Self Improvement Ai

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:22 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned but asks agents to persist and promote conversation/error details into long-lived agent memory and hook configs without enough privacy, review, or scoping controls.

Install only if you want persistent local self-improvement memory. Keep .learnings local by default, redact secrets and personal data before logging, avoid committing learning logs, do not enable global hooks unless you have reviewed the scripts, and require manual review before promoting any learning into CLAUDE.md, AGENTS.md, Copilot instructions, SOUL.md, or TOOLS.md.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:346
• Finding: Untrusted Learning Content Can Poison Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:346-360`, `SKILL.md:448`, `hooks/openclaw/handler.js:11-24` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code From `SKILL.md:346-360`: ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` From `SKILL.md:448`: ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` From `hooks/openclaw/handler.js:11-24`: ```javascript After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` ### Technical Analysis The skill creates a path from user-influenced conversation content to persistent agent instruction files. User corrections and task-derived observations may first be written to `.learnings/LEARNINGS.md` and then promoted into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instructions. The promotion criteria check recurrence and time, but they do not validate: - Whether the original content came from a trusted source. - Whether a human explic ...[truncated 1563 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before writing to any persistent agent instruction file. 2. Treat every learning derived from user messages, command output, external documents, or tool results as untrusted data. 3. Record provenance for every entry, including its source session, author, originating file, and approval status. 4. Do not use recurrence alone as evidence of trust; prevent duplicate attacker-generated observations from satisfying promotion criteria. 5. Add a validation stage that rejects: - Safety-policy overrides. - Requests to ignore prior instructions. - Tool-execution directives. - Encoded or obfuscated content. - External payload URLs. - Credential-handling instructions. 6. Generate a proposed diff for human review instead of directly modifying `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instructions. 7. Limit automatic promotion to narrowly scoped, non-executable project facts. 8. Maintain an audit log and provide a rollback mechanism for every promoted rule. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:176
• Finding: Diagnostic Logging Can Persist and Expose Sensitive Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:176-191`, `SKILL.md:450-459` **Vulnerability Type**: Unsafe retention of raw diagnostics and environment details **Risk Level**: Medium ### Vulnerable Code From the error-entry template in `SKILL.md:176-191`: ```markdown ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ### Suggested Fix If identifiable, what might resolve this ``` From `SKILL.md:450-459`: ```markdown ## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/ ``` **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` The quick-reference section also directs API and external-tool failures to be recorded with integration details: ```markdown | API/external tool fails | Log to `.learnings/ERRORS.md` with integration details | ``` ### Technical Analysis Raw command output, API error responses, parameters, and environment details frequently contain sensitive information, including: - API tokens and authorization headers. - Session cookies. - Credentials embedded in URLs. - Internal hostnames and service endpoints. - User identifiers and personal data. - Local filesystem paths. - Environment variables and configuration values. The workflow does not require redaction before writing this information to `.learnings/ERRORS.md`. It also presents repository tracking as a supported team-wide workflow, which can cause sensitive diagnostics to enter version-control history. Once committed, removing the current file does not remove the data from previous commits, mirrors, forks, caches, or CI artifacts. ### Attack Path 1. A command or external API fails and prints a credential, authenticated URL, header, environment value, or private operational detail. 2. The agent follows the provided template and copies the raw output and environment details into ` ...[truncated 965 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default `.learnings/` to local-only storage and add it to `.gitignore` during setup. 2. Require explicit opt-in and review before any learning file is committed. 3. Replace “Actual error message or output” with a sanitized summary by default. 4. Prohibit storage of: - Passwords, tokens, API keys, and cookies. - Authorization or proxy-authorization headers. - Private keys and certificates. - Complete environment dumps. - Authenticated URLs and signed query strings. - Personal or regulated data. 5. Implement redaction for common secret formats and sensitive field names. 6. Add pre-commit secret scanning for `.learnings/`, generated skills, and persistent prompt files. 7. Store only the minimum diagnostic context required to reproduce the issue. 8. Document repository-history cleanup and credential-rotation procedures for accidental disclosure. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39
• Finding: Manual Installation Retrieves Unpinned Code from a Remote Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:39-44` **Vulnerability Type**: Unpinned remote supply-chain dependency **Risk Level**: Medium ### Vulnerable Code ```markdown **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis The documented manual installation command clones the repository's current default branch without pinning a reviewed commit, immutable release tag, checksum, or cryptographic signature. A plain `git clone` does not itself execute the downloaded scripts. However, the installation workflow places them in an agent skill directory, and subsequent documented hook activation can cause installed scripts or handlers to run with the agent user's permissions. The effective installed payload can therefore differ from the version audited here if the upstream repository changes after review. ### Attack Path 1. The upstream repository, maintainer account, release process, or repository ownership is compromised. 2. An attacker modifies hook handlers or shell scripts in the default branch. 3. A user follows the documentation and clones the current repository state. 4. The user enables the installed OpenClaw, Claude Code, or Codex hook. 5. The altered hook executes during agent lifecycle events. 6. Malicious code operates with the same permissions available to the agent process. ### Impact Assessment A compromised upstream version could read or modify any files accessible to the agent user, inspect hook-provided data, alter agent context, invoke local commands, or communicate over the network where permitted. The audited repository version does not contain such a remote-execution payload. This finding concerns the unsafe installation mechanism and its ability to ...[truncated 133 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin manual installation to a specific reviewed commit hash or immutable signed release. 2. Publish SHA-256 checksums for release archives and document verification before installation. 3. Sign releases and verify signatures against a documented maintainer key. 4. Avoid enabling hooks immediately after cloning; require a review of executable files first. 5. Prefer a trusted registry that supports immutable, versioned artifacts and integrity metadata. 6. Separate executable hooks from documentation-only skill content and request explicit approval before installing executable components. 7. Document the exact reviewed version in installation examples. 