T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:23- Finding
Untrusted Learnings Can Poison Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent V2
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly about learning capture, but it can persist conversation-derived content into future agent instructions with broad hooks and limited privacy safeguards.
Install only if you want an agent to keep durable learning logs and potentially update future agent instruction files. Keep .learnings local by default, redact secrets and personal data before logging, avoid global always-on hooks, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:158- Finding
Raw Error Logging Can Persist and Publish Sensitive Information
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill is about recording learnings, errors, corrections, failed operations, and outdated knowledge for continuous improvement. The supplied code does something materially different: it is an extraction/scaffolding helper that creates a new skill directory and a templated SKILL.md file on disk. While the comments mention creating a skill from a learning entry, the script itself does not capture or analyze failures, corrections, API/tool errors, or recurring better approaches, nor does it review learnings before tasks. Its primary purpose is filesystem-based skill generation, which is not represented by the declared description. Therefore this is a clear description-behavior mismatch.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 94% confidence
- Finding
Writing to ~/.claude/settings.json establishes persistence in the agent's user-level configuration, so any command hook placed there will run across future sessions. In the context of a skill that automatically executes shell scripts, this materially increases the risk of persistent unintended behavior or abuse if the script path is compromised.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This example combines a user-level config path with an empty matcher, creating a persistent always-on hook across all sessions. Because hook commands execute automatically, a broadly scoped global trigger increases blast radius if the referenced script is modified, replaced, or behaves unexpectedly.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation criteria are broad enough that ordinary conversation, routine corrections, or generic requests could trigger unnecessary logging and persistence. In a skill that writes to persistent files and promotes content into agent memory, over-triggering increases the chance of collecting and retaining data that should not be stored.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to persist user corrections, feature requests, and error context without any warning or filtering for secrets, personal data, tokens, internal paths, or proprietary content. This creates a straightforward data retention risk, especially since logs may later be reviewed, shared, or promoted into other instruction files.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
Creating a persistent workspace directory is not inherently unsafe, but in this context it supports long-lived storage of potentially sensitive learnings and error data in a user home directory. That persistence increases the blast radius of any accidental secret capture or privacy mistake elsewhere in the skill.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Cross-session transcript reading and message sharing are described as normal workflows, but there are no privacy boundaries, access controls, or warnings about relaying sensitive content between sessions. This can spread confidential data beyond its original context and make accidental disclosure more likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill normalizes persistent logging plus cross-session sharing of session data, but provides no minimization, retention limits, or sensitivity classification. In practice, this can cause confidential prompts, outputs, errors, or user context to be retained and propagated across agents or sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The logging templates explicitly request full context, user context, inputs, error messages, and related details, which commonly contain secrets, personal information, proprietary code snippets, or internal infrastructure data. Persisting such information in markdown files creates a durable disclosure surface that may later be indexed, committed, or reused.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages aggressive promotion of logged material into durable memory and instruction files used by future agents. If sensitive or user-specific data enters the learning logs, promotion increases persistence, visibility, and the chance that the information resurfaces in unrelated future tasks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The listed trigger phrases are highly generic and likely to match normal dialogue, causing automatic capture of corrections, requests, and errors even when they contain sensitive information. Because the skill encourages durable storage and review, accidental activation can turn everyday chat into long-lived records.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file defines hook activation using an empty matcher string for UserPromptSubmit, which effectively matches all prompts. Because the guide does not provide exclusion conditions or tighter scope constraints in these examples, it risks unintended invocation during ordinary use.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Although presented as a lower-overhead configuration, the example still matches every UserPromptSubmit event because the matcher is empty. The description does not clearly distinguish when the hook should or should not run, so the trigger remains ambiguous in scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Codex configuration mirrors the same always-on trigger pattern without clarifying boundaries or exclusions. In a setup guide, this broad default can lead users to enable the skill in contexts far beyond the intended self-improvement use case.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The 'Detection Triggers' section uses generic conditions like 'User corrections', 'API errors', and 'Knowledge gaps' without defining thresholds, scope, or exclusions. These phrases overlap with common interaction patterns and do not clearly distinguish when the skill should act versus ignore routine events.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger label 'Skill issue' is not operationally defined and could refer to many unrelated problems, making invocation or logging decisions inconsistent. Without concrete criteria or examples, different users or agents may interpret it too broadly.
- Content