aaaa

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:57 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent self-improvement purpose, but it persistently records and promotes conversation-derived guidance into future agent instructions with weak scoping and review safeguards.

Install only if you want agents to keep local learning logs and potentially turn them into future agent instructions. Prefer project-scoped setup, avoid global hooks, do not store secrets or raw transcripts in .learnings, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:328

Finding

Untrusted learning content can persistently influence future agent sessions

Content

View full analysis

" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable ``` The OpenClaw bootstrap hook reinforces the promotion workflow: ```javascript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` ### Technical Analysis The Skill accepts information originating from user corrections, task summaries, errors, and session activity, stores it in `.learnings/`, and encourages promotion into files that function as persistent agent instructions. Recurrence counting establishes frequency but not trustworthiness. The wo ...[truncated 2376 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:92

Finding

Symlink traversal allows the Skill extraction script to write outside the workspace

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The validation rejects absolute paths and literal `..` path segments, but it does not resolve the canonical destination or reject symlinked path components. A relative path can therefore remain lexically inside the current directory while resolving to a directory outside it. For example, if `external-skills` is a symlink to an external location, this argument passes validation: ```bash ./scripts/extract-skill.sh injected-skill --output-dir external-skills ``` Both `mkdir -p` and shell redirection follow symlinks. As a result, the generated directory and `SKILL.md` can be created outside the intended workspace boundary. The restrictive validation of `SKILL_NAME` prevents direct traversal through the Skill name, but it does not address symlinks in `SKILLS_DIR` or its parent components. ### Attack Path 1. An attacker with write access to the workspace creates a relative symlink: ```bash ln -s /path/outside/workspace external-sk ...[truncated 1093 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about a learning/correction capture mechanism used when failures, user corrections, or outdated knowledge are discovered. The supplied code does not capture, store, analyze, or review learnings. Instead, it is a filesystem utility for scaffolding a new skill folder and SKILL.md file from an existing learning entry. This is a materially different primary purpose. The code also performs undeclared write operations by creating directories and files, even though the declared permissions are empty. While the comments mention learnings, the actual behavior is conversion/scaffolding, not continuous-improvement logging or retrieval. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Directing users to modify ~/.claude/settings.json affects the agent's persistent configuration directory, which is a sensitive control plane for future behavior. Changes there can create durable automatic execution and cross-project influence, making mistakes or malicious script substitutions more impactful than project-local changes.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill when a user corrects Claude, when a better approach is discovered, and to 'review learnings before major tasks' without clearly defining boundaries or exclusions. These triggers are broad enough to overlap with many normal conversations and routine work, which could cause unintended or excessive invocation of the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill establishes persistent session state under a home-directory workspace, enabling retention across sessions. Persistence itself is not malicious, but in this context it becomes risky because the same document also encourages storing detailed learnings and sharing them across sessions without privacy controls.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages cross-session sharing of learnings and reading/sending other sessions’ transcripts without any minimization, consent, or secret-handling constraints. This can persist and redistribute sensitive user content, credentials, internal code, or confidential operational context beyond the original session.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The logging instructions tell the agent to retain full context, inputs, parameters, environment details, and detailed narratives in persistent markdown files. Without mandatory sanitization, this creates a durable record of potentially sensitive data that may later be read by other agents or committed into repositories.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'Detection Triggers' section includes generic phrases such as 'Can you also...', 'Is there a way to...', and broad conditions like 'Unexpected output or behavior.' These patterns are common in everyday requests and do not specify when the skill should not activate, increasing the chance of false-positive invocations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guidance to 'promote aggressively' into CLAUDE.md, Copilot instructions, and other persistent memory files increases the blast radius of any sensitive information initially captured. Once propagated into broadly loaded instruction files, accidental disclosure becomes more likely across future sessions and tools.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Placing hook configuration in .claude/settings.json creates session-persistent behavior that survives across prompts and may continue influencing future agent actions. In this skill context, persistence makes the auto-triggered reminder and script execution model more dangerous because it is easy to forget the hooks remain active after initial setup.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

An empty matcher causes the hook to trigger on every prompt, creating broad automatic execution with no scoping. In an agent skill that runs helper scripts, this increases exposure to prompt-driven abuse, unnecessary context injection, and repeated execution of local code regardless of task relevance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-level configuration installs the hook into ~/.claude/settings.json for global activation across sessions and projects. That persistence and broad scope magnify the blast radius of any unsafe script behavior, because the hook will run automatically in unrelated contexts and may process sensitive prompts or project data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Codex CLI example duplicates the always-match trigger pattern, extending the same broad automatic execution model to another tool. Repeating insecure defaults across ecosystems increases the likelihood of widespread unsafe adoption and normalizes unrestricted hook execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document states that the scripts 'only output text' and 'don't modify files or run commands', but the configuration explicitly invokes shell scripts via hook commands. That mismatch can mislead users into granting trust to code that executes automatically in their agent environment, increasing the chance of unsafe deployment or underestimating execution risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

This integration explicitly establishes on-disk session persistence for a self-improvement workflow. Because the skill is designed to capture errors, corrections, and operational learnings, the persisted artifacts may accumulate sensitive operational context over time, increasing privacy and prompt-leakage risk if the workspace is shared, backed up, or later ingested by other agents.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Although presented as a lower-overhead option, the minimal setup still uses an unrestricted matcher and therefore executes on every prompt. This broad activation is less severe than the global variant but still unnecessarily expands the circumstances under which local scripts run and inject content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file includes shell commands that recursively copy the skill and hook into ~/.openclaw/..., which alters the user's local configuration and installed components. The guide presents these write operations as setup steps but does not include any warning that they modify persistent files or may overwrite existing content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide instructs creation of a .learnings directory and says to log learnings there, but does not warn that conversation-derived content, tool errors, or potentially sensitive session details may be written to disk long-term. In a self-improvement skill, this increases the chance that secrets, internal prompts, or user data are unintentionally persisted beyond the active session.

Content

No source excerpt is available for this finding.