ClawHub
Back to skill

Security audit

Aprendizado Continuo

Security checks for vulnerabilities and agentic risk

Overview

The skill openly aims to make agents remember mistakes, but it also directs automatic persistence into files that can change future agent behavior without clear approval controls.

Install only if you want a Portuguese self-improvement workflow and can review every proposed write before it reaches AGENTS.md, TOOLS.md, or SKILL.md. Treat captured corrections and learnings as untrusted notes unless a human explicitly approves the exact diff and destination.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:21
Finding

Persistent Agent-State Poisoning Through Untrusted Learning Promotion

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-27, 39-42, and 65-68
Vulnerability Type: Persistent memory and instruction poisoning
Risk Level: High

Vulnerable Code Snippets

markdown
.learnings/
├── ERRORS.md         # Erros cometidos
├── LEARNINGS.md      # Aprendizados
├── FEATURE_REQUESTS.md  # Features solicitadas
└── CORRECTIONS.md    # Correções de usuário
markdown
### ✅ Correções
- Usuário corrige: "Não, isso está errado..."
- Usuário melhora: "Na verdade, faça assim..."
- Usuário especifica: "Quero que seja..."
markdown
Aprendizados importantes são promovidos para:
- `AGENTS.md` - Conhecimento do agente
- `TOOLS.md` - Notas de ferramentas
- `SKILL.md` - Melhorias de skills

Technical Analysis

The skill directs the agent to capture user-supplied corrections and promote selected learning content into persistent files such as AGENTS.md, TOOLS.md, and SKILL.md. These files can affect the agent's behavior, tool usage, and skill instructions in later sessions.

No validation, sanitization, provenance enforcement, approval workflow, or distinction between declarative knowledge and executable agent instructions is specified. Consequently, attacker-controlled text presented as a correction or learning can be incorporated into persistent agent state. Once promoted, embedded instructions can be interpreted as trusted operational guidance during future sessions.

This is a persistent memory-poisoning issue rather than ordinary current-session prompt injection because the documented promotion mechanism allows untrusted content to survive beyond the originating interaction. Modification of SKILL.md is especially sensitive because poisoned content may be loaded whenever the skill is subsequently activated.

Attack Path

  1. An attacker submits a correction or learning containing concealed or explicit agent instructions.
  2. The skill classif ...[truncated 1185 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not automatically promote user-controlled content into AGENTS.md, TOOLS.md, or SKILL.md.
  2. Restrict automatic writes to isolated .learnings/ data files that are never interpreted as agent instructions.
  3. Require explicit approval from a trusted operator before promoting any learning. Display the source, destination, provenance, and complete diff.
  4. Store learning records in a structured schema that separates factual observations from proposed instructions.
  5. Reject or quarantine content containing imperative agent directives, role changes, tool commands, safety overrides, encoded instructions, or requests to modify trusted configuration.
  6. Preserve provenance metadata, including the originating user, session, timestamp, trust level, and approval identity.
  7. Apply least-privilege filesystem permissions so the learning process cannot directly modify trusted instruction files.
  8. Maintain version history and provide an audited rollback mechanism for every approved change.
  9. Treat all learned content as untrusted data when it is later loaded into an agent context.
  10. Add tests demonstrating that malicious corrections cannot modify persistent agent policy or skill behavior without trusted human authorization.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
- `SKILL.md` - Melhorias de skills

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description states 'Sistema de auto-melhoria em português', and later text says the skill was created for the Brazilian community to have self-improvement in Portuguese. This reads as a language constraint without any opt-in, alternative language support, or explicit justification that the skill is region-specific only.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to match many normal agent interactions, including generic failures, corrections, and newly observed patterns. In a self-improvement skill that writes persistent learnings and promotes them into AGENTS.md, TOOLS.md, and SKILL.md, this can cause unintended activation, noisy or adversarial data capture, and propagation of bad instructions into trusted memory/configuration files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest presents Portuguese as the default operating language for the skill without stating that this is conditional on user preference or environment settings. While not directly a code-execution issue, forced language behavior can override user intent, reduce transparency for reviewers, and make risky self-improvement actions harder for non-Portuguese-speaking operators to detect and validate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description promises automatic capture of errors, corrections, and promotion of changes to AGENTS.md, TOOLS.md, and SKILL.md without defining explicit triggers, approval boundaries, or scope limits. In an agent skill, this creates a real prompt-safety risk because user input or model mistakes could be turned into persistent self-modifications or recommendations that alter future agent behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.