Security audit

testaaa

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it can persist conversation-derived learnings into future agent instructions and broad always-on hooks without enough approval gates.

Install only if you want persistent self-improvement logs and future-agent reminders. Prefer project-local setup, avoid the global hook example, review hook scripts before enabling them, and require explicit user approval before promoting any learning into AGENTS.md, CLAUDE.md, Copilot instructions, SOUL.md, or TOOLS.md.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:366
Finding: Untrusted Learnings Can Be Promoted into Persistent Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:40-43`, `SKILL.md:366-380` **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: High ### Vulnerable Code Snippets ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` ### Technical Analysis The Skill records information derived from conversations, user corrections, command errors, and tool behavior. It then directs the agent to promote recurring or broadly applicable entries into files such as `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `CLAUDE.md`, and Copilot instructions. These files may be loaded automatically as agent context in later sessions. The promotion process therefore crosses a trust boundary: potentially attacker-influenced conversational content is transformed into persistent instructions. The documented recurrence threshold establishes frequency but does not establish trustworthiness. An attacker can repeat the same crafted correction across tasks or induce similar entries until it qualifies for promotion. The workflow does not require explicit approval from a trusted user, provenance validation, content allowlisting, or a security revi ...[truncated 1408 chars]
Remediation: ## Remediation Suggestions 1. Require explicit, informed user approval before every modification to persistent agent-context files. 2. Never promote instructions supplied directly by untrusted users, external content, command output, or cross-session messages without independent verification. 3. Preserve provenance for each learning, including its originating session, source type, author, and supporting evidence. 4. Restrict automatic promotion to factual, project-scoped observations. Prohibit automatic promotion of behavioral directives, tool-execution rules, security-policy changes, or instructions that weaken safeguards. 5. Present the exact proposed diff to the user before writing to `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `CLAUDE.md`, or Copilot instructions. 6. Treat recurrence only as a prioritization signal, not as proof that content is trustworthy. 7. Validate proposed instructions against a denylist covering credential access, external transmission, disabling security controls, destructive operations, and automatic execution. 8. Prefer a separate review queue for promotion candidates instead of allowing the agent to write directly into automatically loaded context files.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract-skill.sh:96
Finding: Relative Output Validation Can Be Bypassed Through Symbolic Links## Vulnerability Details **File Location**: `scripts/extract-skill.sh:96-109`, `scripts/extract-skill.sh:165-177` **Vulnerability Type**: Symlink-based filesystem path escape **Risk Level**: Medium ### Vulnerable Code Snippets ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" ``` ```bash # Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE --- name: $SKILL_NAME description: "[TODO: Add a concise description of what this skill does and when to use it]" --- ``` ### Technical Analysis The script attempts to constrain output to the current workspace by rejecting absolute paths and lexical `..` path segments. However, it does not canonicalize the destination or reject symbolic links in existing path components. A path can therefore be lexically relative while resolving outside the current directory. For example, if `skills/link` is a symbolic link to `/tmp/external`, the accepted output directory `skills/link` resolves outside the workspace. `mkdir -p` and the shell redirection subsequently follow that symbolic link. This is a path-validation weakness rather than command injection: arguments are quoted and the skill name is restricted to lowercase letters, numbers, and hyphens. The exploitable operation is the unchecked filesystem resolution of the output directory. ### Attack Path 1. An attacker controls or can modify a workspace in which the helper will run. 2. The attacker creates a symbolic ...[truncated 1199 chars]
Remediation: ## Remediation Suggestions 1. Resolve the current workspace and output parent to canonical paths with `realpath` or an equivalent platform-safe mechanism. 2. Verify that the canonical destination begins with the canonical workspace path followed by a path separator. 3. Reject any existing symbolic link in every output-path component, rather than checking only for lexical `..` segments. 4. Create the destination one component at a time and verify each component with `lstat`. 5. Use no-follow semantics where available when opening the output file. 6. Avoid the check-then-write race by creating the destination securely and opening the file atomically with exclusive creation. 7. A suitable validation pattern should conceptually enforce: ```bash workspace="$(realpath -P .)" parent="$(realpath -P "$SKILLS_DIR")" case "$parent/" in "$workspace/"*) ;; *) log_error "Resolved output directory escapes the workspace"; exit 1 ;; esac ``` 8. Add automated tests covering parent-directory symlinks, nested symlinks, broken symlinks, absolute paths, `..` segments, and concurrent path replacement.