T01 · Skill Instruction Hijacking
Error
- Location
scripts/learn.py:1002- Finding
Automatic Promotion of Untrusted Learning Entries into Core Agent Instruction Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improvement Llm
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed self-learning memory system, but it can automatically persist conversation-derived content into agent instruction and memory files and includes unsafe import/install helpers.
Install only if you intentionally want an always-on, persistent agent memory system. Review and disable automatic promotion, dream distillation, the startup hook, ZIP import, and skill approval helpers unless you are comfortable with conversation-derived text changing future agent behavior and local workspace files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
hooks/openclaw/handler.js:22- Finding
Persistent Startup Prompt Injection Through Unsanitized Hook Context
- Content
View full analysis
(e.priority === "critical" || e.priority === "high") && e.status === "pending" ); ``` ```javascript // Pending patterns (≥2 occurrences) const patternGroups = {}; for (const e of (trail.entries || [])) { const pk = e.pattern_key || e.pattern_key; if (!pk || e.status === "resolved" || e.status === "promoted") continue; if (!patternGroups[pk]) { patternGroups[pk] = { count: 0, entries: [], summary: e.summary }; } patternGroups[pk].count += e.recurrence_count || 1; patternGroups[pk].entries.push(e); } const readyPatterns = Object.entries(patternGroups) .filter(([, v]) => v.count >= 2) .map(([pk, v]) => ({ pk, count: v.count, summary: v.summary })); if (highPriority.length > 0) { lines.push(`## ⚠️ Pending High-Priority Items (${highPriority.length})`); highPriority.forEach((e) => lines.push(`- [${e.id}] ${e.summary}`) ); lines.push(""); } if (readyPatterns.length > 0) { lines.push(`## 🚀 Patterns Ready for Promotion (${readyPatterns.length})`); readyPatterns.forEach((p) => lines.push(`- \`${p.pk}\` (${p.count}x): ${p.summary?.slice(0, 80)}`) ); lines.push(""); } ``` ```javascript // Write context file fs.writeFileSync(contextPath, lines.join("\n"), "utf-8"); ``` The corresponding mandatory Agent instruction is: ```markdown 5. **Check `.hook-context.txt`** (written by plugin hook at gateway startup): Use `read(path="memory/.hook-context.txt")` to check it. If it shows pending verifications or patterns ready for promotion, act on them. ``` ### Technical Analysis The hook reads `summary`, `pattern_key`, and re ...[truncated 1511 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
scripts/dream.py:179- Finding
Unsanitized Daily Logs Are Automatically Converted into Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/sync.py:69- Finding
Zip Slip Allows Arbitrary File Creation and Overwrite During Backup Import
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/skillgen.py:289- Finding
Path Traversal in Generated Skill Approval Can Copy or Replace Unintended Directories
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (65)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The activation description is extremely broad, covering generic requests like 'improve yourself,' learning from sessions, periodic self-evaluation, and updating core files. In an agent environment, such broad triggers can cause the skill to activate during ordinary conversations and perform persistent logging or self-modification without a narrowly scoped user request.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to operate during every conversation establishes an always-on behavior that continuously inspects messages and tool results for logging opportunities. That creates persistent surveillance-like behavior and increases the chance of collecting sensitive data or changing long-term memory outside the user's expectations.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/learn.py --log correction "具体纠正了什么"
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill promises a user-approval workflow for changes, but later explicitly permits auto-applying updates to MEMORY.md, USER.md, preferences.json, and TOOLS.md. That contradiction weakens consent boundaries and can let the agent persist behavior- or user-derived changes without meaningful review, especially because these files influence future actions and data retention.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The architecture includes a self-modification stage that writes changes to files based on an automated learn/verify/integrate cycle. In an agent system, enabling autonomous file modification materially increases the risk of prompt-influenced persistence, policy drift, corruption of trusted instructions, or malicious behavior being written into future execution paths.
- Content
│ ▼ ┌──────────────┐ │ Self-Modify │ │ (files) │ └──────────────┘
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description advertises autonomous memory and preference management but does not present an upfront warning that conversation-derived data may be persistently stored. Users may engage the skill without understanding that their corrections, preferences, summaries, and profile details can be retained beyond the current session.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The instructions hard-code trigger handling for specific Chinese terms such as "不对" and "错了" alongside English phrases, and later examples and operating text are partly in Chinese. The document does not explicitly state that language handling is user-configurable or optional, which can amount to an implicit locale policy choice.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Early instructions mandate appending post-task summaries to the daily log, while later sections define a more specific memory flow where structured events go only to the learning trail and session-end summaries are written to memory/sessions plus a concise daily summary. This creates conflicting operator intent about what should be logged where and when, especially for task-level learnings versus micro-events.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly directs the agent to maintain persistent user preferences and profile information in files such as preferences.json and USER.md. That creates a durable data-retention channel for personal or behavioral information, which can later leak through prompts, summaries, exports, backups, or other skills.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
These sections describe automatic logging, long-term retention, and memory promotion behaviors without requiring a clear privacy notice or active consent first. Because the storage includes daily logs, session summaries, and structured learning entries, the absence of a warning materially increases privacy and compliance risk.
- Content
Static analysis
No suspicious patterns detected.