自我成长

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:49 PM UTC
• Version: 1.0.1

Overview

The skill is a disclosed self-improvement logger, but it asks agents to retain session-derived content, install always-on hooks, and promote learnings into persistent agent instruction files with weak safeguards.

Install only if you want persistent agent self-improvement behavior. Keep hooks project-local, avoid empty matchers where possible, review any hook script before enabling it, redact secrets and personal data before logging errors or context, and require explicit human review before promoting anything into agent instruction files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: hooks/openclaw/handler.ts:10

Finding

Persistent Bootstrap and Prompt-Submission Instruction Injection

Content

View full analysis

{ if (!event || typeof event !== 'object') { return; } if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } if (!event.context || typeof event.context !== 'object') { return; } const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The prompt-submission hook additionally emits: ```bash cat << 'EOF' After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Con ...[truncated 1741 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:347

Finding

Untrusted Observations Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` The bootstrap reminder reinforces the same behavior: ```typescript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` ### Technical Analysis The Skill treats user corrections, command failures, tool output, and conversation-derived observations as candidates for promotion into files that are automatically loaded as instructions in future Agent sessions. These source channels may be attacker-controlled or merely incorrect. Recurrence counting does not establish trustworthiness: an attacker can repeat the same claim across tasks, and multiple occurrences of malicious or inaccurate content do not make it safe. The instruction to “promote aggressively” further weakens the review boundary. On ...[truncated 1189 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/error-detector.sh:4

Finding

Raw Tool Error Output May Be Persisted and Committed Without Redaction

Content

View full analysis

A command error was detected. Consider logging this to .learnings/ERRORS.md if: - The error was unexpected or non-obvious - It required investigation to resolve - It might recur in similar contexts - The solution could benefit future sessions Use the self-improvement skill format: [ERR-YYYYMMDD-XXX] EOF fi ``` The prescribed format requests raw output: ```markdown ### Error ``` Actual error message or output ``` ``` Repository tracking is also presented as an option: ```markdown **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` ### Technical Analysis The detector reads the complete `CLAUDE_TOOL_OUTPUT` value to decide whether an error occurred. While the script itself does not write that value, its emitted instruction directs the Agent to use a logging format that asks for the actual error message or output. Command and API failures frequently expose access tokens, authorization headers, signed URLs, environment values, user names, internal paths, customer data, and service responses. The Skill does not mandate redaction, output-size limits, data classification, or secret scanning. It also explicitly supports committing learning logs to a shared repository. ### Attack Path 1. A command or externa ...[truncated 863 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Installation Instructions Use Mutable and Unpinned Sources

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: hooks/openclaw/handler.js:30

