My skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

This skill matches its self-improvement purpose, but it asks agents to add always-on reminders and write learned rules into future agent instruction files, which needs careful review before installation.

Install only if you want persistent learning logs and future-agent memory changes. Prefer project-local setup, avoid global hooks and empty matchers, review every proposed write to instruction files, keep .learnings out of shared repos unless intentional, and do not forward raw transcripts, command output, or secrets across sessions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: hooks/openclaw/handler.js:8

Finding

Agent Bootstrap and Per-Prompt Instruction Injection

Content

View full analysis

{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The per-prompt hook also emits instructions explicitly intended to become system context: ```bash # Output reminder as system context cat << 'EOF' After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - E ...[truncated 2324 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:282

Finding

Persistent Poisoning of Agent Instruction and Memory Files

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30- ...[truncated 2794 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:97

Finding

Workspace Write Boundary Can Be Bypassed Through Symbolic Links

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis Rejecting absolute paths and `..` path components prevents straightforward traversal but does not guarantee that the resolved destination remains below the current workspace. Unix file operations follow symbolic links by default. If an existing component of `SKILLS_DIR` or `SKILL_PATH` is a symbolic link to a directory outside the workspace, `mkdir -p` and the subsequent shell redirection operate on the linked destination. The script therefore enforces a lexical path boundary rather than a filesystem-resolved boundary. The existing-directory check does not mitigate this condition because `-d` follows symbolic links, and the script only aborts when the complete skill path already resolves to a directory. An attacker can arrange a symlinked parent directory while leaving the final skill directory absent. ### Attack Path 1. An attacker gains control of files inside the workspace or supplies a prepared project archive. 2. The attacker creates a relative ...[truncated 1094 chars]

Remediation

View remediation

/dev/null | grep -q .; then log_error "Output path cannot contain symbolic links." exit 1 fi ``` 9. Perform the final file creation atomically and fail if `SKILL.md` already exists. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a memory/learning-capture capability triggered by failures, corrections, missing capabilities, API/tool issues, outdated knowledge, or improved recurring approaches. The supplied code does not capture learnings, record errors/corrections, review prior learnings, or implement those triggers. Instead, it is a CLI helper that generates a new skill scaffold on disk from a learning entry, including directory creation and template file writing. While related to the broader learning/skill workflow, its primary purpose and concrete behavior are materially different from the declared description.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 181)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill when a command fails unexpectedly, when a user corrects the agent, when a better approach is discovered, and to review learnings before major tasks. Several of these conditions are broad and subjective, especially 'a better approach is discovered' and 'before major tasks,' which do not define clear boundaries or exclusions for when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This skill instructs creation and ongoing use of persistent workspace files under ~/.openclaw/workspace/.learnings, which can retain user corrections, tool failures, and potentially sensitive workflow context across sessions. Even with warnings not to store secrets, session persistence increases the blast radius of accidental data retention and can expose prior-session information to later agents or users in the same environment.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The listed triggers include everyday phrases like 'Actually, it should be...', 'Can you also...', and 'Is there a way to...', which commonly occur in normal chat and are not specific to self-improvement logging. Without stronger constraints, these examples risk unintended invocation or excessive logging during routine conversation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Project-level hook configuration introduces persistent behavior that automatically executes commands in future sessions. In this self-improvement skill, persistence makes the behavior more dangerous because it may continue collecting context or responding to prompts long after the user forgets it was enabled.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

An empty matcher causes the hook to fire on every user prompt, creating an always-on execution path for a shell command. In this skill context, that broad trigger scope increases exposure to accidental data capture, unnecessary processing, and abuse if the hook script is modified or replaced.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Using an empty matcher in a user-level configuration makes the hook globally active across sessions and repositories, greatly expanding where the shell script runs. Because it lives under the user's agent config directory, compromise or unexpected behavior in the script can persist and affect unrelated work, increasing the blast radius.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Although presented as 'lower overhead', the minimal setup still executes the hook for every prompt due to the empty matcher. That makes the example misleading from a security perspective because it reduces functionality but not execution scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Codex CLI example also uses an empty matcher, so the command hook runs on all prompts rather than on a defined subset of cases. In an agent tooling context, broad implicit execution of shell scripts is risky because users may copy the sample verbatim into automation-heavy environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation asserts that hook scripts 'only output text' and 'don't modify files or run commands', but the setup explicitly executes shell scripts as hook commands. That mismatch can cause users to overtrust the hooks' behavior and deploy them without appropriate review, even though invoked shell scripts can perform arbitrary actions with the agent's privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'Detection Triggers' section includes generic conditions such as 'Knowledge gaps', 'API errors', and user corrections like 'No, that's wrong...', without clearly constraining when the skill should activate versus merely observe normal conversation flow. Because this is a markdown file and the trigger list lacks explicit scope limits or negative examples, it creates a vague invocation surface.

Content

No source excerpt is available for this finding.