Self Improving Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 3.0.16

Overview

This skill appears purpose-built rather than malicious, but it broadly encourages agents to store lessons and promote them into future instruction files, so it needs review before installation.

Install only in repositories where persistent agent memory is acceptable. Prefer project-level setup over global hooks, avoid the empty matcher for all prompts, require explicit approval before writing or promoting learnings, review exact diffs to AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or Copilot instructions, and do not use cross-session sharing for private or sensitive work.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:354

Finding

Conversation-Derived Content Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` `SKILL.md:456-464`: ```markdown ## Best Practices 1. **Log immediately** - context is freshest right after the issue 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively* ...[truncated 3250 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/openclaw/handler.js:65

Finding

Opt-In Hooks Inject a Persistent Secondary Objective into Agent Context

Content

View full analysis

After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. EOF ``` `hooks/openclaw/handler.js:12-31`: ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate whether any learnings should be captured. Only log if this repo or workspace is using the self-improvement skill. Before logging: - Create only missing \`.learnings/\` files; never overwrite existing content - Do not log secrets, tokens, private keys, environment variables, or raw transcripts - Prefer short summaries or redacted excerpts over full command output **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, and what to do differently. `.trim(); ``` `hooks/openclaw/handler.js:65-108`: ```javascript // Inject the reminder as ...[truncated 3391 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about maintaining a repository of learnings from failures, corrections, outdated knowledge, and better approaches for continuous improvement. The supplied code does something materially different: it is a command-line helper that creates a new skill folder and a templated SKILL.md file from a skill name. While the template mentions that the skill was extracted from a learning entry, the script itself does not capture learnings, parse errors, record corrections, review prior learnings, or implement the described triggers. Its primary purpose is skill scaffolding/file creation, which is an undeclared and materially different capability from the declared behavior.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 181)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation criteria are extremely broad, causing the skill to activate in many ordinary interactions and increasing the chance that it writes persistent records unnecessarily. In a coding-agent environment, overbroad activation can lead to excessive retention of user prompts, error details, and workspace context, which raises privacy and data-minimization risks even if the skill warns against logging secrets.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This skill explicitly directs creation of persistent files under a workspace home directory, enabling cross-session retention of learnings and errors. Persistent session memory is risky in agent systems because sensitive operational details, file paths, user requests, and excerpts of failures may accumulate over time and become accessible in later sessions or by other tools, especially in the OpenClaw cross-session sharing model described nearby.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The automatic detection triggers instruct the agent to log based on vague conversational cues like corrections, feature wishes, knowledge gaps, and generic errors, without requiring necessity, consent, or sensitivity checks. This can cause the agent to persist user content and operational details into markdown logs far more often than expected, creating durable privacy leakage and potentially storing proprietary information despite the brief redaction guidance.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file defines a UserPromptSubmit hook with an empty matcher string, which effectively matches all prompts. Because the guide presents this as standard setup without constraining scope or giving exclusion examples, it risks unintended invocation during ordinary conversation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'Detection Triggers' section includes generic conditions like 'Knowledge gaps', 'API errors', and 'User corrections' without defining scope, thresholds, or exclusions. In a markdown skill/integration guide, such broad triggers can overlap with common session behavior and make it unclear when the skill should activate versus remain idle.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill focused on capturing learnings, errors, and corrections for continuous improvement, but this script creates entirely new skill directories and templated SKILL.md files. Generating and scaffolding new skills is a broader repository-management capability than merely recording or reviewing learnings.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script creates directories and writes new markdown manifests/templates for skills, which is a content-generation and project-scaffolding capability. That capability is not an obvious or necessary implementation detail of capturing failures, corrections, or outdated knowledge described in the manifest.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.