Self Improving Agent V2

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:24 AM UTC
• Version: 1.0.0

Overview

This skill is openly about learning capture, but it can persist conversation-derived content into future agent instructions with broad hooks and limited privacy safeguards.

Install only if you want an agent to keep durable learning logs and potentially update future agent instruction files. Keep .learnings local by default, redact secrets and personal data before logging, avoid global always-on hooks, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:23
• Finding: Untrusted Learnings Can Poison Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26`, `SKILL.md:269-289`, `SKILL.md:338-360`, and `SKILL.md:442-448` **Vulnerability Type**: Persistent agent memory poisoning through promotion of conversation-derived content **Risk Level**: High ### Vulnerable Code and Instructions From `SKILL.md:23-26`: ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` From `SKILL.md:269-289`: ```markdown - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` From `SKILL.md:442-448`: ```markdown 1. **Log immediately** - context is freshest right after the issue 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes eas ...[truncated 2940 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic or agent-initiated promotion by default and require explicit human approval for every persistent instruction change. 2. Treat all conversation-, tool-, and error-derived content as untrusted data. 3. Add mandatory provenance fields, including the originating session, author, evidence, validation status, reviewer, and review timestamp. 4. Prohibit direct copying of learning text into persistent instruction files. Require a separately reviewed, narrowly scoped rule. 5. Reject promotion candidates containing: - Requests to ignore or override existing instructions. - Commands that access credentials or sensitive files. - External data-transmission instructions. - Encoded or obfuscated content. - Instructions that disable security checks or approval gates. 6. Use allowlisted sections and structured schemas for persistent files instead of unrestricted Markdown insertion. 7. Replace “Promote aggressively” with a conservative rule such as: “Do not promote unless independently verified and explicitly approved.” 8. Keep project facts separate from behavioral or safety instructions, and prevent ordinary learnings from modifying safety-relevant sections. 9. Require code review for changes to `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md`. 10. Record and review diffs before loading newly modified persistent context in subsequent sessions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:158
• Finding: Raw Error Logging Can Persist and Publish Sensitive Information<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:158-175`, `SKILL.md:450-459`, `scripts/error-detector.sh:9-38`, and `references/hooks-setup.md:203-208` **Vulnerability Type**: Plaintext persistence of potentially sensitive command output and environment details **Risk Level**: Medium ### Vulnerable Code and Instructions From `SKILL.md:158-175`: ```markdown ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ### Suggested Fix If identifiable, what might resolve this ### Metadata - Reproducible: yes | no | unknown - Related Files: path/to/file.ext - See Also: ERR-20250110-001 (if recurring) ``` From `SKILL.md:450-459`: ```markdown ## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/ ``` **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` From `scripts/error-detector.sh:9-38`: ```bash # CLAUDE_TOOL_OUTPUT contains the result of the tool execution OUTPUT="${CLAUDE_TOOL_OUTPUT:-}" # Patterns indicating errors (case-insensitive matching) ERROR_PATTERNS=( "error:" "Error:" "ERROR:" "failed" "FAILED" "command not found" "No such file" "Permission denied" "fatal:" "Exception" "Traceback" "npm ERR!" "ModuleNotFoundError" "SyntaxError" "TypeError" "exit code" "non-zero" ) # Check if output contains any error pattern contains_error=false for pattern in "${ERROR_PATTERNS[@]}"; do if [[ "$OUTPUT" == *"$pattern"* ]]; then contains_error=true break fi done ``` From `references/hooks-setup.md:203-208`: ```markdown ## Security Considerations - Hook scripts run with the same permissions as Claude Code - Scripts only output text; they don't modify files or run commands - Error detector reads `CLAUDE_TOOL_OUTPUT` environment variable - All scripts are opt-in (you must config ...[truncated 2429 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make `.learnings/` local and ignored by default. Require an explicit decision before sharing or committing individual sanitized entries. 2. Add mandatory redaction before any error output is persisted. 3. Detect and remove common sensitive patterns, including: - Authorization and cookie headers. - API keys, access tokens, and bearer tokens. - Private keys and certificate material. - Passwords and connection strings. - Credentials embedded in URLs. - Signed query parameters and temporary cloud credentials. 4. Do not record full environment dumps or raw command lines that may contain secrets. Store only the minimum sanitized reproduction information. 5. Replace “Actual error message or output” with “Sanitized excerpt sufficient to identify the failure.” 6. Add a required checklist field confirming that the entry was reviewed for secrets and personal data. 7. Run secret scanning against `.learnings/` in pre-commit and CI workflows. 8. Restrict permissions on local learning files when they may contain operational details. 9. If sensitive data is committed, rotate the affected credential and remove it from repository history and caches; deleting only the latest file revision is insufficient. 10. Clarify in the hook output that raw `CLAUDE_TOOL_OUTPUT` must never be copied without sanitization. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says this skill is about recording learnings, errors, corrections, failed operations, and outdated knowledge for continuous improvement. The supplied code does something materially different: it is an extraction/scaffolding helper that creates a new skill directory and a templated SKILL.md file on disk. While the comments mention creating a skill from a learning entry, the script itself does not capture or analyze failures, corrections, API/tool errors, or recurring better approaches, nor does it review learnings before tasks. Its primary purpose is filesystem-based skill generation, which is not represented by the declared description. Therefore this is a clear description-behavior mismatch.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 94% confidence
