Self-Improvement Plus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 2.0.0

Overview

This skill has a coherent self-improvement purpose, but it gives agents persistent memory-writing and optional hook execution patterns that need careful review before use.

Install only if you want durable agent memory in the workspace. Keep .learnings local and gitignored, do not store secrets in it, require explicit review before anything is promoted into agent instruction files, and do not enable hooks unless you have inspected the actual scripts and trust the installation source.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:359

Finding

Untrusted Conversation Content Can Poison Persistent Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 359-380 and 454-461
Vulnerability Type: Persistent agent memory poisoning
Risk Level: High

Vulnerable Code

markdown

### Promotion Rule (System Prompt Feedback)

Promote recurring patterns into agent context/system prompt files when all are true:

- `Recurrence-Count >= 3`
- Seen across at least 2 distinct tasks
- Occurred within a 30-day window

Promotion targets:
- `CLAUDE.md`
- `AGENTS.md`
- `.github/copilot-instructions.md`
- `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable

Write promoted rules as short prevention rules (what to do before/while coding),
not long incident write-ups.

The promotion policy is reinforced by the following instruction:

markdown

7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md

Technical Analysis

The skill treats conversation-derived corrections, observations, and recurring patterns as inputs to a persistent learning workflow. Those inputs may eventually be promoted into files such as CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, or SOUL.md, which can be automatically loaded as instructions in future agent sessions.

The recurrence requirements establish frequency but do not establish trustworthiness. There is no requirement to:

• Verify the identity or authority of the content source.
• Distinguish trusted project-owner guidance from attacker-controlled prompts.
• Review promoted content for conflicts with security policies.
• Require explicit human approval before modifying instruction-bearing files.
• Prevent promoted rules from authorizing tools, weakening validation, or overriding existing safeguards.
• Preserve provenance in the final instruction file.

The instruction to “promote aggressively” increases this risk by encouraging promotion when uncertainty remains. This creates a durable memory-poisoning channel rather than limiting learning ...[truncated 1373 chars]

Remediation

View remediation

Remediation Suggestions

1. Keep .learnings/ records informational and non-authoritative by default.
2. Require explicit project-owner approval before writing conversation-derived content into any automatically loaded instruction file.
3. Remove the “promote aggressively” policy and replace it with a conservative review requirement.
4. Record immutable provenance for every candidate, including source session, author or trust level, creation time, and approving reviewer.
5. Permit automatic promotion only from authenticated, explicitly trusted sources.
6. Add semantic validation that rejects rules which:
   • Weaken higher-priority safety or security controls.
   • Authorize new tools, network destinations, or credentials.
   • Request secret collection or reduced redaction.
   • Modify approval boundaries.
   • Instruct agents to ignore existing policies.
7. Store proposed promotions in a review queue or patch file instead of directly editing instruction-bearing files.
8. Require signed or reviewed changes to persistent agent configuration.
9. Ensure learned content can never override system, organization, or repository-owner policies.
10. Provide a rollback mechanism and an audit log for all promotions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50

Finding

Unpinned Third-Party Installation Is Combined with Persistent Hook Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50-59 and 493-543
Vulnerability Type: Insecure dependency installation and persistent hook execution
Risk Level: Medium

Vulnerable Code

markdown

### Installation

**Via ClawdHub (recommended):**
```bash
clawdhub install self-improving-agent

Manual:

bash

git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent

text

The installed content can then be registered for automatic execution:

```json
{
  "hooks": {
    "UserPromptSubmit": [{
      "matcher": "",
      "hooks": [{
        "type": "command",
        "command": "./skills/self-improvement/scripts/activator.sh"
      }]
    }],
    "PostToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "command",
        "command": "./skills/self-improvement/scripts/error-detector.sh"
      }]
    }]
  }
}

Technical Analysis

The installation instructions retrieve a package or clone the default state of a remote repository without pinning an audited release, immutable commit, cryptographic digest, or signature. The hook configuration then causes scripts from the installed content to execute automatically when prompts are submitted or after Bash tool use.

The audited project contains only SKILL.md; the referenced activator.sh and error-detector.sh files are not present. Their implementation therefore cannot be verified from the supplied artifact. The effective executable payload depends on external or locally installed content that may differ from the reviewed documentation.