8. Add a secure update process that displays executable changes and requires user confirmation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about recording and reviewing learnings for continuous improvement when failures, corrections, or knowledge gaps occur. The supplied code does not capture, store, review, or analyze learnings/errors. Instead, it is a filesystem utility that scaffolds a new skill folder and SKILL.md template based on a skill name. Its primary purpose is materially different from the declared behavior. While the template mentions source learnings, the script itself only generates a skill scaffold and writes files, which is an undeclared capability relative to the description.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The inter-session guidance explicitly encourages reading other session transcripts and sending learnings across sessions. This creates a direct pathway for private conversation data, credentials, or sensitive operational context to move beyond the original session boundary without clear need-to-know restrictions.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The templates ask for full context, inputs, parameters, and user context, which are exactly the fields most likely to contain secrets, access tokens, internal hostnames, file paths, or personally sensitive information. Persisting such raw operational detail materially increases the risk of later disclosure or misuse.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Recommending edits to ~/.claude/settings.json introduces persistent behavior in the user's agent configuration directory, which is a sensitive control plane for future sessions. In this skill context, that persistence is more dangerous because it installs automatic command execution globally rather than limiting effects to a single project.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description says to use the skill whenever a command fails, the user corrects the agent, a capability is missing, an external tool fails, knowledge is outdated, or a better approach is discovered. Several of these conditions are very broad and common in normal interactions, and the file does not provide clear exclusion conditions or boundaries for when the skill should not activate.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to record learnings, corrections, and context into durable files for later reuse across sessions. Without data minimization or redaction rules, this can retain sensitive user inputs, secrets, internal URLs, credentials, or proprietary business context long after the original interaction ends.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The workflow creates a standing instruction to retain user corrections and requested capabilities in persistent files. Even when intended for productivity, this can accumulate sensitive or identifying user information and make it available to future sessions or other agents.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Promoting logged content into long-lived instruction and memory files broadens access scope from a local note to durable shared context. If a learning contains sensitive project details or user-provided information, promotion amplifies exposure by making that data more likely to be surfaced in later sessions and to other agents.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The 'Detection Triggers' section includes generic phrases such as 'Can you also...', 'Is there a way to...', and broad conditions like 'Unexpected output or behavior.' These overlap with ordinary conversation and routine debugging, making it unclear when the skill should activate versus when no logging is needed.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: Automatically logging user-supplied information whenever it fills a knowledge gap creates a broad retention rule for whatever the user teaches the agent. That can unintentionally preserve confidential facts, internal procedures, or personal information that were only meant for the current interaction.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instruction to promote aggressively encourages copying retained content into shared, durable agent-instruction files without a privacy boundary. This increases blast radius because any mistake in the original log can propagate into multiple long-lived contexts and repeatedly influence future sessions.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: This markdown template asks authors to 'Include trigger conditions' but does not require concrete, bounded trigger phrases, exclusions, or negative examples. Because this file is a reusable template, it can propagate ambiguous activation descriptions into derived skills.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The minimal template says only 'What this skill does and when to use it,' which is too open-ended for a trigger field and does not direct authors to avoid broad everyday phrasing. In a template file, this omission can lead to vague or overly broad invocation descriptions across many generated skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 78% confidence
• Finding: Creating .claude/settings.json in the project root establishes persistent agent behavior for that repository, including automatic command hook execution in later sessions. While this is a legitimate feature, it is security-relevant because it changes future execution semantics and may be committed, shared, or inherited without all users recognizing the implications.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: An empty matcher causes the hook to fire on every user prompt, creating an unnecessarily broad execution surface for a command hook. In this skill context, that means a local script runs continuously during normal agent use, increasing exposure to malicious script modification, prompt-triggered abuse, or accidental performance and privacy side effects.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The user-level configuration places a command hook in ~/.claude/settings.json with an empty matcher, causing broad automatic execution across all sessions and repositories. Because this persists globally in the agent config directory, any compromise or unsafe modification of the referenced script affects every future interaction, magnifying the blast radius.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Although labeled minimal setup, this configuration still uses an empty matcher and therefore executes on every prompt. The reduced number of hooks lowers overhead but does not reduce the core risk of broad, automatic command execution in the agent workflow.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex CLI example also uses an empty matcher, extending the same all-prompts execution pattern to another tool. This broadens the chance that users copy an unsafe default into multiple environments, normalizing unrestricted hook execution.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document states that the hook scripts only output text and do not run commands, but the configuration explicitly executes shell scripts via hook command entries and also documents invoking another shell script directly. This misrepresents the trust boundary and can cause users to underestimate the risk of arbitrary code execution in their agent context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workspace structure documents MEMORY.md and daily memory files, but does not warn that user prompts, corrections, operational details, or other sensitive session data may be persisted to disk. Because this skill is specifically designed to capture learnings and corrections, silent persistence materially increases privacy and retention risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 89% confidence
• Finding: The guide instructs users to create persistent .learnings storage, but does not explain that failures, corrections, and discovered constraints may be retained across sessions and could include sensitive or identifying information. In a self-improvement skill, persistent retention is core functionality, so the lack of retention boundaries, sanitization rules, or deletion guidance is a real privacy and data-governance weakness.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document describes cross-session transcript access and message passing features without any warning that information from other sessions may contain sensitive user data or that sending messages can propagate sensitive context across boundaries. In a self-improvement/memory-oriented skill, this omission increases the chance that operators or agents will access or relay session data without informed consent, minimization, or review.

Static analysis

No suspicious patterns detected.