Self Improvement Llm

• Outcome: Review
• Latest audit: Jul 29, 2026 · 1:08 PM UTC
• Version: 2.3.0

Overview

This skill is a disclosed self-learning memory system, but it can automatically retain conversation-derived data and modify agent/workspace behavior files with limited user control.

Install only if you intentionally want an agent memory system that stores conversation-derived summaries/preferences and can update persistent behavior files. Review or disable automatic cycle/promotion behavior, avoid importing untrusted backup ZIPs, and treat the Windows recursive delete instruction as a manual operation requiring careful path verification.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tainted flow: 'LEARNING_TRAIL_PATH' from os.environ.get (line 28, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

def save_trail(trail):
    os.makedirs(MEMORY_DIR, exist_ok=True)
    with open(LEARNING_TRAIL_PATH, "w") as f:
        json.dump(trail, f, indent=2)

• Confidence: 90% confidence
• Finding: LEARNING_TRAIL_PATH is derived from the OPENCLAW_WORKSPACE environment variable and then written without validating that the resolved path stays within an approved workspace root. An attacker who can influence the environment or execution context could redirect writes to unintended files, causing arbitrary file overwrite within the process's permissions.

Tainted flow: 'path' from os.environ.get (line 91, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

os.makedirs(MEMORY_DIR, exist_ok=True)
    timestamp = datetime.now().strftime("%H:%M")
    entry = f"\n### {emoji} {timestamp} - {message}"
    with open(path, "a") as f:
        f.write(entry + "\n")
    return path

• Confidence: 88% confidence
• Finding: The daily log path is built from MEMORY_DIR, which ultimately comes from an environment-controlled workspace path, and the code appends attacker-influenced message content to that file. If the environment is manipulated, this can be used to write arbitrary content to attacker-chosen filesystem locations accessible to the process.

Tainted flow: 'index_path' from os.environ.get (line 266, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

# Save index
    index_path = os.path.join(MEMORY_DIR, ".memory-index.json")
    with open(index_path, "w") as f:
        json.dump({"built": datetime.now().isoformat(), "index": index}, f, indent=2, ensure_ascii=False)

    return index

• Confidence: 88% confidence
• Finding: The memory index file is written beneath MEMORY_DIR, which is derived from OPENCLAW_WORKSPACE without validation. In hostile runtime contexts, that enables path redirection and overwrite of unintended files through environment manipulation.

Tainted flow: 'target_path' from os.environ.get (line 1006, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

new_content = content + "\n" + line + "\n"

    # Write the file
    with open(target_path, "w") as f:
        f.write(new_content)

    # Record change for verification

• Confidence: 94% confidence
• Finding: execute_promotion writes to target_path built from WORKSPACE plus filenames like MEMORY.md, TOOLS.md, AGENTS.md, or SOUL.md, where WORKSPACE is environment-derived and unvalidated. Because this function is part of an automatic promotion flow, a manipulated workspace can redirect autonomous writes to arbitrary files, increasing the danger beyond a simple local data write.

Tainted flow: 'summary_path' from os.environ.get (line 1197, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

seq = len(existing) + 1

    summary_path = os.path.join(sessions_dir, f"{today}-{seq:03d}.md")
    with open(summary_path, "w") as f:
        f.write(f"# Session Summary: {today}-{seq:03d}\n\n")
        f.write(f"Generated: {datetime.now().strftime('%Y-%m-%d %H:%M')}\n\n")
        if tasks:

• Confidence: 87% confidence
• Finding: summary_path is created under a sessions directory derived from the environment-controlled workspace, then opened for write without path validation. This allows filesystem writes to be redirected if an attacker controls OPENCLAW_WORKSPACE or related path components.

Tainted flow: 'LEARNING_TRAIL_PATH' from os.environ.get (line 28, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

}
    if not os.path.exists(LEARNING_TRAIL_PATH):
        os.makedirs(MEMORY_DIR, exist_ok=True)
        with open(LEARNING_TRAIL_PATH, "w") as f:
            json.dump(default, f, indent=2)
        return default
    try:

• Confidence: 90% confidence
• Finding: Initial creation of the learning trail file writes to LEARNING_TRAIL_PATH derived from an untrusted environment variable. That makes first-run initialization capable of creating or overwriting files outside the expected workspace if the process environment is attacker-controlled.

Tainted flow: 'LEARNING_TRAIL_PATH' from os.environ.get (line 28, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

save_trail(trail)
        return trail
    except (json.JSONDecodeError, FileNotFoundError):
        with open(LEARNING_TRAIL_PATH, "w") as f:
            json.dump(default, f, indent=2)
        return default

• Confidence: 90% confidence
• Finding: On JSON decode or missing file errors, the script rewrites LEARNING_TRAIL_PATH without validating the environment-derived destination. This expands the arbitrary file overwrite risk to error-handling paths, which attackers often can trigger intentionally.