The relative hook paths also depend on workspace layout and resolution behavior. If an attacker can replace files at those paths, the hook may execute attacker-controlled code under the agent process account.

Attack Path

1. A user follows the documented installation command, which retrieves an unpinned package or repository state.
2. The user configures the documented ` ...[truncated 1120 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to a specific audited release and immutable commit hash.
2. Publish and verify cryptographic checksums or signatures before installation.
3. Include every referenced hook script in the auditable skill artifact.
4. Require users to inspect and explicitly approve each script before enabling hooks.
5. Use canonical absolute paths and verify path ownership, file type, permissions, and expected digest before every execution.
6. Refuse to execute hook files that are writable by untrusted users or resolved through symbolic links outside the approved installation directory.
7. Run hooks with least privilege in a restricted environment without unnecessary credentials or network access.
8. Keep PostToolUse disabled by default and clearly document what portions of command output it receives.
9. Provide a straightforward command to disable and remove all installed hooks.
10. Revalidate script hashes when upgrading the package rather than silently following upstream changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Learning Logs Permit Plaintext Secret Persistence When Requested

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 24
Vulnerability Type: Plaintext storage of sensitive information
Risk Level: Medium

Vulnerable Code

markdown

Do not log secrets, tokens, private keys, environment variables, or full source/config files unless the user explicitly asks for that level of detail. Prefer short summaries or redacted excerpts over raw command output or full transcripts.

Technical Analysis

The instruction discourages sensitive logging but contains an explicit exception when a user asks for full detail. User consent does not make Markdown files an appropriate secret-storage mechanism. The .learnings/*.md files have no documented encryption, access-control enforcement, retention limit, or mandatory redaction.

Learning files may subsequently be committed to source control, included in backups, indexed by development tools, read by future agents, or referenced during cross-session communication. Private keys, tokens, environment variables, and secret-bearing configuration values can therefore persist beyond their intended lifetime.

The issue is especially significant because logging is triggered by failures and integration problems, where raw command output commonly contains request headers, connection strings, stack traces, environment values, and credentials.

Attack Path

1. A user, malicious prompt, or troubleshooting workflow requests complete command output, configuration, or environment details.
2. Relying on the documented exception, the agent writes secret-bearing content into .learnings/LEARNINGS.md or .learnings/ERRORS.md.
3. The plaintext file remains in the project or workspace.
4. The file is committed, backed up, indexed, read by a later agent, or shared with another session.
5. A party with access to that secondary channel obtains the persisted secret.
6. If the credential remains valid, it can be used against the service or resource for which it grants access.

Impact A

...[truncated 573 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the exception allowing secret logging at user request.
2. Establish an unconditional rule that tokens, passwords, private keys, session cookies, and secret environment values must never be written to learning files.
3. Apply mandatory redaction before persistence, including common credential formats, authorization headers, URLs containing credentials, and private-key blocks.
4. Store only short sanitized summaries and minimal reproduction metadata.
5. Reject or pause logging when safe redaction cannot be guaranteed.
6. Set restrictive filesystem permissions on .learnings/.
7. Keep learning files excluded from source control by default and enforce that policy through repository checks.
8. Run secret scanning before commits, cross-session sharing, exports, and backups.
9. Define retention and secure-deletion procedures for local learning records.
10. If sensitive troubleshooting artifacts are genuinely required, use a dedicated encrypted secret-management or incident-storage system rather than Markdown logs.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The OpenClaw setup directs creation of persistent files under ~/.openclaw/workspace/.learnings, which survives across sessions and can accumulate behavioral history or sensitive operational context. Even though the skill advises sanitization, persistence across sessions increases privacy and prompt-injection risk if later sessions consume this data automatically or without clear boundaries.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list uses very broad conversational phrases such as 'Can you also...', 'Is there a way to...', and 'Actually...' that commonly appear in normal user interactions. In an auto-activation workflow, this can cause the skill to log or modify local state unexpectedly, creating prompt-driven side effects and noisy persistence without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to create directories and files in the project or workspace root during first use, but the warning about filesystem modification is implicit rather than an explicit consent gate. That makes it easy for an agent to persist data locally in response to ordinary task flow, surprising users and violating least astonishment.

Content

No source excerpt is available for this finding.