Self Improvement

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:34 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed self-improvement logger, but it encourages broad persistent agent-memory changes and always-on hooks that users should review carefully before installing.

Install only if you want a persistent self-improvement memory system, not just a temporary log. Prefer project-local setup, avoid user-global hooks, narrow hook matchers, review the shell and OpenClaw hook code before enabling it, and require explicit human approval before writing conversation-derived content into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files. Do not store secrets, raw transcripts, credentials, personal data, or sensitive project details in .learnings without redaction.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:339

Finding

Persistent Agent-State Poisoning Through Unvalidated Learning Promotion

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` Related promotion guidance includes: ```markdown | Behavioral patterns | Promote to `SOUL.md` | | Workflow improvements | Promote to `AGENTS.md` | | Tool gotchas | Promote to `TOOLS.md` | ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The skill encourages observations derived from conversations, user corrections, errors, and task outcomes to be promoted into files that are loaded as persistent agent context. These targets include `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. The recurrence threshold only measures repetition and timing. It does not establish that the source is trusted or that the promoted rule is safe. There is no mandatory human approval, provenance verification, security review, or restriction against promoting rules that alter tool usage, network behavior, authentication practices, permissions, or safety controls. Consequently, attacker-controlled conversational content can be transformed from transient input into durable instructions that affect future sessions. The instruction to “promote aggressively” further weakens the threshold for modifyi ...[truncated 1439 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/openclaw/handler.js:8

Finding

Lifecycle-Wide Agent Instruction Injection Through Bootstrap and Prompt Hooks

Content

View full analysis

{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The prompt-submit hook also injects instructions: ```bash cat << 'EOF' After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern lea ...[truncated 2526 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Installation of Mutable Remote Skill and Hook Content

Content

View full analysis

Remediation

View remediation

``` 5. Document the expected repository owner, package publisher, release version, and commit identifier. 6. Require users to inspect executable scripts and hooks before enabling them. 7. Separate hook activation from package installation so downloaded code is not automatically trusted or executed. 8. Add a reproducible release process and compare packaged artifacts against the corresponding source revision. 9. Recommend least-privilege execution and prevent hooks from receiving unnecessary credentials or sensitive environment variables. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented primarily as a learning/logging aid, but it also instructs creation of hooks, workspace files, and even extraction/scaffolding of new skills via helper scripts. That broader operational behavior changes the trust boundary: a user enabling the skill may unintentionally authorize filesystem changes and reusable prompt-context propagation they did not expect from the description alone.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Referencing ~/.claude/settings.json directs users to modify a high-trust agent configuration location that affects all sessions. While not inherently malicious, instructions that establish persistent execution from a global config directory are security-sensitive because compromise or misuse of that path can yield durable agent behavior changes.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation criteria are broad enough to fire during many normal interactions, increasing the chance that ordinary conversation content, corrections, or failures get logged by default. In a skill that writes to persistent files and promotes content into shared agent context, over-triggering directly increases privacy and prompt-persistence risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly encourages storing conversation-derived learnings and promoting them into persistent memory files and shared instruction files across sessions and agents. That creates a durable data-retention channel for potentially sensitive user content, including mistakes, requests, and operational details that may later be surfaced in unrelated contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill instructs creation of persistent learning directories in a user workspace, establishing session persistence by default. Persistence is not inherently unsafe, but in this skill it compounds the logging and cross-session sharing behaviors, turning transient conversation artifacts into durable state that may outlive user expectations.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Normalizing transcript access and inter-session sharing expands exposure of prior conversations beyond the original session boundary. If transcripts contain secrets, proprietary code, or sensitive user context, these workflows make lateral disclosure much easier through natural-language retrieval and forwarding.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The logging templates direct the agent to capture full context, inputs, parameters, environment details, and user context, which are precisely the fields most likely to contain credentials, tokens, personal data, internal paths, or proprietary business information. Because the data is written to persistent markdown, any later agent or collaborator with access can read and reuse it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases include very common conversational language like corrections and wishes, without requiring security, persistence, or logging-specific context. This makes unintended activation likely and can cause sensitive or irrelevant user statements to be stored, linked, and propagated across future sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The recommendation to promote learnings aggressively into CLAUDE.md, Copilot instructions, and similar shared context files increases the blast radius of any sensitive content captured earlier. Once promoted, that information may be injected into many future interactions, making accidental disclosure persistent and hard to track or remove.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The guidance creates persistent hook configuration in the project’s agent settings, causing the behavior to survive beyond the current session. Persistence is not automatically malicious, but in this context it increases risk because automatic script execution continues for future users or sessions unless deliberately removed.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Using an empty matcher on UserPromptSubmit causes the hook to fire on every prompt, creating broad and persistent execution of the referenced script regardless of task context. In agent environments, overly broad trigger scope increases attack surface, raises the chance of prompt-sensitive data exposure to hook logic, and normalizes continuous code execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-level configuration installs the hook in the global agent config directory and applies it across all sessions with no meaningful trigger constraint. This makes the behavior persistent and cross-project, so any bug, unsafe script change, or sensitive-context interaction can affect every future session rather than a single repository.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Codex CLI example also uses an empty matcher, so the hook executes for every submitted prompt instead of only when learning capture is relevant. In a tool-integrated agent, this broad scope can unnecessarily expose session content to hook processing and makes any future script flaw more widely reachable.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document’s security section understates risk by claiming the scripts only output text and do not run commands, even though the hook mechanism explicitly executes shell scripts as commands. This can mislead operators into trusting hook installation without understanding that arbitrary local code will run in the agent context, increasing the chance of unsafe deployment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The guide explicitly instructs creation of a persistent .learnings/ directory in the workspace or skill directory, enabling state to survive across sessions. Persistence is risky here because the skill's purpose is to capture errors and corrections, which can store untrusted or manipulative content that later influences behavior or leaks project context across tasks.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation directs the agent to promote learnings into persistent workspace files like SOUL.md, TOOLS.md, and AGENTS.md without warning that these are durable behavioral prompt inputs. This is dangerous because incorrect, adversarial, or user-injected content can become long-lived instruction context and influence future sessions beyond the original task.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger definitions are broad enough that the skill could activate and write persistent 'learnings' in many ambiguous situations, including normal corrections or routine tool failures. In a self-modifying or memory-writing skill, unclear activation boundaries increase the risk of unnecessary persistence, prompt poisoning, and accumulation of low-quality or adversarial data in workspace memory files.

Content

No source excerpt is available for this finding.