Security audit

aaaa

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent self-improvement purpose, but it persistently records and promotes conversation-derived guidance into future agent instructions with weak scoping and review safeguards.

Install only if you want agents to keep local learning logs and potentially turn them into future agent instructions. Prefer project-scoped setup, avoid global hooks, do not store secrets or raw transcripts in .learnings, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:328
Finding: Untrusted learning content can persistently influence future agent sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:328-360`; supporting behavior in `hooks/openclaw/handler.js:20-23` and `references/openclaw-integration.md:130-142` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium ### Vulnerable Code ```markdown ## Simplify & Harden Feed Use this workflow to ingest recurring patterns from the `simplify-and-harden` skill and turn them into durable prompt guidance. ### Ingestion Workflow 1. Read `simplify_and_harden.learning_loop.candidates` from the task summary. 2. For each candidate, use `pattern_key` as the stable dedupe key. 3. Search `.learnings/LEARNINGS.md` for an existing entry with that key: - `grep -n "Pattern-Key: <pattern_key>" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable ``` The OpenClaw bootstrap hook reinforces the promotion workflow: ```javascript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` ### Technical Analysis The Skill accepts information originating from user corrections, task summaries, errors, and session activity, stores it in `.learnings/`, and encourages promotion into files that function as persistent agent instructions. Recurrence counting establishes frequency but not trustworthiness. The wo ...[truncated 2376 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before promoting any learning into an automatically loaded instruction file. 2. Treat user messages, command output, task summaries, session transcripts, and generated learning entries as untrusted data. 3. Store learnings in a non-authoritative data file rather than directly in `SOUL.md`, `AGENTS.md`, `TOOLS.md`, or equivalent instruction files. 4. Preserve provenance for every entry, including originating user, session, task, timestamp, and approval status. 5. Reject or quarantine content that: - Contains imperative commands. - Changes safety or authorization requirements. - Requests secret access or external transmission. - Modifies tool permissions or confirmation rules. - Instructs the agent to ignore higher-priority guidance. 6. Replace frequency-only promotion with a review process that evaluates correctness, security impact, and source trust. 7. Delimit any stored learning injected into context as untrusted reference material and explicitly prohibit treating it as an instruction. 8. Provide a review and rollback mechanism for all promoted rules. 9. Restrict cross-session propagation to sanitized factual summaries rather than verbatim session-derived content. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract-skill.sh:92
Finding: Symlink traversal allows the Skill extraction script to write outside the workspace<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh:92-106` and `scripts/extract-skill.sh:167-170` **Vulnerability Type**: Symlink-based path traversal and arbitrary file creation **Risk Level**: Medium ### Vulnerable Code The script performs only lexical validation of the requested output directory: ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" ``` It subsequently creates and writes through the resulting path: ```bash # Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The validation rejects absolute paths and literal `..` path segments, but it does not resolve the canonical destination or reject symlinked path components. A relative path can therefore remain lexically inside the current directory while resolving to a directory outside it. For example, if `external-skills` is a symlink to an external location, this argument passes validation: ```bash ./scripts/extract-skill.sh injected-skill --output-dir external-skills ``` Both `mkdir -p` and shell redirection follow symlinks. As a result, the generated directory and `SKILL.md` can be created outside the intended workspace boundary. The restrictive validation of `SKILL_NAME` prevents direct traversal through the Skill name, but it does not address symlinks in `SKILLS_DIR` or its parent components. ### Attack Path 1. An attacker with write access to the workspace creates a relative symlink: ```bash ln -s /path/outside/workspace external-sk ...[truncated 1093 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve both the current workspace and destination to canonical paths before writing: ```bash WORKSPACE_ROOT="$(realpath -e .)" OUTPUT_PARENT="$(realpath -m -- "$SKILLS_DIR")" case "$OUTPUT_PARENT/" in "$WORKSPACE_ROOT/"*) ;; *) log_error "Resolved output directory escapes the workspace." exit 1 ;; esac ``` 2. Reject symlinked components in the output path. Inspect each existing component with `test -L` or use a secure directory-walking implementation. 3. Revalidate the canonical destination after directory creation to reduce time-of-check/time-of-use exposure. 4. Refuse to overwrite or follow a pre-existing symlink at `SKILL_PATH` or `SKILL_PATH/SKILL.md`. 5. Create the final file using no-follow and exclusive-creation semantics. A small helper in a language supporting `O_NOFOLLOW | O_CREAT | O_EXCL` is preferable to shell redirection. 6. Use restrictive default permissions, such as: ```bash umask 077 ``` 7. If custom output locations are unnecessary, remove `--output-dir` and always write beneath a fixed, canonical `skills/` directory. 8. Add regression tests covering: - A symlinked output directory. - A symlinked parent component. - A pre-existing `SKILL.md` symlink. - Paths that resolve outside the workspace. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about a learning/correction capture mechanism used when failures, user corrections, or outdated knowledge are discovered. The supplied code does not capture, store, analyze, or review learnings. Instead, it is a filesystem utility for scaffolding a new skill folder and SKILL.md file from an existing learning entry. This is a materially different primary purpose. The code also performs undeclared write operations by creating directories and files, even though the declared permissions are empty. While the comments mention learnings, the actual behavior is conversion/scaffolding, not continuous-improvement logging or retrieval. Therefore this is a clear description-behavior mismatch.