ClawHub
Back to skill

Security audit

321

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed self-improvement logger, but it should be reviewed because it encourages broad persistent agent-memory changes, always-on hooks, and cross-session context sharing without enough guardrails.

Install only if you want persistent self-improvement memory. Keep learnings project-local, redact secrets and user data before saving, avoid the global hook setup, use narrow hook matchers, and require human review before changing `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instruction files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:439
Finding

Untrusted Learnings Can Be Promoted into Persistent Agent Instruction Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:439-447
Additional Locations: SKILL.md:23-26, SKILL.md:262-289, SKILL.md:351-360, hooks/openclaw/handler.ts:19-24, hooks/openclaw/handler.js:18-23
Vulnerability Type: Persistent agent memory and instruction poisoning
Risk Level: High

Vulnerable Code

markdown
## Best Practices

1. **Log immediately** - context is freshest right after the issue
2. **Be specific** - future agents need to understand quickly
3. **Include reproduction steps** - especially for errors
4. **Link related files** - makes fixes easier
5. **Suggest concrete fixes** - not just "investigate"
6. **Use consistent categories** - enables filtering
7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md
8. **Review regularly** - stale learnings lose value

Related promotion destinations are explicitly defined as follows:

markdown
| Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` |
| Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) |
| Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) |
| Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) |

The bootstrap reminder reinforces these destinations:

typescript
**Promote when pattern is proven:**
- Behavioral patterns → \`SOUL.md\`
- Workflow improvements → \`AGENTS.md\`
- Tool gotchas → \`TOOLS.md\`

Technical Analysis

The Skill captures information originating from conversations, user corrections, command failures, and tool behavior. It then instructs the agent to promote selected information into files such as CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, and .github/copilot-instructions.md.

These files can function as persistent agent instructions and may be loaded into future sessions. The promotion workflow does not require a human ...[truncated 1882 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the “promote aggressively” instruction and make promotion opt-in and conservative.
  2. Require explicit human approval before modifying CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files.
  3. Store raw learnings as non-executable data that is never automatically interpreted as agent policy.
  4. Attach provenance to every entry, including source session, author, timestamp, related task, and reviewer.
  5. Reject promotions containing behavioral overrides, security-policy changes, tool-execution instructions, secret-handling rules, or unrelated commands.
  6. Use an allowlisted schema for promoted content and separate factual project notes from agent instructions.
  7. Present a reviewable diff before any persistent instruction file is changed.
  8. Require corroboration from trusted project documentation or reviewed code before promoting user-provided claims.
  9. Provide a rollback mechanism and audit log for every promotion.

T01 · Skill Instruction Hijacking

Warning
Location
hooks/openclaw/handler.js:28
Finding

Hooks Repeatedly Inject Skill-Controlled Instructions into Agent Context

Content
View full analysis

Vulnerability Details

File Location: hooks/openclaw/handler.js:28-52
Additional Locations: hooks/openclaw/handler.ts:28-59, scripts/activator.sh:7-19, SKILL.md:471-515
Vulnerability Type: Automatic instruction injection through prompt and bootstrap hooks
Risk Level: Medium

Vulnerable Code

javascript
const handler = async (event) => {
  // Safety checks for event structure
  if (!event || typeof event !== 'object') {
    return;
  }

  // Only handle agent:bootstrap events
  if (event.type !== 'agent' || event.action !== 'bootstrap') {
    return;
  }

  // Safety check for context
  if (!event.context || typeof event.context !== 'object') {
    return;
  }

  // Inject the reminder as a virtual bootstrap file
  // Check that bootstrapFiles is an array before pushing
  if (Array.isArray(event.context.bootstrapFiles)) {
    event.context.bootstrapFiles.push({
      path: 'SELF_IMPROVEMENT_REMINDER.md',
      content: REMINDER_CONTENT,
      virtual: true,
    });
  }
};

The prompt hook also emits instructions as context after every configured prompt:

bash
# Output reminder as system context
cat << 'EOF'
<self-improvement-reminder>
After completing this task, evaluate if extractable knowledge emerged:
- Non-obvious solution discovered through investigation?
- Workaround for unexpected behavior?
- Project-specific pattern learned?
- Error required debugging to resolve?

