Security audit

Temp Skill Download

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it deserves review because it can install always-on agent hooks and turn conversation-derived notes into long-lived agent instructions.

Install only if you want persistent self-improvement logs and agent reminders. Prefer project-scoped setup, avoid the global ~/.claude hook with an empty matcher, narrow matchers to debugging or learning workflows, redact secrets and personal data from learnings, and require a manual diff review before promoting anything into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, Copilot instructions, or a new skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: hooks/openclaw/handler.js:46
Finding: Agent Bootstrap and Prompt Hook Instruction Injection
Content: View full analysis
Vulnerability Details

File Location: hooks/openclaw/handler.js:46-52
Additional Locations: hooks/openclaw/handler.ts:44-59, scripts/activator.sh:9-18, SKILL.md:411-465
Vulnerability Type: Agent-context instruction injection through lifecycle hooks
Risk Level: Medium

Vulnerable Code

javascript
if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); }

The prompt hook also emits instructions into agent context:

bash
<self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. </self-improvement-reminder>

Technical Analysis

Once the optional hooks are enabled, Skill-controlled instructions are inserted into the agent context during bootstrap or after each submitted prompt. The bootstrap handler presents the content as a virtual workspace file, while the shell hook emits an XML-like instruction block.

These instructions alter agent behavior beyond the immediate user request by directing the agent to evaluate, record, and potentially promote information after completing tasks. The behavior is documented and opt-in, and no explicit instruction to bypass platform safety controls was found. Nevertheless, it is an instruction-injection mechanism capable of influencing every matching session.

There is also a runtime-source discrepancy. The TypeScript source at hooks/openclaw/handler.ts:44-49 excludes session keys containing :subagent:, but the shipped JavaScript handler does not ...[truncated 1482 chars]
Remediation: View remediation
Remediation Suggestions

Require an explicit user request or per-session consent before injecting self-improvement instructions.

Clearly label injected content as optional advisory material that must not override the current user request or higher-priority instructions.

Require confirmation before the agent writes learning records or modifies persistent instruction files.

Restrict the hook to narrowly defined events and sessions rather than every prompt.

Rebuild handler.js from the reviewed TypeScript source so the sub-agent exclusion is present in the runtime artifact.

Add an automated test that compares TypeScript and JavaScript behavior, including rejection of session keys containing :subagent:.

Document which handler file OpenClaw executes and avoid shipping divergent source and runtime implementations.

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:264
Finding: Unsanitized Promotion of Conversation-Derived Content into Persistent Agent Instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:264-270
Additional Locations: SKILL.md:21-24, SKILL.md:243-262, SKILL.md:387, references/openclaw-integration.md:123-143, references/openclaw-integration.md:205-213
Vulnerability Type: Persistent agent-memory poisoning through untrusted learning promotion
Risk Level: High

Vulnerable Instructions

markdown
### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`

The Skill identifies persistent behavioral files as promotion targets:

markdown
| Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) |

It further recommends an aggressive promotion policy:

markdown
7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md

Technical Analysis

The Skill accepts conversation events, user corrections, failures, and discoveries as learning sources. It then directs the agent to promote selected material into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or .github/copilot-instructions.md. These files can be automatically loaded into future agent sessions and treated as authoritative project or behavioral guidance.

The promotion workflow does not require source authentication, trust classification, adversarial-instruction filtering, independent verification, or explicit human approval. Distillation alone does not neutralize malicious semantics. An attacker ...[truncated 2596 chars]
Remediation: View remediation
Remediation Suggestions

Adopt a default-deny promotion policy and remove the instruction to “promote aggressively.”

Require explicit human review and confirmation before modifying any persistent agent instruction file.

Treat conversation content, user corrections, tool output, external documentation, and cross-session messages as untrusted data.

Never copy raw learning text directly into authoritative instruction files.

Validate proposed rules against repository documentation, tests, code, or another trusted source before promotion.

Store provenance metadata including the source session, author, timestamp, related files, verification evidence, and approving reviewer.

Reject promotion candidates that request safety overrides, credential handling, privilege changes, automatic external communication, destructive commands, or unreviewed code execution.

Keep .learnings/ as non-authoritative reference material and separate it structurally from files automatically injected as instructions.

Present a reviewable diff before promotion and require approval for each target file.

Add automated checks that flag imperative commands, external URLs, secret-related language, encoded content, and attempts to alter instruction hierarchy.

Limit persistent rules to the narrowest relevant project scope and provide expiration or revocation metadata.