Finding

Runtime JavaScript Omits the Documented Sub-Agent Exclusion

Content

View full analysis

{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The TypeScript source contains an exclusion that is absent from the runtime JavaScript: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } ``` ### Technical Analysis The TypeScript source states that sub-agent sessions are excluded to avoid bootstrap issues, but the distributed JavaScript implementation does not perform this check. If OpenClaw loads `handler.js`, the effective runtime behavior is broader than the behavior represented by `handler.ts`. This inconsistency makes source review unreliable and allows reminder injection into sub-agent sessions that the apparent source contract intends to exclude. It also indicates that generated artifacts are not being checked for parity. ### Attack Path 1. OpenClaw loads the distributed `handler.js`. 2. A bootstrap event is generated for a sub-agent whose session key contains `:subagent:`. 3. The ...[truncated 702 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is about recording and reviewing learnings, failures, corrections, and improvements for continuous improvement. The supplied code does not capture, store, analyze, or review learnings or errors. Instead, it is a helper script for creating a new skill scaffold on disk, including directory creation and writing a templated SKILL.md file. While the comments mention creating a skill from a learning entry, the implementation only generates a template and suggests manual follow-up; it does not process learning entries themselves. This is a materially different primary purpose, so the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented ability to read other sessions' transcripts and send learnings across sessions can disclose sensitive conversation data across boundaries that users may reasonably expect to remain isolated. Because this is framed as a standard self-improvement mechanism, it normalizes unnecessary access to broader conversational history.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The templates explicitly instruct capturing full context, inputs, parameters, error output, and user context, which are common carriers of secrets, tokens, personal data, internal paths, and proprietary information. Persisting this material in project files materially increases the likelihood of accidental exposure through source control, shared workspaces, or later agent access.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Referencing ~/.claude/settings.json instructs users to modify a user-level agent configuration directory, which establishes persistent behavior outside a single project. In the context of command hooks, this is sensitive because it changes the trusted execution environment for all future sessions and can be abused for durable auto-execution.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide recommends placing an unconditional hook in ~/.claude/settings.json, which enables execution across all sessions and projects for that user. Combining global persistence with automatic command execution materially raises risk because a compromised or changed script will run broadly and repeatedly without project-specific review.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill whenever a command fails unexpectedly, a user corrects the agent, an external API fails, knowledge is outdated, or a better approach is discovered. Several of these conditions are extremely common during normal agent interactions, and the file does not define limiting conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to persist user corrections, learnings, and context into local memory files and then review or promote them into broader memory stores. This creates a clear natural-language data retention risk because sensitive user-provided content may be stored beyond the original interaction and reused in later contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill encourages use of inter-session tools to read transcripts and send learnings across sessions, which can expose sensitive information from one session to another without clear minimization or authorization boundaries. In the context of a 'self-improvement' skill, this capability is broader than necessary and materially increases the chance of cross-session data disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Detection Triggers section includes generic conversational phrases like "Can you also...", "I wish you could...", and broad conditions like unexpected behavior or user-provided information. These overlap with common everyday interaction patterns and lack negative examples or scope limits, making it unclear when the skill should activate versus when it should remain inactive.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes this skill as capturing learnings, errors, and corrections, plus reviewing and promoting them before major tasks. This section goes beyond logging and promotion by instructing the agent to extract entirely new skills via helper scripts and manual skill creation workflows, which is a separate capability not clearly justified by the stated purpose.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The project-level settings guidance establishes session-persistent automatic behavior by adding hooks to agent configuration. While persistence is sometimes intentional, it is still security-relevant here because it ensures code execution recurs across sessions, increasing the blast radius of any script flaw or later tampering.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

An empty matcher causes the hook to fire for every user prompt, creating an unconditional execution path for the configured script. In the context of an automatically invoked command hook, this broad trigger increases attack surface, enables persistent behavior across normal usage, and makes any future script bug or malicious modification more impactful.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'minimal' setup still uses an empty matcher, so it remains an always-on automatic trigger despite being presented as lower overhead. This is dangerous because it normalizes unconditional execution and may lead users to underestimate how often the script runs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Codex CLI example repeats the same empty matcher pattern, propagating the unsafe always-trigger behavior to another agent environment. Reuse across tools increases exposure because the same reviewed-once assumption may cause users to enable broad auto-execution in multiple places.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a self-improvement skill focused on recording learnings and reviewing them before major tasks. This guide additionally exposes an 'extract-skill.sh' workflow that scaffolds a new skill, which is a broader code-generation or packaging capability not clearly implied by simple learning capture.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document's security section states the scripts only output text and do not run commands, yet the setup explicitly configures them as shell commands via the hook system. This is dangerous because it downplays the execution risk of local scripts that run automatically in response to agent events, which can mislead users into granting trust and permissions they would otherwise scrutinize.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Creating a persistent learning directory establishes retention of agent-generated memory across sessions, which can preserve sensitive or poisoned content and influence future behavior. In a self-improvement skill, persistence is directly tied to the feature set, making improper scoping and retention especially risky.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guide instructs users to create persistent '.learnings/' storage but does not warn that session-derived content may be written to disk and retained. This can cause sensitive prompts, tool outputs, secrets, or user data to persist beyond the session unexpectedly, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The guide explicitly recommends promoting captured 'learnings' into high-authority workspace prompt files such as AGENTS.md, SOUL.md, and TOOLS.md. That broadens the self-improvement skill from local note-taking into persistent prompt-surface modification, which can amplify prompt injection or incorrect guidance across future sessions and agents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation introduces session history access, cross-session messaging, and sub-agent spawning even though the skill's purpose is self-improvement logging. These capabilities increase the blast radius of bad or injected 'learnings' by allowing them to spread between sessions or be acted on by additional agents without clear necessity or safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The cross-session features are documented without warning that transcript content may be read from other sessions or forwarded to them. This creates a realistic risk of unintended disclosure of sensitive user data, credentials, or internal context across isolation boundaries users may assume exist.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.