Self Improving Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:12 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it persistently changes agent behavior through learning logs, prompt-memory promotion, and optional hooks with broad triggers.

Install only if you want persistent learning memory and review any hook setup carefully. Prefer project-local hooks and learning files, avoid global ~/.claude or broad empty-match hooks unless you trust all affected workspaces, redact secrets before logging, and require human review before promoting entries into agent instruction files or extracting new skills.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:356

Finding

Untrusted learnings can be promoted into persistent agent-control files

Content

View full analysis

" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable ``` The project also identifies user corrections as learning inputs: ```markdown **Corrections** (→ learning with `correction` category): - "No, that's not right..." - "Actually, it should be..." - "You're wrong about..." - "That's outdated..." ``` ### Technical Analysis The Skill permits content originating from task summaries and user corrections to enter `.learnings/`, and subsequently recommends promoting recurring content into files such as `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `CLAUDE.md`. These files are described as agent context or system-prompt feedback and may be loaded into future sessions. The recurrence checks establish frequency, but not trustworthiness. Repeated att ...[truncated 1775 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Note

• Location: hooks/openclaw/handler.ts:76

Finding

Opt-in hooks inject Skill-controlled instructions into recurring agent context

Content

View full analysis

isObject(file) && file.path === REMINDER_PATH && !isInjectedReminderFile(file), ); if (occupiedByOtherFile) { return; } const cleanedBootstrapFiles = event.context.bootstrapFiles.filter( (file, index, files) => !isInjectedReminderFile(file) || files.findIndex((candidate) => isInjectedReminderFile(candidate)) === index, ); const reminderFile = { name: REMINDER_NAME, path: REMINDER_PATH, content: REMINDER_CONTENT, missing: false, virtual: true, }; const existingIndex = cleanedBootstrapFiles.findIndex((file) => isInjectedReminderFile(file)); if (existingIndex === -1) { cleanedBootstrapFiles.push(reminderFile); } else { cleanedBootstrapFiles[existingIndex] = reminderFile; } event.context.bootstrapFiles = cleanedBootstrapFiles; } ``` The prompt-submit hook also emits agent-directed instructions: ```bash cat << 'EOF' After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. EOF ``` ### Technical Analysis The OpenClaw hook modifies `event.context.bootstrapFiles` and inserts a virtual Markdown file containin ...[truncated 1930 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:107

Finding

Skill extraction output validation can be bypassed through symlink traversal

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script blocks absolute paths and lexical `..` components, but it does not resolve the canonical destination or reject symbolic links in existing path components. A relative path can therefore appear to remain under the current directory while resolving to a location elsewhere. For example, if `./skills-link` is a symbolic link to a writable directory outside the workspace, then: ```bash ./scripts/extract-skill.sh attacker-skill --output-dir ./skills-link ``` causes `mkdir -p` and shell redirection to operate through the symlink. The lexical checks pass because the supplied path is relative and contains no `..`. The script also performs a check-then-write sequence without exclusive creation or no-follow protection. This creates an additional race window in shared or attacker-writ ...[truncated 1361 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a logging/self-improvement utility, but it also instructs the agent to perform additional filesystem-changing behaviors such as hook setup, promotion into other prompt files, and skill extraction/scaffolding. This scope expansion matters because users or orchestrators may authorize it expecting passive note-taking, while it can materially alter agent behavior and persistent workspace state.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Directing users to place hook configuration in ~/.claude/settings.json grants persistent access through a high-trust agent configuration directory. Because this skill is explicitly about continuous self-improvement and automatic triggers, global config placement materially increases the risk of durable behavior changes and unintended execution across future sessions.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 181)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation guidance is broad enough to match common situations such as routine corrections, failures, or better approaches, making the skill likely to trigger in many ordinary interactions. Over-triggering is dangerous here because the skill performs persistent writes and may steer the agent toward modifying memory, hooks, or other context files without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 73% confidence

Finding

The skill establishes persistent storage under a workspace/home-style path, which creates durable records across sessions. Persistence is not inherently unsafe, but in a self-improvement skill it can accumulate sensitive conversational or operational data over time and make accidental retention more likely.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill includes instructions to view other sessions' history and send learnings across sessions, which exceeds simple local logging and introduces access to broader conversational data. Even though it says to use this only in trusted environments and with explicit user intent, embedding this capability in a generally activated self-improvement skill increases the chance of unnecessary transcript access or data propagation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The listed detection phrases are everyday conversational prompts that can be ambiguous outside the intended logging workflow. Using these as automatic triggers can cause unrequested persistence of user content, including sensitive context, into local files or promoted instruction files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill adds the ability to convert learnings into new reusable skills, which is a privilege expansion from simple note capture into creating new executable/prompted agent behaviors. That increases the risk of persistence and prompt-surface growth, especially if extracted skills are created from imperfect or adversarially influenced learning entries.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The guide encourages installing automatic hooks in persistent agent settings, which creates session-to-session behavior persistence. In this skill context, persistence is the core feature, so the risk is elevated: a mistaken, compromised, or overly broad hook can continuously influence future agent behavior without per-task reapproval.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Using an empty matcher for UserPromptSubmit causes the hook to trigger on every prompt, creating broad and persistent prompt injection into all sessions. In a self-improvement skill, this increases exposure of user inputs and expands the blast radius if the hook script is modified, compromised, or produces unsafe content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-level configuration in ~/.claude/settings.json enables the hook globally across projects without meaningful trigger constraints. This is more dangerous than project-local setup because it creates persistent cross-project execution of local scripts and can affect unrelated repositories, including sensitive workspaces.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Codex example also uses an empty matcher, which broadly applies the hook to all prompts. This creates unnecessary execution frequency and enlarges the impact of any unsafe script behavior or prompt-channel leakage introduced by the hook output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document states that the scripts 'only output text' and 'don't modify files or run commands,' but the configured hook type is a shell command that executes local scripts. This is dangerous because it can cause operators to underestimate the trust boundary and permissions of those scripts, leading them to enable code execution hooks more broadly than intended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

Creating a persistent workspace .learnings/ store increases the chance that sensitive operational context will accumulate across sessions. In this skill context, long-lived memory is core functionality, so without retention, minimization, and redaction controls it can expose prior prompts, failures, environment details, or secrets to later sessions or other local users.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guide encourages storing learnings in persistent .learnings/ files but does not warn against recording secrets, personal data, or sensitive command output. In a self-improvement skill, users may log errors, prompts, and tool failures that often contain tokens, internal paths, or other sensitive context, creating an avoidable retention and disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes commands that write into ~/.openclaw/skills/ and ~/.openclaw/hooks/, which affects the user's local agent configuration and filesystem state. The guide provides setup steps but does not explicitly warn that these commands modify persistent directories or may overwrite existing installations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This natural-language instruction directs the agent toward a specific communication style that suppresses disclaimers. As written, it applies broadly and does not indicate user choice or a justified, context-specific locale/policy exception.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.