Record and audit all promotions so poisoned instructions can be traced and reverted.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a logging/improvement aid, but it also instructs the agent to create directories/files, modify persistent instruction sources, and scaffold new skills. That mismatch matters because users or orchestrators may grant it broader trust than warranted, causing unintended filesystem writes or persistence of agent behavior beyond simple note-taking.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Directing users to modify ~/.claude/settings.json establishes persistence in the agent's user-level config directory, which affects all future sessions rather than a single project. In the context of executable hooks, this makes any mistake, malicious modification, or unsafe script path far more impactful and durable.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The user-level example installs a global hook in ~/.claude/settings.json with an empty matcher, making it execute for every prompt across all projects and sessions. This greatly expands blast radius: a problematic or modified script affects unrelated repositories, sensitive tasks, and future sessions by default.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is broad enough to match many ordinary interactions, which can cause the skill to run when not needed. Unintended activation increases the chance of unnecessary persistence, file churn, and accidental recording of sensitive conversation content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill expands from recording local learnings into changing broader prompt/instruction files such as CLAUDE.md, AGENTS.md, and copilot-instructions. This creates persistence and prompt-surface modification that can influence future sessions, potentially amplifying mistakes or embedding unsafe guidance across the workspace.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 79% confidence
Finding: The skill directs creation of persistent files under a workspace directory, which means conversation-derived content is retained across sessions. Persistent storage is risky because it can accumulate sensitive data, stale instructions, or attacker-influenced content that later affects agent decisions.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Reading other sessions' transcripts and messaging/spawning sessions is broader than a local self-improvement logger needs. In contexts where these tools are available, the skill could propagate sensitive context across sessions or expand its reach without a clear user ask, increasing confidentiality and control risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Trigger phrases like common corrections or feature questions are normal chat patterns and can cause over-collection or automatic logging without clear consent. While not directly exploit code execution, this can create privacy and persistence issues by storing routine conversational content in project files.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Automatic extraction of learnings into new reusable skills turns transient observations into executable/persistent agent behavior. That broadens the attack surface because flawed, overfit, or adversarially influenced learnings can become reusable artifacts that affect future tasks and projects.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Project-root hook configuration creates session-persistent behavior that automatically reappears whenever the project is opened. While less severe than user-level persistence, it still normalizes automatic code execution and context injection across sessions, which can surprise users and compound the effect of script changes over time.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Using an empty matcher causes the hook to fire on every prompt, creating an always-on trigger surface. In a self-improvement skill, that broad scope increases the chance of untrusted prompt content influencing hook behavior or causing unnecessary persistent context injection across all interactions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Codex example repeats the same empty-matcher design, causing unconditional execution on all prompts. Even if the current script is simple, unconditional hook execution increases attack surface, noise, and the consequences of script tampering or future script changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation states that the scripts 'only output text' and 'don't modify files or run commands', but the same file configures those scripts to be executed as hook commands. This is misleading because any executable hook runs with the agent's permissions and can perform arbitrary actions if changed, replaced, or misunderstood by users, reducing operator caution around a privileged execution path.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The instructions explicitly create persistent '.learnings/' storage in the workspace or skill directory, encouraging retention of operational mistakes, corrections, and tool failures across sessions. In a self-improvement skill, this persistence can accumulate sensitive data and make it repeatedly available as future context, increasing exposure and making prompt-injected or compromised sessions more valuable targets.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.
openclaw hooks enable self-improvement

text
### 3. Create Learning Files Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to promote learnings into persistent workspace files such as SOUL.md, TOOLS.md, AGENTS.md, and MEMORY.md without any warning about sensitive data handling. In a self-improvement skill, failure details, user corrections, tool errors, and operational notes can easily include secrets, personal data, internal paths, or confidential workflow information that then become long-lived prompt context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The section documents cross-session transcript access and messaging capabilities, including reading another session's history and sending messages, but gives no privacy, authorization, or data-handling warning. In this skill context, learnings and error reports may contain sensitive prompts, outputs, file paths, or operational details, so normalizing unrestricted transcript inspection or forwarding materially increases the chance of internal data exposure across sessions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: In this markdown file, the listed trigger 'Knowledge gaps' is ambiguous because it does not define what counts as a gap or when the skill should activate. This broad phrasing can overlap with many ordinary agent interactions and lacks scope constraints or negative examples.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger label 'Skill issue' is too generic to clearly distinguish intended invocations from routine problems. The description does not specify what kinds of issues qualify, nor does it provide constraints or counterexamples to prevent over-triggering.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Instructions

Technical Analysis

Remediation Suggestions

SkillSpector

Tp4

Agent Config Directory Access

Option 2: User-Level Configuration

Vague Triggers

Exfiltration Commands

sessions_send

Vague Triggers

Description-Behavior Mismatch

Session Persistence

Context-Inappropriate Capability

Vague Triggers

Context-Inappropriate Capability

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Intent-Code Divergence

Session Persistence

Missing User Warnings

Missing User Warnings

Vague Triggers

Vague Triggers

Static analysis