自我成

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:50 PM UTC
• Version: 1.0.1

Overview

This is a coherent self-improvement skill, but it needs review because it can turn conversation-derived notes into persistent instructions that affect future agent sessions.

Review before installing. This skill is not clearly malicious, but use it only if you want agents to keep persistent learning files and potentially edit future instruction files. Prefer project-local setup, avoid global hooks unless you trust the scripts, do not log secrets or sensitive prompts, require human review before promoting learnings into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, and install from a pinned or verified release rather than a mutable branch.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:17
• Finding: Untrusted conversational content can be promoted into persistent agent instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-26`, `SKILL.md:277-289`, `SKILL.md:346-360`, and `SKILL.md:448` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown | Situation | Action | |-----------|--------| | Command/operation fails | Log to `.learnings/ERRORS.md` | | User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` | | User wants missing feature | Log to `.learnings/FEATURE_REQUESTS.md` | | API/external tool fails | Log to `.learnings/ERRORS.md` with integration details | | Knowledge was outdated | Log to `.learnings/LEARNINGS.md` with category `knowledge_gap` | | Found better approach | Log to `.learnings/LEARNINGS.md` with category `best_practice` | | Simplify/Harden recurring patterns | Log/update `.learnings/LEARNINGS.md` with `Source: simplify-and-harden` and a stable `Pattern-Key` | | Similar to existing entry | Link with `**See Also**`, consider priority bump | | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` The guidance further states: ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` The installed OpenClaw hook reinforces the promotion workflow in `hooks/openclaw/handler.js:13-25`: ```javascript **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS. ...[truncated 2305 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before modifying any persistent agent instruction file. 2. Treat all conversational and learning-log content as untrusted data, not executable agent guidance. 3. Remove the “promote aggressively” recommendation and replace it with a deny-by-default review process. 4. Add provenance metadata recording the originating user, session, timestamp, and exact source text. 5. Reject promotion candidates containing imperative instructions, safety-policy changes, secret-handling directives, external URLs, shell commands, or requests to bypass review. 6. Keep learning records in a data-only store that is not automatically loaded as trusted prompt context. 7. Generate a proposed diff for promotion rather than editing instruction files directly. 8. Require at least one trusted maintainer to approve the proposed diff. 9. Add integrity monitoring for `SOUL.md`, `AGENTS.md`, `TOOLS.md`, `CLAUDE.md`, and Copilot instruction files. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39
• Finding: Manual installation retrieves mutable Skill content from an unpinned repository branch<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:39-42` **Vulnerability Type**: Unpinned remote supply-chain dependency **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` ### Technical Analysis The documented manual installation command clones the current default branch of a remote personal repository directly into an OpenClaw Skill directory. It does not select an audited commit or release and does not verify a checksum or cryptographic signature. The effective installed content can therefore differ from the version reviewed in this audit. A compromise of the repository, maintainer account, or default branch could introduce altered Skill instructions or executable hook scripts. Although the command does not immediately execute a downloaded shell payload, installing mutable content in an auto-loaded Skill location creates a supply-chain trust issue. Users may subsequently load the instructions or enable the bundled hooks without verifying that the retrieved files match an audited release. ### Attack Path 1. An attacker compromises the referenced repository, maintainer account, or default branch. 2. The attacker modifies `SKILL.md`, hook handlers, or shell scripts in the repository. 3. A user follows the documented `git clone` command. 4. The mutable repository contents are installed directly under `~/.openclaw/skills/`. 5. OpenClaw loads the altered Skill instructions, or the user enables the altered hook. 6. The changed content executes with the permissions available to the OpenClaw or coding-agent process. ### Impact Assessment The maximum impact depends on the malicious content introduced upstream and the permissions of the user running the agent. Potential scope includes: - Agent instruction hijacking. - Repository and workspace file access. - Execution of commands through enabled hooks. - Access to environment variables a ...[truncated 275 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the default-branch clone command with installation of a specific audited release or immutable commit hash. 2. Publish SHA-256 checksums for release archives and require verification before installation. 3. Sign releases and document signature verification using a trusted maintainer key. 4. Prefer a package registry or release channel that supports immutable versions and provenance attestations. 5. Do not install remote mutable branches directly into auto-loading Skill or hook directories. 6. Stage downloaded content in a non-executable directory, verify it, and only then move it into the OpenClaw directory. 7. Document the exact expected version, commit identifier, checksum, and signer identity. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:88
