Security audit

Self Improvement

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed self-improvement logger, but it encourages broad persistent agent-memory changes and always-on hooks that users should review carefully before installing.

Install only if you want a persistent self-improvement memory system, not just a temporary log. Prefer project-local setup, avoid user-global hooks, narrow hook matchers, review the shell and OpenClaw hook code before enabling it, and require explicit human approval before writing conversation-derived content into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files. Do not store secrets, raw transcripts, credentials, personal data, or sensitive project details in .learnings without redaction.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:339
Finding: Persistent Agent-State Poisoning Through Unvalidated Learning Promotion<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:339-360` **Additional Locations**: `SKILL.md:23-26`, `SKILL.md:440-447` **Vulnerability Type**: Persistent agent memory and instruction poisoning **Risk Level**: High ### Vulnerable Code ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` Related promotion guidance includes: ```markdown | Behavioral patterns | Promote to `SOUL.md` | | Workflow improvements | Promote to `AGENTS.md` | | Tool gotchas | Promote to `TOOLS.md` | ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The skill encourages observations derived from conversations, user corrections, errors, and task outcomes to be promoted into files that are loaded as persistent agent context. These targets include `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. The recurrence threshold only measures repetition and timing. It does not establish that the source is trusted or that the promoted rule is safe. There is no mandatory human approval, provenance verification, security review, or restriction against promoting rules that alter tool usage, network behavior, authentication practices, permissions, or safety controls. Consequently, attacker-controlled conversational content can be transformed from transient input into durable instructions that affect future sessions. The instruction to “promote aggressively” further weakens the threshold for modifyi ...[truncated 1439 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user approval before writing to any persistent agent-context file. 2. Treat conversation-derived corrections and recommendations as untrusted input, regardless of recurrence count. 3. Add a mandatory review stage that displays the exact proposed rule, source entries, destination file, and security implications. 4. Prohibit automatic promotion of rules involving: - Credentials or authentication - Network access - Command execution - File permissions - Safety-control changes - External downloads - System or agent configuration 5. Store general learnings in a dedicated non-executable knowledge file rather than files interpreted as agent instructions. 6. Preserve immutable provenance, including the originating session, user, task, and learning identifiers. 7. Remove the “promote aggressively” recommendation and replace it with a least-persistence policy. 8. Support rollback and audit logging for every change to persistent context files. 9. Apply allowlisted schemas to promoted content instead of accepting unrestricted natural-language instructions. ]]>

T01 · Skill Instruction Hijacking

Warning

Location: hooks/openclaw/handler.js:8
Finding: Lifecycle-Wide Agent Instruction Injection Through Bootstrap and Prompt Hooks<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:8-50` **Additional Locations**: `hooks/openclaw/handler.ts:9-59`, `scripts/activator.sh:8-19`, `SKILL.md:469-515` **Vulnerability Type**: Agent context modification through persistent lifecycle hooks **Risk Level**: Medium ### Vulnerable Code ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); const handler = async (event) => { // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The prompt-submit hook also injects instructions: ```bash cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern lea ...[truncated 2526 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Scope the reminder to explicit self-improvement operations rather than injecting it into every session or prompt. 2. Require per-project and per-session consent, with hooks disabled by default. 3. Avoid representing the reminder as a bootstrap file or other high-priority context artifact. 4. Add explicit precedence language stating that the reminder cannot override system, developer, user, security, or task-specific instructions. 5. Require confirmation before writing a learning, extracting a skill, or promoting content to persistent context. 6. Sanitize and classify source content before retention, and reject instructions involving credentials, permissions, network access, or safety controls. 7. Make the JavaScript and TypeScript handlers behaviorally consistent, including sub-agent exclusion. 8. Provide a visible indicator showing when the hook is active and a simple mechanism to disable it. 9. Prefer an end-of-task user notification outside model instruction context instead of automatic prompt injection. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Unpinned Installation of Mutable Remote Skill and Hook Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-44` **Vulnerability Type**: Unverified supply-chain installation **Risk Level**: Medium ### Vulnerable Code ```markdown **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis The documented installation methods retrieve the current package or default repository branch without pinning a release version, commit hash, checksum, or cryptographic signature. The installed project contains executable shell scripts and agent lifecycle hooks. Therefore, the code ultimately installed can differ from the version reviewed in this audit. No malicious remote payload was found in the audited snapshot. The vulnerability is the lack of integrity and immutability controls around future installation. If the package registry entry, repository, maintainer account, or default branch is compromised, users following these instructions may install altered hook code with the same permissions as their agent environment. ### Attack Path 1. An attacker compromises the ClawdHub package, upstream repository, maintainer credentials, or distribution process. 2. The attacker publishes or commits a modified version under the existing skill name or default branch. 3. A user follows the documented unpinned installation command. 4. The package manager or `git clone` retrieves the attacker-controlled latest content. 5. The user enables the included hook according to the setup instructions. 6. The malicious hook or script executes with the permissions of OpenClaw, Claude Code, Codex, or the invoking user. ### Impact Assessment A successful supply-chain compromise could execute arb ...[truncated 404 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installations to an audited semantic version and immutable commit hash. 2. Publish SHA-256 checksums for release archives and verify them before installation. 3. Sign releases and document signature-verification commands. 4. For manual installation, use a pinned revision, for example: ```bash git clone https://github.com/peterskoett/self-improving-agent.git cd self-improving-agent git checkout --detach <audited-commit-hash> ``` 5. Document the expected repository owner, package publisher, release version, and commit identifier. 6. Require users to inspect executable scripts and hooks before enabling them. 7. Separate hook activation from package installation so downloaded code is not automatically trusted or executed. 8. Add a reproducible release process and compare packaged artifacts against the corresponding source revision. 9. Recommend least-privilege execution and prevent hooks from receiving unnecessary credentials or sensitive environment variables. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented primarily as a learning/logging aid, but it also instructs creation of hooks, workspace files, and even extraction/scaffolding of new skills via helper scripts. That broader operational behavior changes the trust boundary: a user enabling the skill may unintentionally authorize filesystem changes and reusable prompt-context propagation they did not expect from the description alone.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Referencing ~/.claude/settings.json directs users to modify a high-trust agent configuration location that affects all sessions. While not inherently malicious, instructions that establish persistent execution from a global config directory are security-sensitive because compromise or misuse of that path can yield durable agent behavior changes.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation criteria are broad enough to fire during many normal interactions, increasing the chance that ordinary conversation content, corrections, or failures get logged by default. In a skill that writes to persistent files and promotes content into shared agent context, over-triggering directly increases privacy and prompt-persistence risk.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill explicitly encourages storing conversation-derived learnings and promoting them into persistent memory files and shared instruction files across sessions and agents. That creates a durable data-retention channel for potentially sensitive user content, including mistakes, requests, and operational details that may later be surfaced in unrelated contexts.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 78% confidence
Finding: The skill instructs creation of persistent learning directories in a user workspace, establishing session persistence by default. Persistence is not inherently unsafe, but in this skill it compounds the logging and cross-session sharing behaviors, turning transient conversation artifacts into durable state that may outlive user expectations.

