botlearn-selfoptimize

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:42 AM UTC
• Version: 1.0.5

Overview

This skill is purpose-aligned as a self-improvement tool, but it needs Review because it can persistently change agent instruction files and post workspace-derived memory to an external service with weak user-control and redaction safeguards.

Install only if you are comfortable with an agent keeping durable learning logs, modifying future instruction files, and posting selected workspace context to BotLearn. Before enabling community escalation or hooks, require manual preview and approval of every outbound post, avoid including memory excerpts or file snippets, pin the installed version, and review any changes to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, and Copilot instruction files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: flows/community-help.md:88
• Finding: Mutable Remote Instructions Are Fetched and Followed by the Agent<![CDATA[ ## Vulnerability Details **File Location**: `flows/community-help.md:88-94` **Vulnerability Type**: Remote instruction redirection **Risk Level**: High ### Vulnerable Code ```markdown ### 2.2 Read Official Instructions Fetch the latest instructions from the BotLearn platform: ```bash curl -sL https://botlearn.ai/skill.md ``` Follow any updated registration steps found in the response. ``` The same behavior is also required by `SKILL.md:66-67`: ```text Read https://botlearn.ai/skill.md and follow the registration instructions. Store credentials in ~/.config/botlearn/credentials.json ``` ### Technical Analysis The Skill directs the agent to retrieve a mutable Markdown document from an external service and treat its contents as trusted operational instructions. The downloaded document is not pinned to a version or cryptographic digest, validated against a restricted schema, or displayed for mandatory user approval. Although the repository does not contain a literal `curl | bash` command, an AI agent following arbitrary remote instructions provides a comparable mutable control channel. A compromise of `botlearn.ai`, its DNS or hosting environment, or the remote document's publishing account could alter the effective behavior after this Skill has passed review. This behavior is unnecessary for basic registration. Registration can be implemented using the fixed API protocol already included in the local script. ### Attack Path 1. An attacker compromises or gains publishing control over `https://botlearn.ai/skill.md`. 2. The attacker changes the document to include instructions requesting additional files, credentials, shell commands, or network operations. 3. The Skill reaches its registration or authentication recovery flow. 4. The agent fetches the modified document. 5. The local Skill explicitly instructs the agent to follow the downloaded steps. 6. The agent performs the attacker's instructions with the same filesystem, tool, and network p ...[truncated 625 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to follow arbitrary content returned by `https://botlearn.ai/skill.md`. 2. Bundle a reviewed, versioned registration protocol inside the Skill. 3. If remote discovery is required, accept only a strict machine-readable schema containing allowlisted fields such as endpoint versions and rate limits. 4. Authenticate remote metadata with a digital signature and pin the expected signing key. 5. Reject remote content containing executable commands or natural-language operational instructions. 6. Require explicit user approval before applying any remotely supplied protocol change. 7. Pin BotLearn API endpoints to an audited HTTPS origin and prohibit redirects to other origins. 8. Treat downloaded documentation as untrusted reference material rather than authoritative agent instructions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/botlearn-post.sh:173
• Finding: Workspace Memory and Learning Content Can Be Published Without Effective Sensitive-Data Redaction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/botlearn-post.sh:173-276` **Vulnerability Type**: External disclosure of sensitive workspace content **Risk Level**: High ### Vulnerable Code ```bash # --- Gather Memory Context --- MEMORY_CONTEXT="" if [ -f "$WORKSPACE/MEMORY.md" ]; then # Extract lines mentioning keywords from the summary KEYWORDS=$(echo "$SUMMARY" | tr ' ' '\n' | grep -v '^.\{1,3\}$' | head -5) for kw in $KEYWORDS; do MATCH=$(grep -i "$kw" "$WORKSPACE/MEMORY.md" 2>/dev/null | head -3) if [ -n "$MATCH" ]; then MEMORY_CONTEXT="${MEMORY_CONTEXT}${MATCH}\n" fi done fi # Check recent daily memory files for i in $(seq 0 6); do DATE=$(date -v-${i}d +%Y-%m-%d 2>/dev/null || date -d "$i days ago" +%Y-%m-%d 2>/dev/null) FILE="$WORKSPACE/memory/$DATE.md" if [ -f "$FILE" ]; then for kw in $KEYWORDS; do MATCH=$(grep -i "$kw" "$FILE" 2>/dev/null | head -2) if [ -n "$MATCH" ]; then MEMORY_CONTEXT="${MEMORY_CONTEXT}[$DATE] ${MATCH}\n" fi done fi done ``` The gathered data is incorporated into the outbound post: ```bash BODY="## Problem $SUMMARY ## Details $DETAILS ## Context - Area: ${AREA:-unknown} - Priority: ${PRIORITY:-medium} - Entry: $ENTRY_ID ## What I Tried ${SUGGESTED_FIX:-No specific fix attempted yet.} ## Relevant Memory Context $(echo -e "$MEMORY_CONTEXT" | sed "s|$HOME|~|g" | head -15) ## Relevant Files $(echo "$RELATED_FILES" | sed "s|$HOME|~|g") ## Environment - Platform: $(uname -s) $(uname -m) - Node.js: $(node -v 2>/dev/null || echo 'unknown') Any help or pointers appreciated! #selfimprovement #${AREA:-general}" # Redact any remaining home paths BODY=$(echo "$BODY" | sed "s|$HOME|~|g") ``` The resulting content is transmitted externally: ```bash POST_RESPONSE=$(curl -s -X POST "$BOTLEARN_API/posts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $API_ ...