contains OpenClaw hook handlers. The documentation subsequently instructs the user to copy those handlers into the OpenClaw hooks directory and enable them. Hook code executes during agent lifecycle events with the permissions of the OpenClaw process. The code present in the audited artifact only injects static reminder text ...[truncated 1618 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin manual installation to an immutable, reviewed commit hash or signed release tag. 2. Publish SHA-256 or stronger checksums for each release artifact and require verification before installation. 3. Sign releases and document signature-verification steps. 4. Use provenance attestations, such as Sigstore, where supported. 5. Avoid cloning a moving default branch directly into an executable Skill directory. 6. Separate download, inspection, and activation into distinct steps. 7. Require users to review the exact hook diff and declared events before enabling it. 8. Restrict hook permissions through sandboxing, filesystem allowlists, network denial, and a minimal environment. 9. Pin the ClawdHub package to an explicit version and verify that registry ownership and package identity match the expected publisher. 10. Document a safe update procedure that repeats integrity verification for every new version. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about maintaining and consulting learnings after failures, corrections, outdated knowledge, or improved approaches. The supplied code does something materially different: it is an extraction/helper utility that scaffolds a new skill on disk from a skill name. While comments mention creating a skill from a learning entry, the script itself neither captures learnings nor processes failures/corrections nor reviews prior learnings. Its primary behavior is filesystem creation and template generation, which is an undeclared and materially different capability from the declared purpose.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The described cross-session features explicitly enable reading other sessions' transcripts and sending learnings between sessions. That materially increases disclosure risk by normalizing reuse of prior conversational content across contexts, which can leak confidential user data, internal discussions, or sensitive troubleshooting details to sessions that do not have a need to know.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill instructs logging integration details, session information, and learnings without any sanitization or privacy guardrails. In practice, this can capture secrets, personal data, access tokens, internal URLs, and other sensitive context into persistent files or shared workspace memory where it may later be exposed to other agents or users.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The templates directly ask for full context, inputs, parameters, user context, and actual error output in persistent markdown files. Those fields are exactly where secrets, customer data, authentication material, and sensitive business logic often appear, making the skill a strong mechanism for plain-text data leakage and long-term retention.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The error template explicitly requests raw error output and environment details, which frequently contain secrets, file paths, hostnames, API keys, stack traces with sensitive inputs, or customer data. Persisting such data in markdown logs creates a durable leakage surface that can be indexed, committed, or read by later sessions.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Directing users to modify ~/.claude/settings.json affects a sensitive agent configuration directory and establishes persistent behavior at the user level. While configuration guidance is not inherently malicious, changing agent-wide settings can enable durable command execution across sessions, magnifying the effect of any unsafe hook script or misconfiguration.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description says to use the skill when a command fails, when the user corrects the agent, when an API fails, when a better approach is discovered, and to review learnings before major tasks. These conditions are very broad and overlap with common coding-session events, without clear boundaries or exclusions for when the skill should not activate.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill encourages recording user corrections, failures, and other conversation-derived details into persistent logs and project memory. That creates a natural-language data retention risk because user-provided content, proprietary context, or sensitive operational details may be stored beyond the original session and later surfaced to unrelated tasks.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 84% confidence
• Finding: The skill explicitly creates persistent storage under the user's home workspace for accumulating learnings and errors. While persistence itself is not always unsafe, here it increases exposure because the skill is designed to store conversational and operational details over time in easily accessible plaintext files.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The listed feature-request triggers include generic phrases such as "Can you also...", "I wish you could...", and "Is there a way to...", which commonly appear in ordinary conversation. Without tighter scope, these phrases could activate the skill in many situations unrelated to intentional self-improvement logging.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Suggested prompts like "Log this to learnings" and "Check .learnings/ for related issues" are short, generic commands that may be reused in varied contexts. The file does not define guardrails or scope constraints to distinguish intentional invocation from incidental mention.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 80% confidence
• Finding: Documenting hooks in .claude/settings.json creates session-persistent behavior that automatically reappears in future agent runs. Persistence itself is a legitimate feature, but in this context it increases risk because the hook executes commands and may silently influence later sessions beyond the original task.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: An empty matcher causes the activator hook to run for every prompt, creating a broad automatic trigger with no scope restriction. In an agent environment, always-on hooks increase the chance of prompt interception, context manipulation, or unintended data exposure across unrelated tasks.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The user-level configuration installs the hook in ~/.claude/settings.json, enabling broad persistence across all future sessions and projects. Combined with an empty matcher, this creates global automatic execution in diverse contexts, increasing exposure to sensitive prompts and making unintended behavior harder to detect or contain.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex CLI example also uses an empty matcher, causing the hook to run on all prompts without clear boundaries. This repeats the same overbroad trigger pattern in another agent environment, normalizing unsafe defaults for automatic command-backed hooks.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document states that the hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly executes shell scripts via command hooks. This mismatch can mislead users into granting trust or permissions under false assumptions, reducing scrutiny of code that runs automatically in the agent context.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 91% confidence
• Finding: Creating persistent `.learnings/` storage in the workspace or skill directory introduces durable retention of model-derived notes that may contain sensitive user information, prompt injections, or operational details. In OpenClaw, where workspace files are injected into future sessions, this persistence meaningfully increases the blast radius of any bad or tainted entry.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs writing learnings into workspace and skill files without warning that these locations are persistent and may contain secrets, proprietary prompts, user inputs, or operational details. Because the surrounding integration relies on prompt-injected workspace files, unsafe logging can turn transient sensitive content into long-lived context that is repeatedly re-exposed to future sessions.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Using generic user corrections like 'No, that's wrong...' as an automatic trigger is too broad because normal conversational feedback may contain sensitive context, sarcasm, or incomplete corrections. In this skill, that broad trigger feeds a persistence mechanism, making accidental retention of user content and poisoned 'lessons' more likely.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger 'knowledge gaps' is overly broad and lacks operational boundaries, which can cause the system to persist large amounts of ambiguous or sensitive interaction content as 'learnings'. In a self-improvement skill, vague capture criteria increase the chance of logging unnecessary user data, model uncertainty, or adversarial prompt content into durable memory.