Ssd 3

Medium

Confidence: 93% confidence
Finding: Normalizing transcript access and inter-session sharing expands exposure of prior conversations beyond the original session boundary. If transcripts contain secrets, proprietary code, or sensitive user context, these workflows make lateral disclosure much easier through natural-language retrieval and forwarding.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The logging templates direct the agent to capture full context, inputs, parameters, environment details, and user context, which are precisely the fields most likely to contain credentials, tokens, personal data, internal paths, or proprietary business information. Because the data is written to persistent markdown, any later agent or collaborator with access can read and reuse it.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger phrases include very common conversational language like corrections and wishes, without requiring security, persistence, or logging-specific context. This makes unintended activation likely and can cause sensitive or irrelevant user statements to be stored, linked, and propagated across future sessions.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The recommendation to promote learnings aggressively into CLAUDE.md, Copilot instructions, and similar shared context files increases the blast radius of any sensitive content captured earlier. Once promoted, that information may be injected into many future interactions, making accidental disclosure persistent and hard to track or remove.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 86% confidence
Finding: The guidance creates persistent hook configuration in the project’s agent settings, causing the behavior to survive beyond the current session. Persistence is not automatically malicious, but in this context it increases risk because automatic script execution continues for future users or sessions unless deliberately removed.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Using an empty matcher on UserPromptSubmit causes the hook to fire on every prompt, creating broad and persistent execution of the referenced script regardless of task context. In agent environments, overly broad trigger scope increases attack surface, raises the chance of prompt-sensitive data exposure to hook logic, and normalizes continuous code execution.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The user-level configuration installs the hook in the global agent config directory and applies it across all sessions with no meaningful trigger constraint. This makes the behavior persistent and cross-project, so any bug, unsafe script change, or sensitive-context interaction can affect every future session rather than a single repository.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The Codex CLI example also uses an empty matcher, so the hook executes for every submitted prompt instead of only when learning capture is relevant. In a tool-integrated agent, this broad scope can unnecessarily expose session content to hook processing and makes any future script flaw more widely reachable.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document’s security section understates risk by claiming the scripts only output text and do not run commands, even though the hook mechanism explicitly executes shell scripts as commands. This can mislead operators into trusting hook installation without understanding that arbitrary local code will run in the agent context, increasing the chance of unsafe deployment.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 88% confidence
Finding: The guide explicitly instructs creation of a persistent `.learnings/` directory in the workspace or skill directory, enabling state to survive across sessions. Persistence is risky here because the skill's purpose is to capture errors and corrections, which can store untrusted or manipulative content that later influences behavior or leaks project context across tasks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation directs the agent to promote learnings into persistent workspace files like SOUL.md, TOOLS.md, and AGENTS.md without warning that these are durable behavioral prompt inputs. This is dangerous because incorrect, adversarial, or user-injected content can become long-lived instruction context and influence future sessions beyond the original task.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger definitions are broad enough that the skill could activate and write persistent 'learnings' in many ambiguous situations, including normal corrections or routine tool failures. In a self-modifying or memory-writing skill, unclear activation boundaries increase the risk of unnecessary persistence, prompt poisoning, and accumulation of low-quality or adversarial data in workspace memory files.

Static analysis

No suspicious patterns detected.