Self Improving Agent

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 2.0.0

Overview

This skill has a coherent self-improvement purpose, but it needs review because it stores long-lived agent memory and can generate future skills with weak safeguards.

Install only if you want persistent local agent memory and generated skills. Avoid storing secrets or proprietary context, review and clean ~/.openclaw/memory/self-improving and ~/.openclaw/skills-generated regularly, and patch the generator to allow only safe slug names before using skill generation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill describes persistent file reads/writes and likely environment access, but does not declare any permissions or constraints. This creates a transparency and governance gap: a host system or reviewer cannot accurately assess what the skill may access, and the skill’s memory-writing behavior increases the chance of unintended data handling.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The unvalidated skill name is concatenated into a filesystem path and passed to os.makedirs, so a name such as '../x' or an absolute path can escape the intended skills-generated directory. In this self-improving context, names may be derived from task output or model-generated content, making path traversal more dangerous because semi-trusted automation can create or overwrite directories and SKILL.md files in unintended locations under the selected base path or beyond it.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly describes persistent storage of errors, corrections, best practices, and generated skills, but it does not clearly warn users that potentially sensitive prompts, commands, mistakes, and preferences will be written to local files. In a self-improving agent, this creates a real privacy and security risk because stored data can accumulate sensitive operational context and may later be reused or exposed unintentionally.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger list includes broad phrases like 'remember this' and 'learn from mistake' that can occur in ordinary conversation. That can cause unintended activation of a skill that persistently stores corrections, preferences, and task context, expanding the chance of surprise data retention or side effects.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script persists arbitrary user-provided correction text to a local JSONL file without any consent prompt, notice, minimization, or sensitivity checks. In a self-improving agent context, those corrections can easily contain secrets, personal data, or proprietary content, creating a privacy and data-retention risk if the file is later accessed by other tools, users, or compromised processes.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are broad, conversational, and overlap with normal user language such as 'remember this' and 'self-improving'. In a skill that hooks into error logging, correction logging, best-practice capture, and automatic skill generation, accidental activation can cause unintended persistence of user data or unreviewed behavior changes, increasing security and privacy risk.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The metadata and description explicitly promote remembering user preferences, learning from corrections, and auto-generating reusable skills. In this context, persistent storage of natural-language corrections and task context can easily capture secrets, personal data, internal project details, or operational procedures, especially when later reused in generated skills.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The passive and proactive workflows direct broad collection into errors.jsonl, corrections.jsonl, best_practices.jsonl, and generated skills. Because the collected material is free-form and tied to failures, corrections, and task context, it is likely to include sensitive commands, credentials pasted during troubleshooting, business logic, or user preferences that persist beyond the session.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The example commands explicitly encourage saving free-form '--notes "Important context"' and detailed corrections into persistent storage. In practice, users and agents often place API keys, hostnames, internal URLs, customer data, or incident details into such notes, which then become long-lived and may be copied into generated skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Install
mkdir -p ~/.openclaw/memory/self-improving
mkdir -p ~/.openclaw/skills-generated

# Log an error

• Confidence: 86% confidence
• Finding: mkdir -p ~/.openclaw/memory/self-improving mkdir -p ~/.openclaw/skills-generated # Log an error python3 log_error.py --command "npm install xxx" --error "permission denied" --fix "use sudo" # Log a

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.