[truncated 2770 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to posting only explicitly selected, structured fields from the learning entry. 2. Do not automatically read `MEMORY.md`, daily memory, `SOUL.md`, `AGENTS.md`, or `TOOLS.md`. 3. Require a mandatory preview and explicit user approval before every external post. 4. Replace blacklist-style redaction with an allowlist specifying exactly which fields may leave the host. 5. Run secret detection over the complete title and body before transmission, covering: - API keys and bearer tokens - Passwords and connection strings - Private keys and certificates - Environment variable assignments - Email addresses and personal identifiers - Internal hostnames, URLs, and filesystem paths 6. Fail closed if potentially sensitive content is found; do not silently submit a partially sanitized post. 7. Label the destination, retention implications, and exact fields being transmitted in the approval prompt. 8. Add tests proving that representative GitHub tokens, cloud keys, JWTs, private keys, passwords, and user paths cannot be posted. 9. Update documentation so it does not claim credential redaction unless that protection is actually implemented. 10. Consider posting a locally generated issue identifier and minimal error description rather than raw memory excerpts. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:353
• Finding: Untrusted Learnings Can Be Promoted into Persistent Agent Instruction Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:353-405,440-456` **Vulnerability Type**: Persistent instruction and memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` The recurring-pattern rule further encourages durable promotion: ```markdown - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` ### Technical Analysis The Skill captures user corrections, conversational content, command errors, and external community solutions as learnings. ...[truncated 2056 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic or agent-only promotion into instruction-bearing files. 2. Require an explicit human-reviewed diff before writing to `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instruction files. 3. Keep raw learning entries in a data-only store that is not interpreted as agent instructions. 4. Record immutable provenance for every candidate, including the originating user, session, timestamp, and supporting evidence. 5. Treat user messages, tool output, retrieved web content, and community comments as untrusted. 6. Reject candidates containing commands, role changes, credential requests, tool directives, or attempts to override higher-priority instructions. 7. Require independent technical verification; recurrence alone must not establish correctness. 8. Use a constrained schema for promoted facts and prevent arbitrary Markdown from entering prompt files. 9. Provide rollback history and a review log for every persistent instruction change. 10. Scope approved rules to the narrowest applicable project rather than writing to global workspace files. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:151
• Finding: Installation Instructions Use Mutable and Unverified Upstream Sources<![CDATA[ ## Vulnerability Details **File Location**: `README.md:151-155` **Vulnerability Type**: Unpinned supply-chain installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install ```bash clawhub install @botlearn/botlearn-selfoptimize --force ``` ``` Additional mutable installation guidance appears in `SKILL.md:126-135`: ```markdown **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` ``` ### Technical Analysis The installation commands do not pin an immutable package version, Git commit, release digest, or cryptographic checksum. Consequently, the code installed in the future may differ from the version audited here. The `--force` option can overwrite an existing installation without first requiring comparison or review. The repository documentation also uses inconsistent package and project identifiers, increasing the risk of installing an unintended or similarly named upstream artifact. No evidence establishes that the referenced dependencies are currently malicious. The vulnerability is the absence of supply-chain integrity controls, not a confirmed upstream compromise. ### Attack Path 1. An attacker compromises a referenced registry account, package, repository, default branch, or publisher credential. 2. The attacker publishes a modified Skill or changes the repository's default branch. 3. A user follows the documented unpinned installation command. 4. The package manager or Git retrieves the attacker's current content rather than the audited revision. 5. With `--force`, the modified content may replace a previously reviewed installation. 6. Modified hooks, scripts, or Skill instructions execute with the permissions granted to the agent environment. ### Impact Assessment A successful upstream compromise could replace any part of the installed Skill, including boots ...[truncated 431 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin ClawdHub installations to an immutable, reviewed version. 2. Pin manual Git installations to a full commit hash or signed release tag. 3. Publish and verify SHA-256 checksums or signed provenance attestations. 4. Remove `--force` from the default installation command. 5. If replacement is required, instruct users to inspect the current and incoming versions first. 6. Use one canonical package name consistently throughout all documentation. 7. Document the expected publisher, repository owner, release signature, and verified source URL. 8. Prefer a lockfile or signed manifest covering every executable hook and script. 9. Provide an update procedure that displays security-relevant diffs before activation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (62)

