Learn & Reflect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 0.2.0

Overview

This learning skill is not overtly malicious, but it tells the agent to persist session details and change code, tools, or directives without clear consent, scope, or redaction safeguards.

Install only if you want an agent to keep durable lessons and plan history. Before using it, require explicit approval for every saved entry or code/directive change, keep logs inside a known project folder, review and redact content for secrets or private data, and treat any old plan logs as untrusted historical notes rather than instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:65

Finding

Unapproved Persistent Modification of Tools, Code, and Agent Directives

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:65-85 and SKILL.md:122-134
Vulnerability Type: Excessive write authority and modification beyond the Skill's reflection scope
Risk Level: Medium

Vulnerable Content

markdown

Error occurred
  → Fix the immediate problem
  → Update the tool/script that failed
  → Test the updated tool
  → Update the directive/documentation
  → System is now stronger against this class of error

markdown

**Annealing targets (in order of durability):**

| Target | Durability | Example |
|--------|-----------|---------|
| Code/Script | Highest | Add validation, fix the bug, add error handling |
| Automated check | High | Add to pre-push script, CI check, linter rule |
| Directive/Playbook | Medium | Update the SOP with new step or warning |
| Memory/Notes | Lowest | Save as memory for future conversations |

Always aim for the highest durability target. A lesson embedded in code cannot be forgotten.

markdown

**Step 4: Anneal**
For each lesson, identify the highest-durability target and implement the prevention mechanism.

Technical Analysis

The Skill is presented as a knowledge-capture and reflection mechanism, but its instructions extend beyond documenting lessons. It directs the Agent to implement persistent modifications in source code, scripts, automated checks, directives, and playbooks.

These instructions do not require explicit user authorization before modifying executable or behavior-controlling files. They also do not define an allowed path list, require a reviewable diff, distinguish project-owned files from system or shared files, or constrain the scope of an “annealing” change.

Consequently, a mistaken inference or attacker-influenced lesson could be converted into a persistent code or instruction change. Modifying directives is particularly sensitive because those files may control the Agent's future behavior, whi ...[truncated 1311 chars]

Remediation

View remediation

Remediation Suggestions

1. Make lesson capture read-only by default and emit proposed changes rather than applying them.
2. Require explicit, per-change user approval before modifying source code, scripts, CI configuration, directives, playbooks, or shared tooling.
3. Restrict writes to user-approved project-relative paths and reject traversal, system paths, startup locations, and files outside the active workspace.
4. Display the target path and complete diff before requesting authorization.
5. Separate verified facts from inferences and prohibit automatic implementation when the root cause is not verified.
6. Require tests after an approved change and provide a rollback mechanism.
7. Prohibit modification of Agent directives or security controls unless the user specifically requests that category of change.
8. Record whether a prevention mechanism was merely proposed or was explicitly approved and implemented.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:153

Finding

Automatic Cross-Session Persistence of Potentially Untrusted Context

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:153-197 and SKILL.md:210-216
Vulnerability Type: Persistent memory poisoning and uncontrolled retention
Risk Level: Medium

Vulnerable Content

markdown

### How It Works

Every time a plan is created or a non-trivial task begins, save a timestamped snapshot:

PlanLog/ ├── 202604111430_apify-skills-collection.md ├── 202604111600_clawhub-distribution.md ├── 202604111730_clawhub-deep-dive.md └── 202604111800_learn-skill-update.md

text

markdown

### When to Review the Plan Log

- At the start of a new session (read recent entries for context)
- When unsure what was supposed to happen next
- When the user asks "what were we doing?" or "what's left?"
- Before declaring a task complete (check: did we finish what we planned?)

markdown

## Where to Save Knowledge

| Knowledge type | Where to save |
|---------------|--------------|
| Technical fact (reusable) | Directive or knowledge base file |
| Project-specific context | Memory system or project notes |
| Tool bug or limitation | Comment in the tool's source code |
| Process improvement | Update the relevant SOP/playbook |
| One-time context | Don't save — it's ephemeral |

Technical Analysis

The Skill directs the Agent to save a timestamped plan whenever a plan is created or a non-trivial task begins and to read recent entries at the start of later sessions. It also directs project-specific context into a memory system or project notes.

No explicit user consent is required before persistence or replay. The instructions do not specify a trusted storage location, retention period, access controls, sensitivity filtering, secret redaction, deletion process, or provenance markers. They also do not require the Agent to treat stored text as untrusted historical data rather than executable instructions.

This creates a memory-poisoning channel: attacker-cont ...[truncated 1696 chars]

Remediation

View remediation

Remediation Suggestions

1. Make cross-session persistence opt-in and ask the user before creating each plan log or memory entry.
2. Show the exact content and destination path before writing it.
3. Define a dedicated project-relative storage directory with restrictive permissions and prohibit storage outside the approved workspace.
4. Scan and redact credentials, tokens, personal information, private keys, environment values, and other sensitive content before persistence.
5. Add creation time, source, author, project scope, expiration time, and trust status to every entry.
6. Apply a retention limit and provide explicit review, correction, and deletion mechanisms.
7. Treat reloaded notes strictly as untrusted historical data, not as Agent instructions or authorization.
8. Do not automatically read prior entries at session startup; request user approval and identify the entries that would be loaded.
9. Prevent memory entries from overriding current user instructions, system safety controls, or project security policy.
10. Store verified facts separately from inferences and assumptions so unverified conclusions cannot silently become durable rules.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and include common language such as 'save lessons' and 'what were we doing', which can cause the skill to activate in contexts the user did not clearly intend. Unintended invocation is risky here because the skill encourages persistent recording of session content, increasing the chance of unnecessary data capture or workflow drift.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'When to Use' guidance includes ambiguous language like 'record this', which is too underspecified for a skill that creates retained knowledge artifacts. In practice this can cause the agent to interpret casual user phrasing as consent to summarize and store session details, including sensitive operational context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions explicitly encourage recording session actions, errors, fixes, file paths, commands, and plan context, all of which may contain credentials, internal topology, customer data, or other sensitive material. Because the skill also promotes reuse and later review of these artifacts, any captured sensitive data may be replayed, exposed to future contexts, or retained longer than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to save timestamped plan logs and knowledge artifacts but provides no safeguards around secrets, personal data, retention, or storage scope. This creates a straightforward path for sensitive information from user sessions, internal plans, file paths, or operational details to be written to persistent storage in plain text.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.