If yes: Log to .learnings/ using the self-improvement skill format.
If high-value (recurring, broadly applicable): Consider skill extraction.
</self-improvement-reminder>
EOF

Technical Analysis

When enabled, the OpenClaw hook inserts a virtual bootstrap file containing Skill-controlled instructions. The separate activator hook is designed to inject another reminder after each user prompt. This changes agent context without requiring a ...[truncated 1943 chars]

Remediation
View remediation

Remediation Suggestions

  1. Restrict the hooks to explicit Skill invocations or narrowly defined, user-approved events.
  2. Clearly mark hook output as advisory and untrusted rather than system-level instructions.
  3. Require confirmation before the agent writes learning records, changes persistent instructions, or extracts a new Skill.
  4. Apply identical session-scope controls to the JavaScript and TypeScript handlers, including the sub-agent exclusion.
  5. Generate the JavaScript artifact from the reviewed TypeScript source to prevent implementation drift.
  6. Add tests confirming that unsupported events, malformed contexts, and sub-agent sessions do not receive injected content.
  7. Provide configuration controls to disable promotion, persistent writes, or Skill extraction independently.
  8. Display enabled hooks and their injected content to the user at session startup.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:34
Finding

Installation Instructions Retrieve Mutable Third-Party Content without Integrity Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:34-44
Additional Location: references/openclaw-integration.md:31-41
Vulnerability Type: Unpinned package and repository installation
Risk Level: Medium