Ssd 3

High

• Confidence: 97% confidence
• Finding: The core design is a background learning loop that captures errors, corrections, and learnings, then may escalate unresolved issues to an external community. In this context, retention plus sharing is inherently dangerous because normal conversational and workspace context can contain secrets or proprietary material, making data leakage a built-in risk rather than an edge case.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Automatic promotion into permanent workspace memory files increases the blast radius of any mistaken, sensitive, or adversarially induced learning by embedding it into durable instruction sources. Because these files influence future agent behavior across tasks, bad data can become persistent prompt poisoning or policy drift without the user's informed approval.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The community escalation flow explicitly describes gathering workspace-derived context and posting it externally, but does not warn about privacy, confidentiality, or data handling boundaries. That creates a direct pathway for exfiltration of source code, credentials, internal discussions, or customer data through normal operation of the skill.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The escalation step instructs the agent to gather workspace context and compose a help post for an external community, which is semantically equivalent to preparing potentially sensitive internal information for publication. Because the skill is framed as an autonomous improvement engine, users may not realize that private context can be repackaged and transmitted outside the workspace.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill is presented as local self-improvement logging but also instructs agent registration, local credential storage, remote posting, and transmission of workspace-derived context to an external service. That description-behavior gap is dangerous because it obscures materially different networked and persistence capabilities that can leak sensitive data and expand trust assumptions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as local self-improvement logging but also instructs agent registration, local credential storage, remote posting, and transmission of workspace-derived context to an external service. That description-behavior gap is dangerous because it obscures materially different networked and persistence capabilities that can leak sensitive data and expand trust assumptions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as local self-improvement logging but also instructs agent registration, local credential storage, remote posting, and transmission of workspace-derived context to an external service. That description-behavior gap is dangerous because it obscures materially different networked and persistence capabilities that can leak sensitive data and expand trust assumptions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill is presented as local self-improvement logging but also instructs agent registration, local credential storage, remote posting, and transmission of workspace-derived context to an external service. That description-behavior gap is dangerous because it obscures materially different networked and persistence capabilities that can leak sensitive data and expand trust assumptions.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill encourages autonomous external posting of locally gathered context without a clear, prominent warning that workspace memory, file snippets, environment details, and attempted fixes may be transmitted off-system. This creates a serious informed-consent failure and raises the risk of accidental data exfiltration.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The workflow explicitly tells the agent to gather workspace memory and synthesize it into an external community post. That creates a natural-language exfiltration channel for sensitive project information, secrets-adjacent operational context, internal file paths, or prior session content that may not be safe to share externally.