• Finding: Writing to ~/.claude/settings.json establishes persistence in the agent's user-level configuration, so any command hook placed there will run across future sessions. In the context of a skill that automatically executes shell scripts, this materially increases the risk of persistent unintended behavior or abuse if the script path is compromised.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: This example combines a user-level config path with an empty matcher, creating a persistent always-on hook across all sessions. Because hook commands execute automatically, a broadly scoped global trigger increases blast radius if the referenced script is modified, replaced, or behaves unexpectedly.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation criteria are broad enough that ordinary conversation, routine corrections, or generic requests could trigger unnecessary logging and persistence. In a skill that writes to persistent files and promotes content into agent memory, over-triggering increases the chance of collecting and retaining data that should not be stored.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to persist user corrections, feature requests, and error context without any warning or filtering for secrets, personal data, tokens, internal paths, or proprietary content. This creates a straightforward data retention risk, especially since logs may later be reviewed, shared, or promoted into other instruction files.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 78% confidence
• Finding: Creating a persistent workspace directory is not inherently unsafe, but in this context it supports long-lived storage of potentially sensitive learnings and error data in a user home directory. That persistence increases the blast radius of any accidental secret capture or privacy mistake elsewhere in the skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Cross-session transcript reading and message sharing are described as normal workflows, but there are no privacy boundaries, access controls, or warnings about relaying sensitive content between sessions. This can spread confidential data beyond its original context and make accidental disclosure more likely.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill normalizes persistent logging plus cross-session sharing of session data, but provides no minimization, retention limits, or sensitivity classification. In practice, this can cause confidential prompts, outputs, errors, or user context to be retained and propagated across agents or sessions.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The logging templates explicitly request full context, user context, inputs, error messages, and related details, which commonly contain secrets, personal information, proprietary code snippets, or internal infrastructure data. Persisting such information in markdown files creates a durable disclosure surface that may later be indexed, committed, or reused.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill encourages aggressive promotion of logged material into durable memory and instruction files used by future agents. If sensitive or user-specific data enters the learning logs, promotion increases persistence, visibility, and the chance that the information resurfaces in unrelated future tasks.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The listed trigger phrases are highly generic and likely to match normal dialogue, causing automatic capture of corrections, requests, and errors even when they contain sensitive information. Because the skill encourages durable storage and review, accidental activation can turn everyday chat into long-lived records.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This markdown file defines hook activation using an empty matcher string for UserPromptSubmit, which effectively matches all prompts. Because the guide does not provide exclusion conditions or tighter scope constraints in these examples, it risks unintended invocation during ordinary use.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Although presented as a lower-overhead configuration, the example still matches every UserPromptSubmit event because the matcher is empty. The description does not clearly distinguish when the hook should or should not run, so the trigger remains ambiguous in scope.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex configuration mirrors the same always-on trigger pattern without clarifying boundaries or exclusions. In a setup guide, this broad default can lead users to enable the skill in contexts far beyond the intended self-improvement use case.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The 'Detection Triggers' section uses generic conditions like 'User corrections', 'API errors', and 'Knowledge gaps' without defining thresholds, scope, or exclusions. These phrases overlap with common interaction patterns and do not clearly distinguish when the skill should act versus ignore routine events.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger label 'Skill issue' is not operationally defined and could refer to many unrelated problems, making invocation or logging decisions inconsistent. Without concrete criteria or examples, different users or agents may interpret it too broadly.

Static analysis

No suspicious patterns detected.