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Directing users to modify ~/.claude/settings.json affects the agent's persistent configuration directory, which is a sensitive control plane for future behavior. Changes there can create durable automatic execution and cross-project influence, making mistakes or malicious script substitutions more impactful than project-local changes.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description says to use the skill when a user corrects Claude, when a better approach is discovered, and to 'review learnings before major tasks' without clearly defining boundaries or exclusions. These triggers are broad enough to overlap with many normal conversations and routine work, which could cause unintended or excessive invocation of the skill.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 87% confidence
Finding: The skill establishes persistent session state under a home-directory workspace, enabling retention across sessions. Persistence itself is not malicious, but in this context it becomes risky because the same document also encourages storing detailed learnings and sharing them across sessions without privacy controls.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill explicitly encourages cross-session sharing of learnings and reading/sending other sessions’ transcripts without any minimization, consent, or secret-handling constraints. This can persist and redistribute sensitive user content, credentials, internal code, or confidential operational context beyond the original session.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The logging instructions tell the agent to retain full context, inputs, parameters, environment details, and detailed narratives in persistent markdown files. Without mandatory sanitization, this creates a durable record of potentially sensitive data that may later be read by other agents or committed into repositories.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The 'Detection Triggers' section includes generic phrases such as 'Can you also...', 'Is there a way to...', and broad conditions like 'Unexpected output or behavior.' These patterns are common in everyday requests and do not specify when the skill should not activate, increasing the chance of false-positive invocations.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The guidance to 'promote aggressively' into CLAUDE.md, Copilot instructions, and other persistent memory files increases the blast radius of any sensitive information initially captured. Once propagated into broadly loaded instruction files, accidental disclosure becomes more likely across future sessions and tools.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 84% confidence
Finding: Placing hook configuration in .claude/settings.json creates session-persistent behavior that survives across prompts and may continue influencing future agent actions. In this skill context, persistence makes the auto-triggered reminder and script execution model more dangerous because it is easy to forget the hooks remain active after initial setup.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: An empty matcher causes the hook to trigger on every prompt, creating broad automatic execution with no scoping. In an agent skill that runs helper scripts, this increases exposure to prompt-driven abuse, unnecessary context injection, and repeated execution of local code regardless of task relevance.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The user-level configuration installs the hook into ~/.claude/settings.json for global activation across sessions and projects. That persistence and broad scope magnify the blast radius of any unsafe script behavior, because the hook will run automatically in unrelated contexts and may process sensitive prompts or project data.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The Codex CLI example duplicates the always-match trigger pattern, extending the same broad automatic execution model to another tool. Repeating insecure defaults across ecosystems increases the likelihood of widespread unsafe adoption and normalizes unrestricted hook execution.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document states that the scripts 'only output text' and 'don't modify files or run commands', but the configuration explicitly invokes shell scripts via hook commands. That mismatch can mislead users into granting trust to code that executes automatically in their agent environment, increasing the chance of unsafe deployment or underestimating execution risk.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 82% confidence
Finding: This integration explicitly establishes on-disk session persistence for a self-improvement workflow. Because the skill is designed to capture errors, corrections, and operational learnings, the persisted artifacts may accumulate sensitive operational context over time, increasing privacy and prompt-leakage risk if the workspace is shared, backed up, or later ingested by other agents.

Vague Triggers

Low

Confidence: 92% confidence
Finding: Although presented as a lower-overhead option, the minimal setup still uses an unrestricted matcher and therefore executes on every prompt. This broad activation is less severe than the global variant but still unnecessarily expands the circumstances under which local scripts run and inject content.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: This markdown file includes shell commands that recursively copy the skill and hook into `~/.openclaw/...`, which alters the user's local configuration and installed components. The guide presents these write operations as setup steps but does not include any warning that they modify persistent files or may overwrite existing content.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The guide instructs creation of a .learnings directory and says to log learnings there, but does not warn that conversation-derived content, tool errors, or potentially sensitive session details may be written to disk long-term. In a self-improvement skill, this increases the chance that secrets, internal prompts, or user data are unintentionally persisted beyond the active session.

Static analysis

No suspicious patterns detected.