T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:17- Finding
Conversation-Derived Learnings Can Poison Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent 1.0.5
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed self-improvement logger, but it encourages persistent agent-memory changes, broad hooks, and cross-session reuse without enough consent or redaction guidance.
Install only if you intentionally want persistent learning files and possible changes to future agent instructions. Keep .learnings local or gitignored unless reviewed, redact secrets and private data before logging, avoid user-level hooks, use narrow hook matchers, and require human approval before promoting any learning into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or copilot-instructions.md.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:153- Finding
Error Logging Guidance Can Persist Credentials and Sensitive Tool Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description describes a memory/learning capture feature for recording errors, corrections, failures, and improved approaches. The supplied code does not implement learning capture, review, or continuous-improvement logic. Instead, it is a command-line helper that creates a new skill scaffold on disk from a skill name, including a templated SKILL.md file. This is a materially different primary purpose and includes undeclared file-creation behavior. While the template mentions that the skill was extracted from a learning entry, the script itself does not parse, store, or analyze learnings; it only scaffolds files. Therefore the description does not accurately represent the code's actual behavior.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Instructing users to modify ~/.claude/settings.json establishes persistence in the agent’s configuration directory, which is a sensitive trust boundary. If a malicious or later-compromised script path is referenced there, it will be automatically invoked in future sessions, making this significantly more dangerous than a one-off project setting.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill repeatedly instructs the agent to persist user corrections, requests, and contextual details to markdown files, but it provides no warning or filtering guidance for secrets, personal data, tokens, or confidential business information. In practice, this can cause sensitive user input to be stored locally or in-repo in plain text and later exposed through commits, backups, indexing, or other agents reading those files.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The inter-session features encourage viewing transcript history and sending learnings between sessions without any user-facing consent, access-control, or data-minimization warning. That creates a clear pathway for conversation contents to be reused or disclosed across contexts where users may not expect their prompts, outputs, or embedded secrets to travel.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Cross-session transcript reading and message passing increase the blast radius of any sensitive information already present in a session by normalizing reuse across agents or conversations. Even if intended for productivity, this can expose conversation content beyond its original scope and undermine user expectations of compartmentalization.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The logging instructions explicitly encourage storing 'full context' and source details, which often includes raw prompts, errors, filenames, environment details, and user-provided content. Without redaction guidance, this creates durable plain-text records of potentially sensitive information that may later be searched, synced, or committed.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Feature request logging asks the agent to persist what the user wanted and why they needed it, which can capture business goals, internal workflows, unmet security needs, or sensitive project plans. Storing this material in plain markdown without safeguards increases the risk of privacy leakage and operational intelligence exposure.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
Project-level hook setup introduces session-persistent automated behavior that continues across future agent interactions in that repository. While persistence is part of the feature, it is still security-relevant because it changes future execution context and can silently keep invoking local shell scripts after the initial setup is forgotten.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
An empty matcher causes the UserPromptSubmit hook to trigger on every prompt, creating very broad automatic execution scope. In a skill that installs shell-command hooks, this increases the chance of unnecessary context injection, privacy exposure, or abuse if the hooked script is modified or replaced.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The user-level configuration installs the hook in ~/.claude/settings.json, causing broad persistent activation across repositories and sessions without meaningful constraints. This amplifies the blast radius of any bug, script tampering, or unintended data capture because the command hook runs in many more contexts than necessary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The repeated empty matcher in the minimal setup example normalizes unconstrained triggering and makes insecure broad scope appear standard. Because this skill is about continuous self-improvement and reminders, users may enable it reflexively, leading to persistent automatic command execution on unrelated prompts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document’s security section materially understates execution risk by claiming the scripts only output text and do not run commands, while the hooks are explicitly configured as command hooks and one referenced script can create scaffolding. Misleading security claims can cause users to grant trust and install persistent hook execution without understanding the actual capability and privilege level of those scripts.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document promotes cross-session transcript access and messaging without any privacy, consent, or data-handling guidance. In an agent environment, normalizing unrestricted reading and forwarding of session history can lead to inadvertent disclosure of sensitive prompts, secrets, or user data across sessions.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file includes filesystem-changing setup commands such as copying skill and hook directories and creating
.learnings/directories. Because the document does not disclose that these steps alter local OpenClaw configuration and create persistent storage for learned content, users are not explicitly warned about system and data persistence effects.- Content
Static analysis
No suspicious patterns detected.