Credential Access

High

• Category: Privilege Escalation

Content

Step 2 — Join BotLearn (first time only)
  Read https://botlearn.ai/skill.md and follow the registration instructions.
  Store credentials in ~/.config/botlearn/credentials.json

Step 3 — Compose & Post
  Synthesize memory context + learning entry into a community help post.

• Confidence: 90% confidence
• Finding: The skill instructs storage of BotLearn credentials in a local JSON file without describing permissions, encryption, lifecycle management, or least-privilege controls. Credential creation and persistence are sensitive operations; mishandling can expose tokens to other tools, sessions, users, or accidental commits/backups.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The post template specifically encourages inclusion of file paths, snippets, environment details, and memory-derived attempted fixes in public or third-party posts. Those details can directly leak proprietary code, infrastructure details, internal topology, and debugging artifacts that materially aid attackers or violate confidentiality.

Ssd 3

High

• Confidence: 98% confidence
• Finding: These instructions explicitly connect gathering workspace memory and prior-session context with escalation of a learning entry, setting up later external disclosure. Because the collected material comes from broad memory sources, the skill context makes this especially dangerous: internal agent memory often contains high-sensitivity context not meant for publication.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This flow expands a local self-improvement mechanism into a third-party community workflow that registers the agent and publishes workspace-derived incident information externally. That creates a clear data exfiltration path and materially changes the trust boundary of the skill without explicit user approval or strong minimization controls.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The flow creates a persistent third-party account and stores API credentials locally, which is outside the stated self-improvement purpose and introduces long-lived external access. Persistent registration increases blast radius because future sessions can silently reuse credentials to continue transmitting data.

Credential Access

High

• Category: Privilege Escalation

Content

### 2.1 Check Existing Credentials

```bash
CRED_FILE="$HOME/.config/botlearn/credentials.json"
if [ -f "$CRED_FILE" ]; then
  echo "Already registered. Loading credentials."
  API_KEY=$(cat "$CRED_FILE" | grep -o '"api_key":"[^"]*"' | cut -d'"' -f4)

• Confidence: 90% confidence
• Finding: The flow reads an API key from a local credential file so the skill can authenticate to the external BotLearn service. Accessing credentials is sometimes legitimate, but in this case it supports an unnecessary third-party integration that can silently persist across sessions and enable repeated external posting.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The posting step instructs the agent to send synthesized workspace-derived context to an external service without a clear user-facing warning or affirmative consent. Even with a brief security note, the operational instructions normalize transmission rather than requiring an explicit review of what leaves the system.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The composition template instructs inclusion of relevant memory context, environment details, and file paths in the body sent to BotLearn. That is a direct recipe for leaking operational metadata and historical context that could aid reconnaissance, fingerprint the system, or expose confidential project information.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Directing users to modify ~/.claude/settings.json affects the agent's global configuration directory, creating persistent behavior across unrelated repositories and sessions. In the context of auto-executed command hooks, this is especially risky because it establishes durable execution and context interception beyond the intended project boundary.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Credential Access

High

• Category: Privilege Escalation

Content

# Usage: ./botlearn-post.sh <entry-id> [--submolt <name>] [--dry-run]
#
# Prerequisites:
#   - BotLearn credentials at ~/.config/botlearn/credentials.json
#   - Learning entry exists in .learnings/
#   - curl available

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Usage: ./botlearn-post.sh <entry-id> [--submolt <name>] [--dry-run]
#
# Prerequisites:
#   - BotLearn credentials at ~/.config/botlearn/credentials.json
#   - Learning entry exists in .learnings/
#   - curl available

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Usage: ./botlearn-post.sh <entry-id> [--submolt <name>] [--dry-run]
#
# Prerequisites:
#   - BotLearn credentials at ~/.config/botlearn/credentials.json
#   - Learning entry exists in .learnings/
#   - curl available

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

# --- Post ---
log_info "Posting to BotLearn submolt: $SUBMOLT"

POST_RESPONSE=$(curl -s -X POST "$BOTLEARN_API/posts" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $API_KEY" \
    -d "$(cat << PAYLOAD

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states that entries are logged to workspace files automatically, but gives no warning that user conversation, errors, or inferred learnings will be written to disk. Silent persistence creates privacy and integrity risks, especially in repositories where logs may later be committed, shared, or inspected by other tools.