T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:38- Finding
Untrusted User Corrections Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
self-improvement
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate self-improvement memory skill, but it should be reviewed because it can persist user corrections and conversation-derived lessons into future agent instructions without clear approval or privacy controls.
Install only if you want the agent to keep durable learning files. Prefer project-local setup, avoid global hooks unless you trust the scripts and scope, require manual review before anything is promoted into AGENTS.md, SOUL.md, TOOLS.md, or MEMORY.md, and do not store secrets, personal details, credentials, or raw conversation text in learnings.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description is about capturing and organizing lessons from mistakes and corrections into a learning-memory workflow. The supplied code does not record failures, classify patterns, review historical lessons, or integrate long-term memory. Instead, it is a utility for scaffolding a new skill on disk by creating directories and a markdown template. This is a materially different primary purpose, with undeclared filesystem creation behavior and unrelated triggers. Therefore the description does not accurately represent the code.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Directing users to modify ~/.claude/settings.json establishes persistent agent behavior from a user-level config directory, which is a sensitive control point. If this pattern is adopted casually, any malicious or later-compromised script path referenced there can influence all future sessions for that user.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises automatic error logging, learning capture, periodic review, and long-term memory integration, but it does not clearly warn users that conversation content, failures, or corrections may be stored persistently. This creates a real risk of retaining sensitive data without informed consent, especially because the feature is framed as automatic and continuous.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The README describes integrating learnings into long-term memory and forming hardened rules to prevent recurrence, which is a form of session persistence that can outlive the original user interaction. Without clear scoping, review, and deletion controls, this can preserve sensitive or incorrect information and influence future behavior in ways users do not expect.
- Content
md - 🎓 **Learning Capture**: Record corrections and discoveries - 🔄 **Periodic Review**: Regular retrospectives to consolidate learnings - 🧠 **Memory Integration**: Promote important patterns to long-term memory - 🛡️ **Rule Formation**: Create hardened rules to prevent recurring mistakes ## How It Works
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README says the skill activates automatically on broad conditions such as failures, user corrections, missing capabilities, and discovery of a better approach. In a self-improvement skill that performs persistent logging and memory integration, this ambiguity can cause over-collection of user content and unintended triggering during normal conversations, increasing privacy and governance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill metadata description and invocation guidance are written in a bilingual mix of Chinese and English, but the file does not state that language preference is optional or user-selected. This can amount to a language/locale policy issue because the skill implicitly assumes users can understand those languages without opt-in.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs the agent to persist learned information into long-term memory files and to promote lessons into durable storage. In practice, this can capture user-supplied personal data, sensitive corrections, or contextual details without clear minimization, consent, retention limits, or access controls, creating privacy and data-handling risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The recommended MEMORY.md structure explicitly includes storing information 'about the boss' such as preferences, habits, and important details, which encourages retention of user-specific personal information. This increases privacy risk, enables profiling, and may preserve sensitive data beyond the immediate task context without any guardrails on consent, necessity, or deletion.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
Placing hook configuration in a project-local agent settings file creates session-persistent behavior that automatically re-executes in future sessions. While not inherently malicious, persistence is security-relevant because it can survive context changes and continue injecting behavior after the original setup rationale is forgotten.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An empty matcher causes the hook to run on every prompt, creating a broad and continuous execution surface with little scope control. In a self-improvement skill, this increases the chance of unnecessary triggering, prompt-context injection, and normalization of always-on command execution for all user interactions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide recommends installing the hook in ~/.claude/settings.json for global activation, which expands the behavior across all projects and sessions. This broad persistence magnifies the blast radius of any script bug, future script modification, or unintended prompt interception because it affects unrelated workspaces by default.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Codex example repeats the empty matcher pattern, again causing execution on every prompt without meaningful narrowing. This is risky because it makes the always-on behavior portable across agent platforms, increasing exposure and making accidental over-collection or misuse more likely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document states the scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly invokes shell scripts via command hooks. This is security-relevant because readers may underestimate the trust and execution risk of enabling these hooks, leading to unsafe installation of code that executes in the agent's environment.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The usage section includes a Chinese trigger phrase as a manual invocation example without indicating that language selection is optional or user-configurable. This can create a language/locale policy concern because the skill presents a specific language requirement without opt-in or explanation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file instructs the user to copy skill and hook directories into
~/.openclaw/..., which changes local files and configuration state. The surrounding text presents these commands as straightforward setup steps but does not warn that they may overwrite existing installations or alter the user's environment.- Content
Static analysis
No suspicious patterns detected.