Self Improvement Ai

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:22 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned but asks agents to persist and promote conversation/error details into long-lived agent memory and hook configs without enough privacy, review, or scoping controls.

Install only if you want persistent local self-improvement memory. Keep .learnings local by default, redact secrets and personal data before logging, avoid committing learning logs, do not enable global hooks unless you have reviewed the scripts, and require manual review before promoting any learning into CLAUDE.md, AGENTS.md, Copilot instructions, SOUL.md, or TOOLS.md.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:346

Finding

Untrusted Learning Content Can Poison Persistent Agent Instructions

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` From `SKILL.md:448`: ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` From `hooks/openclaw/handler.js:11-24`: ```javascript After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` ### Technical Analysis The skill creates a path from user-influenced conversation content to persistent agent instruction files. User corrections and task-derived observations may first be written to `.learnings/LEARNINGS.md` and then promoted into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instructions. The promotion criteria check recurrence and time, but they do not validate: - Whether the original content came from a trusted source. - Whether a human explic ...[truncated 1563 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:176

Finding

Diagnostic Logging Can Persist and Expose Sensitive Data

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Manual Installation Retrieves Unpinned Code from a Remote Repository

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about recording and reviewing learnings for continuous improvement when failures, corrections, or knowledge gaps occur. The supplied code does not capture, store, review, or analyze learnings/errors. Instead, it is a filesystem utility that scaffolds a new skill folder and SKILL.md template based on a skill name. Its primary purpose is materially different from the declared behavior. While the template mentions source learnings, the script itself only generates a skill scaffold and writes files, which is an undeclared capability relative to the description.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inter-session guidance explicitly encourages reading other session transcripts and sending learnings across sessions. This creates a direct pathway for private conversation data, credentials, or sensitive operational context to move beyond the original session boundary without clear need-to-know restrictions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The templates ask for full context, inputs, parameters, and user context, which are exactly the fields most likely to contain secrets, access tokens, internal hostnames, file paths, or personally sensitive information. Persisting such raw operational detail materially increases the risk of later disclosure or misuse.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Recommending edits to ~/.claude/settings.json introduces persistent behavior in the user's agent configuration directory, which is a sensitive control plane for future sessions. In this skill context, that persistence is more dangerous because it installs automatic command execution globally rather than limiting effects to a single project.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says to use the skill whenever a command fails, the user corrects the agent, a capability is missing, an external tool fails, knowledge is outdated, or a better approach is discovered. Several of these conditions are very broad and common in normal interactions, and the file does not provide clear exclusion conditions or boundaries for when the skill should not activate.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to record learnings, corrections, and context into durable files for later reuse across sessions. Without data minimization or redaction rules, this can retain sensitive user inputs, secrets, internal URLs, credentials, or proprietary business context long after the original interaction ends.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow creates a standing instruction to retain user corrections and requested capabilities in persistent files. Even when intended for productivity, this can accumulate sensitive or identifying user information and make it available to future sessions or other agents.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Promoting logged content into long-lived instruction and memory files broadens access scope from a local note to durable shared context. If a learning contains sensitive project details or user-provided information, promotion amplifies exposure by making that data more likely to be surfaced in later sessions and to other agents.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'Detection Triggers' section includes generic phrases such as 'Can you also...', 'Is there a way to...', and broad conditions like 'Unexpected output or behavior.' These overlap with ordinary conversation and routine debugging, making it unclear when the skill should activate versus when no logging is needed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Automatically logging user-supplied information whenever it fills a knowledge gap creates a broad retention rule for whatever the user teaches the agent. That can unintentionally preserve confidential facts, internal procedures, or personal information that were only meant for the current interaction.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to promote aggressively encourages copying retained content into shared, durable agent-instruction files without a privacy boundary. This increases blast radius because any mistake in the original log can propagate into multiple long-lived contexts and repeatedly influence future sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown template asks authors to 'Include trigger conditions' but does not require concrete, bounded trigger phrases, exclusions, or negative examples. Because this file is a reusable template, it can propagate ambiguous activation descriptions into derived skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The minimal template says only 'What this skill does and when to use it,' which is too open-ended for a trigger field and does not direct authors to avoid broad everyday phrasing. In a template file, this omission can lead to vague or overly broad invocation descriptions across many generated skills.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

Creating .claude/settings.json in the project root establishes persistent agent behavior for that repository, including automatic command hook execution in later sessions. While this is a legitimate feature, it is security-relevant because it changes future execution semantics and may be committed, shared, or inherited without all users recognizing the implications.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

An empty matcher causes the hook to fire on every user prompt, creating an unnecessarily broad execution surface for a command hook. In this skill context, that means a local script runs continuously during normal agent use, increasing exposure to malicious script modification, prompt-triggered abuse, or accidental performance and privacy side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-level configuration places a command hook in ~/.claude/settings.json with an empty matcher, causing broad automatic execution across all sessions and repositories. Because this persists globally in the agent config directory, any compromise or unsafe modification of the referenced script affects every future interaction, magnifying the blast radius.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Although labeled minimal setup, this configuration still uses an empty matcher and therefore executes on every prompt. The reduced number of hooks lowers overhead but does not reduce the core risk of broad, automatic command execution in the agent workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Codex CLI example also uses an empty matcher, extending the same all-prompts execution pattern to another tool. This broadens the chance that users copy an unsafe default into multiple environments, normalizing unrestricted hook execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document states that the hook scripts only output text and do not run commands, but the configuration explicitly executes shell scripts via hook command entries and also documents invoking another shell script directly. This misrepresents the trust boundary and can cause users to underestimate the risk of arbitrary code execution in their agent context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workspace structure documents MEMORY.md and daily memory files, but does not warn that user prompts, corrections, operational details, or other sensitive session data may be persisted to disk. Because this skill is specifically designed to capture learnings and corrections, silent persistence materially increases privacy and retention risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The guide instructs users to create persistent .learnings storage, but does not explain that failures, corrections, and discovered constraints may be retained across sessions and could include sensitive or identifying information. In a self-improvement skill, persistent retention is core functionality, so the lack of retention boundaries, sanitization rules, or deletion guidance is a real privacy and data-governance weakness.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document describes cross-session transcript access and message passing features without any warning that information from other sessions may contain sensitive user data or that sending messages can propagate sensitive context across boundaries. In a self-improvement/memory-oriented skill, this omission increases the chance that operators or agents will access or relay session data without informed consent, minimization, or review.

Content

No source excerpt is available for this finding.