T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:15- Finding
Untrusted conversation content can poison persistent agent instruction files
- Content
View full analysis
- Remediation
View remediation
Security audit
Chen Self Improvement
Security checks for vulnerabilities and agentic risk
Overview
The skill is not overtly malicious, but it persistently records and promotes conversation-derived learnings into future agent context with broad hook examples and weak review/redaction guidance.
Install only if you want a persistent learning-memory workflow. Keep hooks project-local, avoid global always-on settings, add a restrictive matcher, keep .learnings ignored by default, redact secrets and private data before logging, and require human review before anything is promoted into AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or Copilot instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:167- Finding
Error-learning workflow can persist credentials and confidential command output
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:34- Finding
Installation instructions retrieve mutable, unverified skill content
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description suggests a mechanism for recording lessons learned, corrections, failures, and reviewing those learnings for future tasks. The supplied code does not capture, store, review, or manage learnings directly. Instead, it generates a new skill scaffold on the filesystem from a skill name, including a templated SKILL.md file, and advises the user to manually fill in content from an existing learning entry. This is a materially different primary purpose: skill extraction/scaffolding rather than continuous-improvement learning capture. The filesystem write behavior is also an undeclared capability relative to the description.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The hook configuration uses an empty matcher for UserPromptSubmit, which causes the activator to run on every prompt. Always-on prompt hooks materially increase attack surface for prompt injection, create unnecessary persistent evaluation of all user inputs, and can lead to overcollection or unintended state changes on every interaction.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The second example repeats the same empty UserPromptSubmit matcher, preserving the always-on behavior even in the fuller configuration. Combined with PostToolUse automation, this can create pervasive monitoring and logging behavior across both prompts and command executions, amplifying privacy and persistence risks.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Instructing users to modify ~/.claude/settings.json establishes persistence in an agent configuration directory, which can affect future sessions and unrelated projects. In the context of executable command hooks, this is more dangerous than ordinary documentation because it creates a durable execution path in a trusted control plane for the agent.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Placing an always-on empty-matcher hook in ~/.claude/settings.json makes the behavior global and persistent across projects and sessions. That broadens the blast radius from one repository to all agent usage, so any unsafe behavior in the script or future modifications affects every prompt everywhere.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description and early guidance define many broad activation conditions, which can cause the agent to invoke the skill in situations only loosely related to errors or corrections. In agent systems with automatic skill loading, overbroad triggers increase prompt-surface area and can cause unintended logging, persistence of sensitive context, or workflow disruption.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 79% confidence
- Finding
The skill instructs creation of persistent files under ~/.openclaw/workspace/.learnings, enabling retention of interaction-derived data across sessions. Session persistence is not inherently malicious, but it becomes security-relevant because the same document encourages broad automatic triggering and promotion of learnings into higher-trust memory files, increasing the chance that sensitive or adversarial content is stored long-term.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The detection triggers include common conversational phrases like 'Can you also...' and 'Is there a way to...' without requiring a clear self-improvement context. This can cause frequent unintended invocation and persistent logging of ordinary user interactions, which is risky when logs are retained across sessions or promoted into memory files.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
Creating .claude/settings.json in the project root introduces session-persistent behavior for anyone using that repository with the agent. While less severe than user-level persistence, it can still silently alter agent behavior across future sessions and collaborators if committed or copied, especially because the hooks execute commands automatically.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
An empty matcher on UserPromptSubmit causes the hook to run for every prompt, creating broad automatic execution with no scoping. In a self-improvement skill, that means untrusted user input and session activity can continually trigger local scripts, increasing exposure to prompt-driven side effects, data collection, or resource overhead.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'minimal setup' still installs an always-triggering hook, so it reduces only one dimension of overhead while preserving unrestricted activation. Users may interpret 'minimal' as safer, when in practice it still enables automatic execution on every prompt.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Codex CLI example repeats the empty matcher pattern, causing hook execution on all prompts in that environment as well. This propagates the same overbroad trigger design across tools, increasing the chance of unintended execution and making the risky pattern easier to adopt widely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document's security section is internally inconsistent: it says the hook scripts 'only output text' and 'don't modify files or run commands,' yet the setup explicitly installs them as command hooks and separately instructs users to execute another script. This can mislead users into granting trust or permissions under false assumptions, reducing scrutiny of code that will execute automatically in the agent environment.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The setup guide explicitly creates a persistent .learnings directory in the workspace or skill directory, encouraging retention of operational and conversational artifacts across sessions. In the context of a self-improvement skill that records failures, corrections, and tool issues, this can accumulate sensitive data, prompt-injection residue, or misleading instructions that affect later sessions.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document instructs promoting learnings into persistent workspace files such as SOUL.md, TOOLS.md, and AGENTS.md without warning that these files may be injected into future sessions or read across workflows. This creates a privacy and prompt-integrity risk because sensitive, user-specific, or attacker-influenced content could be retained and later reused beyond the original context.
- Content
Static analysis
No suspicious patterns detected.