Vulnerable Code

markdown
### Installation

**Via ClawdHub (recommended):**
```bash
clawdhub install self-improving-agent

Manual:

bash
git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent

Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement

text

### Technical Analysis

The recommended package installation does not specify a version, digest, or signature. The manual Git installation clones the repository's current default branch rather than a reviewed commit or signed release.

As a result, the content installed by a future user can differ from the content audited here. This is especially significant because the package contains shell scripts and agent hooks that run with the hosting agent's permissions once enabled.

No evidence was found that the currently reviewed repository retrieves and executes a remote payload at runtime. The risk instead arises at installation time from mutable third-party sources and the absence of integrity verification.

### Attack Path

1. An attacker compromises the package publisher account, package registry entry, GitHub account, repository, or an upstream maintainer workflow.
2. The attacker publishes or commits a modified version containing malicious hook or script logic.
3. A user follows the documented unversioned `clawdhub install` or default-branch `git clone` command.
4. The user receives the modified content rather than the version reviewed in this audit.
5. The user enables a hook or invokes a bundled script.
6. The malicious replacement executes with the permi
...[truncated 563 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the ClawdHub installation to an immutable, reviewed version.
  2. Pin manual Git installation to a full commit hash or signed release tag.
  3. Publish SHA-256 checksums for release artifacts and document mandatory verification steps.
  4. Sign releases and verify signatures against a documented maintainer key.
  5. Identify one canonical repository and publisher; avoid ambiguous references to forks or predecessor repositories.
  6. Review installed hook and script contents before enabling execution.
  7. Use a lockfile or trusted manifest recording the exact package version and artifact digest.
  8. Document an update process that repeats security review and integrity verification before replacing an installed version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about maintaining a learning/error-correction memory process: capturing failures, user corrections, outdated knowledge, and better approaches for future improvement. The supplied code does not implement that behavior. Instead, it is a helper utility for creating a new skill scaffold on disk from a skill name, including directory creation and a templated SKILL.md file. While the generated template references a 'learning entry' as source material, the script itself neither captures learnings nor reviews them before tasks. Its primary purpose is materially different: skill extraction/scaffolding, not continuous-improvement logging or retrieval. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The cross-session features explicitly encourage reading another session's transcript and sending learnings between sessions, creating a direct pathway for context leakage across isolation boundaries. Without strict access controls, consent, and sanitization, one session can expose sensitive material from another session to unrelated tasks or agents.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The error template explicitly tells the agent to record actual error output, input/parameters, and environment details, which are common carriers of secrets such as API keys, bearer tokens, file paths, stack traces, internal hostnames, and customer data. Because these logs are persistent markdown files, a one-time leak becomes durable and may later be committed, indexed, or surfaced to other agents.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Directing users to modify ~/.claude/settings.json establishes persistence in an agent configuration directory, which can affect all future sessions. In the context of command hooks, this is more dangerous than ordinary documentation because it creates durable execution behavior and potential cross-project data exposure from a single setup step.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The user-level configuration combines global installation in ~/.claude/settings.json with an empty matcher, making the hook execute across all sessions and projects. Because the hook runs as a command and the skill is designed for persistent self-improvement capture, this greatly increases exposure to unintended data collection, prompt leakage, and cross-project persistence.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill repeatedly encourages persisting conversation details, corrections, and learnings into durable files and promoting them into wider agent context files, but it provides no data minimization or redaction rules. In practice, this can capture secrets, personal data, internal URLs, credentials in error text, or sensitive business context and then spread them to future sessions and tools.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill directs creation of persistent workspace files under a home-directory path, which increases retention of potentially sensitive operational history across sessions. Persistence is not inherently unsafe, but in this skill's context it amplifies the impact of over-collection by making sensitive data durable and likely to be reused or discovered later.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Persisting detailed user context and requested capabilities without privacy constraints can retain unnecessary personal, proprietary, or confidential information beyond the original interaction. Although less acute than raw error logging, it still creates a durable record of user intent and context that may later be reused or exposed inappropriately.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The listed detection triggers include very common phrases such as "Can you also..." and "Is there a way to...", which appear in ordinary user requests outside the narrow scope of self-improvement logging. Because the section says to automatically log when these are noticed, the activation boundary is too broad and lacks exclusion conditions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Phrases like "Remember this pattern" and "This would be useful for other projects" are broad conversational statements that could arise in many contexts. The file does not provide clear limits or negative examples distinguishing when these statements should trigger skill extraction versus normal discussion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown template tells authors to 'Include trigger conditions' but provides no requirement for specificity, scope limits, or negative examples. Because this file is itself a template for future skill manifests, it may propagate ambiguous invocation language into generated skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The placeholder 'What this skill does and when to use it.' gives no instruction to make activation conditions precise or narrowly scoped. In a template context, this omission can result in descriptions that overlap with common requests and unintended invocations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This description placeholder again asks only for a general statement of purpose and timing, without constraining trigger scope. As a reusable template, it does not steer authors away from broad phrases that could match everyday speech.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

Creating .claude/settings.json in the project root introduces persistent agent behavior for anyone using that repository, rather than a one-off action for a single session. In a self-improvement skill that injects reminders and reacts to tool failures, repository-level persistence can surprise collaborators and cause unintended execution in future sessions.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Using an empty matcher on UserPromptSubmit causes the hook to fire on every prompt, regardless of task sensitivity or relevance. In this skill context, that creates pervasive prompt interception and automatic context injection, which broadens the blast radius of any buggy, over-collecting, or later-modified hook script.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Although presented as 'minimal,' this setup still enables the hook for every prompt via an empty matcher. That means reduced overhead but not reduced scope, so the same risks of universal triggering, unwanted prompt processing, and silent behavior injection remain.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Codex CLI example repeats the empty matcher pattern, causing command-hook execution on every prompt in that environment as well. Reusing this broad trigger across agent platforms makes the risky behavior portable and easier to normalize, increasing the chance of widespread unintended activation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document states that hook scripts 'only output text' and 'don't modify files or run commands,' but the same guide configures those scripts as command hooks and also documents invoking an extraction script that can create scaffolding. This mismatch can mislead operators into granting trust or broader deployment under false assumptions, increasing the chance that command-executing hooks are enabled without proper review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

Creating a persistent .learnings/ store is a real session-persistence risk because the skill is specifically designed to retain and reuse prior content across runs. In this context, persistence increases the chance that sensitive data, erroneous conclusions, or injected instructions survive beyond the original interaction and influence future behavior.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document instructs the agent to persist learnings into workspace and behavioral prompt files without warning that these files are durable, later injected into model context, and may contain sensitive or attacker-influenced content. This creates privacy, integrity, and prompt-injection risks because mistakes or hostile text can become long-lived instructions affecting later sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger descriptions are broad enough that the self-improvement skill may activate on many normal interactions, including generic tool errors or vague 'knowledge gaps.' In a skill that writes persistent learnings and promotes them into injected workspace files, over-triggering can amplify bad data, prompt-injected content, or user-sensitive information into future sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.