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes a reflective/record-keeping skill for capturing learnings, errors, corrections, and reviewing them later. The supplied code does not capture, store, analyze, or review learnings. Instead, it is a project scaffolding utility that creates a new skill directory and populates a SKILL.md template based on a skill name. This is a materially different primary purpose and includes filesystem creation behavior that is undeclared. Although the template mentions a source learning entry, the script itself does not extract content from learnings; it only creates a blank scaffold with TODO placeholders. Therefore the description does not accurately represent the code's actual behavior.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Writing hook configuration to ~/.claude/settings.json establishes persistent, user-wide execution of local scripts from the agent configuration directory. In this context, that is more dangerous because the skill's purpose is to inject itself into future sessions, so compromise, misconfiguration, or later script tampering can affect all projects and prompts until manually removed.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill encourages very broad activation conditions such as using it whenever the agent notices errors, corrections, outdated knowledge, or better approaches. In practice, this can cause over-activation on ordinary conversation patterns and lead to unnecessary logging, file writes, and persistence of user interaction details without sufficiently narrow consent boundaries.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 81% confidence
Finding: The skill directs creation of persistent files under `~/.openclaw/workspace/.learnings`, enabling cross-session retention of errors, corrections, and other potentially sensitive operational context. Even though the document warns against storing secrets, the persistence mechanism increases privacy and data retention risk if users or agents log sensitive details or if multiple sessions can access the shared workspace.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger phrases include common language like 'Can you also...', 'Is there a way to...', and 'Actually...' that appears frequently in benign chat. This can spur unintended skill activation and persistence of conversation-derived data, especially when combined with auto-logging and promotion guidance.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 82% confidence
Finding: Creating .claude/settings.json in the project root introduces session-persistent hook behavior that survives across future agent runs in that repository. In a self-improvement skill, persistence is the point, but it also means an unsafe or overly broad hook can continue influencing later sessions without fresh user awareness.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Using an empty matcher on UserPromptSubmit causes the hook to run for every prompt, greatly widening the trigger surface. In this skill context, that means self-improvement reminders may be injected into all sessions and tasks, increasing exposure to sensitive prompt content and making unintended persistence or data capture more likely if the script behavior changes.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The global user-level example combines an empty matcher with installation in ~/.claude/settings.json, causing the hook to run across essentially all prompts and projects. That broad scope increases the blast radius of any buggy, over-collecting, or later-modified script and makes the persistence more dangerous than a project-scoped configuration.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Although labeled 'minimal,' this setup still uses an empty matcher, so it triggers on every submitted prompt. Reducing the number of hooks lowers overhead, but not the overly broad activation scope, which still creates unnecessary collection and execution opportunities.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The Codex CLI example repeats the empty matcher pattern, so the hook executes for all prompts in that environment as well. Because the skill is designed for continuous self-improvement and learning capture, broad activation makes it more likely to process unrelated or sensitive interactions unnecessarily.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The security section asserts that hook scripts 'don't modify files or run commands,' but the document explicitly configures those scripts as command hooks and also documents directly invoking an extract script. This misleading assurance can cause operators to under-trust the execution risk of installed hooks and approve them with broader permissions or less review than warranted.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The statement that scripts 'only output text' conflicts with the documented extract script behavior that scaffolds a skill, which implies file creation or modification. In a security-sensitive setup guide, such contradictions are dangerous because they normalize unsafe assumptions about what hooked scripts are allowed to do.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: In the markdown file's trigger section, 'Knowledge gaps' does not define what observable condition qualifies as a trigger or when it should not apply. Because it is a common, subjective condition during many normal interactions, it risks over-broad invocation of the learning workflow.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The phrase 'Model behavior surprise' is subjective and does not specify what kinds of behavior deviations should trigger logging versus normal variance. Without examples or exclusion conditions, different operators may interpret it inconsistently, leading to unintended or excessive trigger activation.

Static analysis

No suspicious patterns detected.