T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:17- Finding
Untrusted conversational content can be promoted into persistent agent instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
自我成
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent self-improvement skill, but it needs review because it can turn conversation-derived notes into persistent instructions that affect future agent sessions.
Review before installing. This skill is not clearly malicious, but use it only if you want agents to keep persistent learning files and potentially edit future instruction files. Prefer project-local setup, avoid global hooks unless you trust the scripts, do not log secrets or sensitive prompts, require human review before promoting learnings into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, and install from a pinned or verified release rather than a mutable branch.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:39- Finding
Manual installation retrieves mutable Skill content from an unpinned repository branch
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract-skill.sh:88- Finding
Output path validation can be bypassed through symbolic links
- Content
View full analysis
"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script attempts to confine writes to the current workspace by rejecting absolute paths and literal `..` components. This is only lexical validation and does not verify the canonical filesystem destination. A relative output directory can contain a symbolic-link component that resolves outside the current working directory. Both `mkdir -p` and shell redirection follow such symbolic links. As a result, the script can create or overwrite `SKILL.md` beyond the boundary claimed by its validation comment. The issue is especially relevant in shared, extracted, or attacker-influenced workspaces where an adversary can pre-create symbolic links. ### Attack Path 1. An attacker creates a symbolic link inside the workspace, for example: ```bash ln -s /attacker-selected/directory external-link ``` 2. The script is invoked with: ```bash ./scripts/extract-skill.sh injected-skill --output-dir external-link ``` 3. `external-link` passes validation because it is relative and contains no `..` component. 4. `SKILL_PATH` b ...[truncated 876 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description is about maintaining and consulting learnings for continuous improvement—essentially recording lessons, corrections, and failures. The supplied code does not capture, store, review, or manage learnings directly. Instead, it is a filesystem scaffolding utility that generates a new skill folder and template markdown file from a skill name, optionally as a dry run. While the comments mention extracting a skill from a learning entry, that is a narrower and different function than the declared behavior. The primary purpose, triggers, and effective capabilities are materially different, so this is a clear mismatch.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Instructing users to install the hook in ~/.claude/settings.json enables global execution across all projects and sessions, expanding the blast radius if the script is unsafe, modified, or later compromised. Because the skill is self-improvement oriented and persistent by design, global activation makes the behavior more dangerous than project-local use.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The skill instructs agents to create persistent files under
~/.openclaw/workspace/.learnings, which can retain conversation-derived content across sessions. Because the logged material may include user corrections, errors, API details, or operational context, this creates a data-retention and cross-session exposure risk if sensitive information is written without redaction or access controls.- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
An empty hook matcher causes the activator script to run on every user prompt, creating an overly broad prompt-injection surface and unnecessary execution path. In environments where hook scripts process untrusted prompt content or invoke shell logic, this increases the chance of unintended data exposure, excessive logging, or abuse through crafted prompts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The full hook setup repeats the same broad empty matcher, so every prompt triggers the hook regardless of relevance. Repeated always-on triggering magnifies the risk of prompt-driven misuse, noisy persistence of sensitive content into
.learnings/, and accidental execution overhead in all sessions.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a skill focused on capturing learnings, errors, and corrections and reviewing them before major tasks. This section adds a separate capability to generate entirely new skills, including invoking helper scripts and creating
skills/<skill-name>/SKILL.md, which is not an obvious or necessary part of merely recording and promoting learnings.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
Project-level hook configuration creates session persistence, causing the behavior to be reloaded automatically in future sessions without a fresh security decision. Persistence is not inherently malicious, but for command-executing hooks it increases the risk of unnoticed continued execution and long-term influence over agent behavior.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An empty matcher causes the activator hook to run on every prompt, creating broad and persistent interception of agent activity. In this skill context, that increases exposure because any future change to the script or its output affects all prompts rather than a narrowly scoped subset.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document states that hook scripts only output text and do not run commands, but the configuration explicitly executes shell scripts via command hooks. This mismatch can mislead users into granting trust or permissions under false assumptions, increasing the chance they deploy code-executing hooks without appropriate review.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Static analysis
No suspicious patterns detected.