• Finding: Output path validation can be bypassed through symbolic links<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh:88-105` and `scripts/extract-skill.sh:171-177` **Vulnerability Type**: Path-containment bypass through symbolic-link traversal **Risk Level**: Medium ### Vulnerable Code ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" ``` The validated path is later used for file creation: ```bash # Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script attempts to confine writes to the current workspace by rejecting absolute paths and literal `..` components. This is only lexical validation and does not verify the canonical filesystem destination. A relative output directory can contain a symbolic-link component that resolves outside the current working directory. Both `mkdir -p` and shell redirection follow such symbolic links. As a result, the script can create or overwrite `SKILL.md` beyond the boundary claimed by its validation comment. The issue is especially relevant in shared, extracted, or attacker-influenced workspaces where an adversary can pre-create symbolic links. ### Attack Path 1. An attacker creates a symbolic link inside the workspace, for example: ```bash ln -s /attacker-selected/directory external-link ``` 2. The script is invoked with: ```bash ./scripts/extract-skill.sh injected-skill --output-dir external-link ``` 3. `external-link` passes validation because it is relative and contains no `..` component. 4. `SKILL_PATH` b ...[truncated 876 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Determine a canonical trusted workspace root before processing user input: ```bash WORKSPACE_ROOT="$(realpath -e -- "$PWD")" ``` 2. Canonicalize the output directory’s nearest existing parent and verify that it remains under `WORKSPACE_ROOT`. 3. Reject any output path containing symbolic-link components. On Linux, inspect each component with `test -L` or use a secure directory traversal implementation. 4. Revalidate the canonical destination immediately before creation to reduce time-of-check/time-of-use exposure. 5. Avoid ordinary shell redirection for security-sensitive file creation because it follows symbolic links. 6. Use exclusive, no-follow file creation semantics where the platform supports them. 7. Run the extraction helper with minimal filesystem permissions. 8. Add automated tests covering: - Absolute paths. - `..` traversal. - Symlinks to external directories. - Nested symlink components. - Replacement of a validated directory with a symlink before file creation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description is about maintaining and consulting learnings for continuous improvement—essentially recording lessons, corrections, and failures. The supplied code does not capture, store, review, or manage learnings directly. Instead, it is a filesystem scaffolding utility that generates a new skill folder and template markdown file from a skill name, optionally as a dry run. While the comments mention extracting a skill from a learning entry, that is a narrower and different function than the declared behavior. The primary purpose, triggers, and effective capabilities are materially different, so this is a clear mismatch.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Instructing users to install the hook in ~/.claude/settings.json enables global execution across all projects and sessions, expanding the blast radius if the script is unsafe, modified, or later compromised. Because the skill is self-improvement oriented and persistent by design, global activation makes the behavior more dangerous than project-local use.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 83% confidence
• Finding: The skill instructs agents to create persistent files under `~/.openclaw/workspace/.learnings`, which can retain conversation-derived content across sessions. Because the logged material may include user corrections, errors, API details, or operational context, this creates a data-retention and cross-session exposure risk if sensitive information is written without redaction or access controls.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: An empty hook matcher causes the activator script to run on every user prompt, creating an overly broad prompt-injection surface and unnecessary execution path. In environments where hook scripts process untrusted prompt content or invoke shell logic, this increases the chance of unintended data exposure, excessive logging, or abuse through crafted prompts.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The full hook setup repeats the same broad empty matcher, so every prompt triggers the hook regardless of relevance. Repeated always-on triggering magnifies the risk of prompt-driven misuse, noisy persistence of sensitive content into `.learnings/`, and accidental execution overhead in all sessions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The manifest describes a skill focused on capturing learnings, errors, and corrections and reviewing them before major tasks. This section adds a separate capability to generate entirely new skills, including invoking helper scripts and creating `skills/<skill-name>/SKILL.md`, which is not an obvious or necessary part of merely recording and promoting learnings.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 82% confidence
• Finding: Project-level hook configuration creates session persistence, causing the behavior to be reloaded automatically in future sessions without a fresh security decision. Persistence is not inherently malicious, but for command-executing hooks it increases the risk of unnoticed continued execution and long-term influence over agent behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: An empty matcher causes the activator hook to run on every prompt, creating broad and persistent interception of agent activity. In this skill context, that increases exposure because any future change to the script or its output affects all prompts rather than a narrowly scoped subset.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document states that hook scripts only output text and do not run commands, but the configuration explicitly executes shell scripts via command hooks. This mismatch can mislead users into granting trust or permissions under false assumptions, increasing the chance they deploy code-executing hooks without appropriate review.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.