自我成长

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:49 PM UTC
• Version: 1.0.1

Overview

The skill is a disclosed self-improvement logger, but it asks agents to retain session-derived content, install always-on hooks, and promote learnings into persistent agent instruction files with weak safeguards.

Install only if you want persistent agent self-improvement behavior. Keep hooks project-local, avoid empty matchers where possible, review any hook script before enabling it, redact secrets and personal data before logging errors or context, and require explicit human review before promoting anything into agent instruction files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: hooks/openclaw/handler.ts:10
• Finding: Persistent Bootstrap and Prompt-Submission Instruction Injection<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.ts:10-25, 28-59`; `hooks/openclaw/handler.js:9-53`; `scripts/activator.sh:9-19`; `SKILL.md:467-513` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```typescript const REMINDER_CONTENT = `## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently.`; const handler: HookHandler = async (event) => { if (!event || typeof event !== 'object') { return; } if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } if (!event.context || typeof event.context !== 'object') { return; } const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The prompt-submission hook additionally emits: ```bash cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Con ...[truncated 1741 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace bootstrap/system-context injection with a user-invoked command or a clearly separated, user-visible notification. - Require explicit confirmation before every write to `.learnings/` or any Agent instruction file. - Scope reminders to tasks where the user explicitly requests learning capture. - Do not frame optional reminders as bootstrap files or system-like context. - Add configuration controls for event scope, target directories, and whether any filesystem modification is permitted. - Ensure hooks default to disabled and clearly display their exact injected content before activation. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:347
• Finding: Untrusted Observations Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26, 262-289, 347-360, 443-448`; `hooks/openclaw/handler.ts:12-25` **Vulnerability Type**: T02: Agent Memory Poisoning **Risk Level**: High ### Vulnerable Instructions ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` The bootstrap reminder reinforces the same behavior: ```typescript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` ### Technical Analysis The Skill treats user corrections, command failures, tool output, and conversation-derived observations as candidates for promotion into files that are automatically loaded as instructions in future Agent sessions. These source channels may be attacker-controlled or merely incorrect. Recurrence counting does not establish trustworthiness: an attacker can repeat the same claim across tasks, and multiple occurrences of malicious or inaccurate content do not make it safe. The instruction to “promote aggressively” further weakens the review boundary. On ...[truncated 1189 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prohibit automatic promotion from conversations, repository content, or tool output into Agent instruction files. - Store observations in a non-executable review queue that is never automatically loaded as prompt context. - Require explicit workspace-owner approval for every promoted rule. - Record provenance, source task, author, timestamp, and a cryptographic content digest. - Require independent verification rather than recurrence alone. - Treat all content copied from command output, websites, repositories, and users as untrusted data. - Use an allowlisted structured schema that cannot contain arbitrary instructions. - Remove the “promote aggressively” guidance and default to non-promotion. - Provide rollback and audit-history mechanisms for all changes to persistent Agent files. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/error-detector.sh:4
• Finding: Raw Tool Error Output May Be Persisted and Committed Without Redaction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/error-detector.sh:4-10, 31-52`; `SKILL.md:169-190, 451-459` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code and Instructions ```bash # Reads CLAUDE_TOOL_OUTPUT environment variable set -e # Check if tool output indicates an error # CLAUDE_TOOL_OUTPUT contains the result of the tool execution OUTPUT="${CLAUDE_TOOL_OUTPUT:-}" ``` ```bash contains_error=false for pattern in "${ERROR_PATTERNS[@]}"; do if [[ "$OUTPUT" == *"$pattern"* ]]; then contains_error=true break fi done if [ "$contains_error" = true ]; then cat << 'EOF' <error-detected> A command error was detected. Consider logging this to .learnings/ERRORS.md if: - The error was unexpected or non-obvious - It required investigation to resolve - It might recur in similar contexts - The solution could benefit future sessions Use the self-improvement skill format: [ERR-YYYYMMDD-XXX] </error-detected> EOF fi ``` The prescribed format requests raw output: ```markdown ### Error ``` Actual error message or output ``` ``` Repository tracking is also presented as an option: ```markdown **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` ### Technical Analysis The detector reads the complete `CLAUDE_TOOL_OUTPUT` value to decide whether an error occurred. While the script itself does not write that value, its emitted instruction directs the Agent to use a logging format that asks for the actual error message or output. Command and API failures frequently expose access tokens, authorization headers, signed URLs, environment values, user names, internal paths, customer data, and service responses. The Skill does not mandate redaction, output-size limits, data classification, or secret scanning. It also explicitly supports committing learning logs to a shared repository. ### Attack Path 1. A command or externa ...[truncated 863 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace raw-output logging with a structured summary containing only the command category, sanitized error type, and remediation. - Apply automatic redaction for API keys, bearer tokens, cookies, credentials, private keys, signed URLs, email addresses, and sensitive paths. - Enforce strict maximum field and file sizes. - Default `.learnings/` to local, ignored storage rather than repository tracking. - Add a pre-write confirmation showing the exact sanitized content. - Add secret scanning before writes and before commits. - Document categories of information that must never be retained. - Avoid passing complete tool output to hooks when only an exit status or structured error code is required. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Installation Instructions Use Mutable and Unpinned Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-44` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Instructions ```markdown ### Installation **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis Neither installation command pins an immutable version, Git commit, tag digest, checksum, or signature. The manual procedure clones the current state of a mutable personal GitHub repository directly into the Agent’s Skill directory. The installed package includes executable shell scripts and an OpenClaw bootstrap handler that users are instructed to enable separately. The reviewed artifact did not contain a remote download-and-execute pipeline and no malicious dependency was identified. The vulnerability is the missing supply-chain integrity boundary: content installed in the future may differ from the audited artifact without an integrity failure being reported. ### Attack Path 1. The upstream registry account or GitHub repository is compromised, transferred, or modified. 2. An attacker replaces a hook or script in the mutable upstream source. 3. A user follows the documented unpinned installation command. 4. The changed files are installed into the Agent’s Skill or hook directory. 5. The user enables the hook as documented. 6. The modified code executes with the Agent process’s permissions on subsequent events. ### Impact Assessment A compromised upstream release could act with the same privileges as the Agent and its hooks, potentially accessing workspace files, modifying Agent context, or running local commands. The current reviewed files do not impl ...[truncated 138 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the registry installation to a specific audited version. - Pin manual Git installation to a full commit hash rather than the default branch. - Publish SHA-256 checksums and signed release manifests. - Verify signatures and checksums before copying files into Agent or hook directories. - Use protected, reproducible releases from an organization-controlled repository. - Display and review executable-file changes before enabling hooks. - Document an upgrade process that requires re-audit when scripts or hook handlers change. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: hooks/openclaw/handler.js:30
• Finding: Runtime JavaScript Omits the Documented Sub-Agent Exclusion<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:30-53`; comparison source at `hooks/openclaw/handler.ts:43-49` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Low ### Vulnerable Runtime Code ```javascript const handler = async (event) => { // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The TypeScript source contains an exclusion that is absent from the runtime JavaScript: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } ``` ### Technical Analysis The TypeScript source states that sub-agent sessions are excluded to avoid bootstrap issues, but the distributed JavaScript implementation does not perform this check. If OpenClaw loads `handler.js`, the effective runtime behavior is broader than the behavior represented by `handler.ts`. This inconsistency makes source review unreliable and allows reminder injection into sub-agent sessions that the apparent source contract intends to exclude. It also indicates that generated artifacts are not being checked for parity. ### Attack Path 1. OpenClaw loads the distributed `handler.js`. 2. A bootstrap event is generated for a sub-agent whose session key contains `:subagent:`. 3. The ...[truncated 702 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Regenerate `handler.js` from the reviewed TypeScript source and include the sub-agent check. - Use one authoritative implementation where possible instead of maintaining parallel source files manually. - Add CI tests that compare generated JavaScript with TypeScript build output. - Add an automated test asserting that sub-agent bootstrap events do not receive the virtual file. - Fail release packaging when generated artifacts are stale or differ from committed source. - Clearly document which file OpenClaw loads at runtime. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description is about recording and reviewing learnings, failures, corrections, and improvements for continuous improvement. The supplied code does not capture, store, analyze, or review learnings or errors. Instead, it is a helper script for creating a new skill scaffold on disk, including directory creation and writing a templated SKILL.md file. While the comments mention creating a skill from a learning entry, the implementation only generates a template and suggests manual follow-up; it does not process learning entries themselves. This is a materially different primary purpose, so the description does not accurately represent the code's actual behavior.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The documented ability to read other sessions' transcripts and send learnings across sessions can disclose sensitive conversation data across boundaries that users may reasonably expect to remain isolated. Because this is framed as a standard self-improvement mechanism, it normalizes unnecessary access to broader conversational history.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The templates explicitly instruct capturing full context, inputs, parameters, error output, and user context, which are common carriers of secrets, tokens, personal data, internal paths, and proprietary information. Persisting this material in project files materially increases the likelihood of accidental exposure through source control, shared workspaces, or later agent access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Referencing ~/.claude/settings.json instructs users to modify a user-level agent configuration directory, which establishes persistent behavior outside a single project. In the context of command hooks, this is sensitive because it changes the trusted execution environment for all future sessions and can be abused for durable auto-execution.