Tainted flow: 'daily_path' from os.environ.get (line 1578, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

# Write cycle summary to daily log for agent visibility
        daily_path = os.path.join(MEMORY_DIR, now.strftime("%Y-%m-%d") + ".md")
        try:
            with open(daily_path, "a") as f:
                f.write(f"\n### 🤖 {now.strftime('%H:%M')} - Self-improvement cycle\n")
                for a in actions_taken:
                    f.write(f"- {a}\n")

• Confidence: 87% confidence
• Finding: The cycle summary append path is based on MEMORY_DIR from the environment-controlled workspace and is written automatically during the learning cycle. This creates another autonomous arbitrary-write primitive if the workspace path is redirected by a hostile environment.

Tainted flow: 'path' from os.environ.get (line 131, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

if error:
        entry += f"\n   Error: {error}"

    with open(path, "a") as f:
        f.write(entry + "\n")
    print(f"📝 Logged to {os.path.relpath(path, WORKSPACE)}")
    return entry

• Confidence: 93% confidence
• Finding: The file write target is derived from the OPENCLAW_WORKSPACE environment variable and then used to build MEMORY_DIR/path without validation. If an attacker can control the runtime environment, they can redirect writes to an unintended location, causing unauthorized file creation or modification within the privileges of the process. The skill context makes this somewhat more dangerous because the script is explicitly intended to auto-log data at session end, so the write path may be exercised routinely and without much operator scrutiny.

Tainted flow: 'src' from os.environ.get (line 305, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow

Content

src = os.path.join(draft_dir, item)
        dst = os.path.join(dest_dir, item)
        if os.path.isfile(src):
            shutil.copy2(src, dst)
        elif os.path.isdir(src):
            if os.path.exists(dst):
                shutil.rmtree(dst)

• Confidence: 81% confidence
• Finding: Approving a draft copies every file and subdirectory from the draft directory into the installed skill directory without validating symlinks, file types, or path trust. If an attacker can place crafted content in the drafts area, this can copy unintended files into the active skills tree and potentially cause the agent to later consume malicious artifacts.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The document promises a user-approval proposal workflow, but later authorizes several classes of changes to be auto-applied. That inconsistency can mislead users and downstream agents into believing approval gates exist when in practice persistent memory and behavior files may be modified automatically, reducing meaningful consent and review.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The skill is activated by broad phrases such as requests to 'improve yourself' or 'learn from this,' which can occur in ordinary conversation and unintentionally trigger persistent logging, self-modification workflows, or file changes. In a self-modifying memory skill, accidental activation is more dangerous because the side effects extend beyond the current session.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill persistently stores user preferences, session summaries, feedback, and knowledge derived from conversations, but the description does not clearly warn users up front about that retention. This creates a substantial privacy and consent risk because users may disclose information without understanding it will be stored across sessions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs automatic file modifications to memory and core behavior files without a clear upfront warning that it performs system-impacting writes. This is risky because an agent may modify persistent workspace state or its own operating guidance unexpectedly, especially when paired with automatic triggers.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This is a real security concern because the document explicitly describes automatic session logging, idle-time execution of a learning script, verification against behavioral metrics, and self-modification of files without any surrounding consent, scoping, or safety controls. In an agent skill context, normalizing background persistence and autonomous file changes can lead to unauthorized retention of sensitive user data and unreviewed prompt/instruction drift, which increases both privacy and integrity risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The full learning cycle can automatically promote patterns and write to repository files without explicit confirmation at execution time. In an agent skill that processes conversational or memory-derived content, this increases the risk of prompt/content injection becoming persistent file tampering or policy drift.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The import routine trusts archive entry names and writes them directly under the workspace using os.path.join(WORKSPACE_DIR, file_path) without validating that the resolved path stays داخل the workspace. A crafted ZIP containing paths like '../../.ssh/authorized_keys' or absolute paths could cause arbitrary file overwrite outside the intended directory, especially when run by a user with access to sensitive files.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill mandates automatic retention and summarization of conversation-derived information across sessions. Persistent cross-session memory increases privacy exposure, creates a durable record of user interactions, and can amplify harm if sensitive data is accidentally captured or later accessed by other components.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to store user preferences and profile data persistently until changed, creating an indefinite user-model store. This is dangerous because profile and preference data can be sensitive, may become stale or inaccurate, and can be used across future interactions without renewed consent.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: Automatically including user feedback in generated session summaries causes conversation-derived content to be copied into persistent records. That can preserve sensitive or identifying details beyond the original interaction and make later misuse or unintended disclosure more likely.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**原因：** OpenClaw Gateway（Node.js）运行时持有技能目录的文件句柄，导致 update 流程中的 rename 操作被操作系统拒绝。

**解决方法：**
1. 手动删除旧目录：`cmd /c rmdir /s /q "<skills路径>\self-improvement-llm"`
2. 重新安装：`openclaw skills install self-improvement-llm`

**Linux/macOS 不受影响**，目录在被读取时仍可 rename。

• Confidence: 97% confidence
• Finding: The skill includes a destructive Windows command using `cmd /c rmdir /s /q` against a path placeholder. Even though framed as troubleshooting guidance, this pattern is dangerous in an agent skill because path substitution errors, malicious path injection, or inattentive execution could recursively delete unintended directories with quiet, forceful semantics.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.