T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:262- Finding
Untrusted conversational content can be promoted into persistent agent instruction files
- Content
View full analysis
- Remediation
View remediation
Security audit
cpskilltest222
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent as a self-improvement logger, but it asks agents to persist conversation-derived details into long-lived instruction files with broad automatic hooks and limited privacy guardrails.
Install only if you are comfortable with persistent learning logs and hook reminders. Keep .learnings local by default, redact secrets and personal or customer data, avoid copying raw error output or full transcripts, review every promotion into CLAUDE.md/AGENTS.md/SOUL.md/TOOLS.md, and prefer project-scoped hooks with narrow matchers over global always-on settings.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:157- Finding
Raw command failures and environment details may be persisted in shared learning files without secret redaction
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:32- Finding
Unpinned external repository can supply executable OpenClaw hook code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about maintaining and consulting learnings after failures, corrections, outdated knowledge, or improved approaches. The supplied code does something materially different: it is an extraction/helper utility that scaffolds a new skill on disk from a skill name. While comments mention creating a skill from a learning entry, the script itself neither captures learnings nor processes failures/corrections nor reviews prior learnings. Its primary behavior is filesystem creation and template generation, which is an undeclared and materially different capability from the declared purpose.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The described cross-session features explicitly enable reading other sessions' transcripts and sending learnings between sessions. That materially increases disclosure risk by normalizing reuse of prior conversational content across contexts, which can leak confidential user data, internal discussions, or sensitive troubleshooting details to sessions that do not have a need to know.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs logging integration details, session information, and learnings without any sanitization or privacy guardrails. In practice, this can capture secrets, personal data, access tokens, internal URLs, and other sensitive context into persistent files or shared workspace memory where it may later be exposed to other agents or users.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The templates directly ask for full context, inputs, parameters, user context, and actual error output in persistent markdown files. Those fields are exactly where secrets, customer data, authentication material, and sensitive business logic often appear, making the skill a strong mechanism for plain-text data leakage and long-term retention.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The error template explicitly requests raw error output and environment details, which frequently contain secrets, file paths, hostnames, API keys, stack traces with sensitive inputs, or customer data. Persisting such data in markdown logs creates a durable leakage surface that can be indexed, committed, or read by later sessions.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Directing users to modify ~/.claude/settings.json affects a sensitive agent configuration directory and establishes persistent behavior at the user level. While configuration guidance is not inherently malicious, changing agent-wide settings can enable durable command execution across sessions, magnifying the effect of any unsafe hook script or misconfiguration.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description says to use the skill when a command fails, when the user corrects the agent, when an API fails, when a better approach is discovered, and to review learnings before major tasks. These conditions are very broad and overlap with common coding-session events, without clear boundaries or exclusions for when the skill should not activate.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill encourages recording user corrections, failures, and other conversation-derived details into persistent logs and project memory. That creates a natural-language data retention risk because user-provided content, proprietary context, or sensitive operational details may be stored beyond the original session and later surfaced to unrelated tasks.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The skill explicitly creates persistent storage under the user's home workspace for accumulating learnings and errors. While persistence itself is not always unsafe, here it increases exposure because the skill is designed to store conversational and operational details over time in easily accessible plaintext files.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The listed feature-request triggers include generic phrases such as "Can you also...", "I wish you could...", and "Is there a way to...", which commonly appear in ordinary conversation. Without tighter scope, these phrases could activate the skill in many situations unrelated to intentional self-improvement logging.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Suggested prompts like "Log this to learnings" and "Check .learnings/ for related issues" are short, generic commands that may be reused in varied contexts. The file does not define guardrails or scope constraints to distinguish intentional invocation from incidental mention.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Documenting hooks in .claude/settings.json creates session-persistent behavior that automatically reappears in future agent runs. Persistence itself is a legitimate feature, but in this context it increases risk because the hook executes commands and may silently influence later sessions beyond the original task.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
An empty matcher causes the activator hook to run for every prompt, creating a broad automatic trigger with no scope restriction. In an agent environment, always-on hooks increase the chance of prompt interception, context manipulation, or unintended data exposure across unrelated tasks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-level configuration installs the hook in ~/.claude/settings.json, enabling broad persistence across all future sessions and projects. Combined with an empty matcher, this creates global automatic execution in diverse contexts, increasing exposure to sensitive prompts and making unintended behavior harder to detect or contain.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Codex CLI example also uses an empty matcher, causing the hook to run on all prompts without clear boundaries. This repeats the same overbroad trigger pattern in another agent environment, normalizing unsafe defaults for automatic command-backed hooks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document states that the hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly executes shell scripts via command hooks. This mismatch can mislead users into granting trust or permissions under false assumptions, reducing scrutiny of code that runs automatically in the agent context.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
Creating persistent
.learnings/storage in the workspace or skill directory introduces durable retention of model-derived notes that may contain sensitive user information, prompt injections, or operational details. In OpenClaw, where workspace files are injected into future sessions, this persistence meaningfully increases the blast radius of any bad or tainted entry.- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs writing learnings into workspace and skill files without warning that these locations are persistent and may contain secrets, proprietary prompts, user inputs, or operational details. Because the surrounding integration relies on prompt-injected workspace files, unsafe logging can turn transient sensitive content into long-lived context that is repeatedly re-exposed to future sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Using generic user corrections like 'No, that's wrong...' as an automatic trigger is too broad because normal conversational feedback may contain sensitive context, sarcasm, or incomplete corrections. In this skill, that broad trigger feeds a persistence mechanism, making accidental retention of user content and poisoned 'lessons' more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger 'knowledge gaps' is overly broad and lacks operational boundaries, which can cause the system to persist large amounts of ambiguous or sensitive interaction content as 'learnings'. In a self-improvement skill, vague capture criteria increase the chance of logging unnecessary user data, model uncertainty, or adversarial prompt content into durable memory.
- Content