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The guide recommends placing an unconditional hook in ~/.claude/settings.json, which enables execution across all sessions and projects for that user. Combining global persistence with automatic command execution materially raises risk because a compromised or changed script will run broadly and repeatedly without project-specific review.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description says to use the skill whenever a command fails unexpectedly, a user corrects the agent, an external API fails, knowledge is outdated, or a better approach is discovered. Several of these conditions are extremely common during normal agent interactions, and the file does not define limiting conditions or negative examples to clarify when the skill should not activate.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to persist user corrections, learnings, and context into local memory files and then review or promote them into broader memory stores. This creates a clear natural-language data retention risk because sensitive user-provided content may be stored beyond the original interaction and reused in later contexts.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill encourages use of inter-session tools to read transcripts and send learnings across sessions, which can expose sensitive information from one session to another without clear minimization or authorization boundaries. In the context of a 'self-improvement' skill, this capability is broader than necessary and materially increases the chance of cross-session data disclosure.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The Detection Triggers section includes generic conversational phrases like "Can you also...", "I wish you could...", and broad conditions like unexpected behavior or user-provided information. These overlap with common everyday interaction patterns and lack negative examples or scope limits, making it unclear when the skill should activate versus when it should remain inactive.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The manifest describes this skill as capturing learnings, errors, and corrections, plus reviewing and promoting them before major tasks. This section goes beyond logging and promotion by instructing the agent to extract entirely new skills via helper scripts and manual skill creation workflows, which is a separate capability not clearly justified by the stated purpose.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 84% confidence
• Finding: The project-level settings guidance establishes session-persistent automatic behavior by adding hooks to agent configuration. While persistence is sometimes intentional, it is still security-relevant here because it ensures code execution recurs across sessions, increasing the blast radius of any script flaw or later tampering.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: An empty matcher causes the hook to fire for every user prompt, creating an unconditional execution path for the configured script. In the context of an automatically invoked command hook, this broad trigger increases attack surface, enables persistent behavior across normal usage, and makes any future script bug or malicious modification more impactful.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The 'minimal' setup still uses an empty matcher, so it remains an always-on automatic trigger despite being presented as lower overhead. This is dangerous because it normalizes unconditional execution and may lead users to underestimate how often the script runs.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The Codex CLI example repeats the same empty matcher pattern, propagating the unsafe always-trigger behavior to another agent environment. Reuse across tools increases exposure because the same reviewed-once assumption may cause users to enable broad auto-execution in multiple places.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest describes a self-improvement skill focused on recording learnings and reviewing them before major tasks. This guide additionally exposes an 'extract-skill.sh' workflow that scaffolds a new skill, which is a broader code-generation or packaging capability not clearly implied by simple learning capture.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document's security section states the scripts only output text and do not run commands, yet the setup explicitly configures them as shell commands via the hook system. This is dangerous because it downplays the execution risk of local scripts that run automatically in response to agent events, which can mislead users into granting trust and permissions they would otherwise scrutinize.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 80% confidence
• Finding: Creating a persistent learning directory establishes retention of agent-generated memory across sessions, which can preserve sensitive or poisoned content and influence future behavior. In a self-improvement skill, persistence is directly tied to the feature set, making improper scoping and retention especially risky.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide instructs users to create persistent '.learnings/' storage but does not warn that session-derived content may be written to disk and retained. This can cause sensitive prompts, tool outputs, secrets, or user data to persist beyond the session unexpectedly, creating privacy and compliance risk.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The guide explicitly recommends promoting captured 'learnings' into high-authority workspace prompt files such as AGENTS.md, SOUL.md, and TOOLS.md. That broadens the self-improvement skill from local note-taking into persistent prompt-surface modification, which can amplify prompt injection or incorrect guidance across future sessions and agents.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The documentation introduces session history access, cross-session messaging, and sub-agent spawning even though the skill's purpose is self-improvement logging. These capabilities increase the blast radius of bad or injected 'learnings' by allowing them to spread between sessions or be acted on by additional agents without clear necessity or safeguards.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The cross-session features are documented without warning that transcript content may be read from other sessions or forwarded to them. This creates a realistic risk of unintended disclosure of sensitive user data, credentials, or internal context across isolation boundaries users may assume exist.

Static analysis

No suspicious patterns detected.