Self Improving Agent Local

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:19 PM UTC
• Version: 1.0.10

Overview

The skill is not overtly malicious, but it needs review because it encourages persistent agent memory, broad hooks, and cross-session sharing without enough redaction or approval controls.

Before installing, decide whether you want an agent to create persistent learning files and propose edits to files that shape future agent behavior. Keep logs local unless deliberately sharing them, redact secrets and personal or customer data, avoid global hooks unless necessary, use narrow hook matchers, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:445
• Finding: Untrusted Lessons Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:27-30` - `SKILL.md:85-96` - `SKILL.md:352-368` - `SKILL.md:445-447` - `hooks/openclaw/handler.js:12-24, 45-50` - `hooks/openclaw/handler.ts:11-25, 53-59` - `references/openclaw-integration.md:128-145` **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: High ### Vulnerable Code and Instructions `SKILL.md:27-30` recommends promoting captured lessons into persistent agent instruction files: ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` `SKILL.md:445-447` explicitly encourages aggressive promotion: ```markdown 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md 8. **Review regularly** - stale learnings lose value ``` `hooks/openclaw/handler.js:12-24` injects the promotion reminder into agent bootstrap context: ```javascript After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` `hooks/openclaw/handler.js:45-50` places that reminder in the files loaded during bootstrap: ```javascript if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ ...[truncated 3576 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Require explicit human approval** - Never automatically promote content derived from users, tools, APIs, logs, or other sessions. - Present the exact proposed diff and require affirmative approval before modifying any persistent instruction file. 2. **Introduce source provenance and trust levels** - Record the original source, session, timestamp, and trust classification for every lesson. - Mark user input, command output, external responses, and cross-session messages as untrusted by default. - Prevent untrusted entries from becoming agent instructions without independent verification. 3. **Store observations as data rather than directives** - Quote original content and clearly delimit it as untrusted evidence. - Do not copy imperative phrases directly into `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or similar files. - Convert verified observations into narrowly scoped factual statements. 4. **Apply a strict promotion schema** - Allow only predefined fields such as affected component, verified behavior, reproduction steps, and evidence. - Reject or flag content containing tool commands, URLs, requests for secrets, behavioral overrides, credential instructions, or changes to safety constraints. 5. **Replace aggressive promotion guidance** - Remove “Promote aggressively” and “if in doubt” language. - Require reproducible evidence, independent confirmation, and a documented security review before promotion. 6. **Do not treat repetition as proof** - Deduplicate by source and session. - Require confirmation from trusted project documentation, tests, or a human maintainer rather than relying only on recurrence count. 7. **Separate memory from executable agent policy** - Keep `.learnings/` as an informational archive that is not interpreted as authoritative instruction context. - Maintain persistent agent policy files under stricter ownership and review controls. 8. **A ...[truncated 531 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about recording and reviewing learnings from failures, corrections, and discoveries. The supplied code does not capture, store, analyze, or review learnings. Instead, it is a helper utility that scaffolds a new skill from a learning entry by creating directories and a templated SKILL.md file on disk. This is a materially different primary purpose and includes filesystem write capabilities not reflected in the declaration. While the comments mention 'from a learning entry,' the implemented behavior is skill extraction/scaffolding, not continuous-improvement logging itself.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The templates explicitly ask for full context, inputs, parameters, user context, and error/output details in persistent logs. Those fields commonly contain API keys, bearer tokens, file paths, customer data, prompts, stack traces, or internal configuration, so the skill materially increases the risk of durable sensitive-data leakage.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Directing users to modify ~/.claude/settings.json and place executable hook scripts under ~/.claude/skills creates persistent access to the agent's configuration directory. Because this location affects future sessions globally, any malicious or tampered script there gains durable influence over agent behavior across projects.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 80% confidence
• Finding: The skill explicitly establishes persistent local storage for accumulated learnings under a workspace path, which creates retention of potentially sensitive operational and conversational data across sessions. Persistence is part of the feature, but without retention, access, and sanitization controls it increases exposure if the workspace is shared, backed up, or later inspected by other tools.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The inter-session communication section normalizes reading other session transcripts and sending learnings across sessions, which can propagate confidential chat content beyond its original scope. Without access controls, consent rules, or redaction requirements, this creates a clear path for unintended disclosure between sessions or agents.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs promotion of learnings and user-provided corrections into persistent memory and prompt files without requiring sanitization. That increases the chance that sensitive conversation content, internal project data, or user-specific details become durable context loaded into future sessions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill encourages storing detailed errors, inputs, environment data, and reviewing other session transcripts, but it does not instruct users to redact secrets, tokens, PII, or confidential prompts first. In practice, this can cause sensitive data from commands, tool output, or prior sessions to be persisted into markdown files and shared more broadly than intended.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: This markdown template instructs authors to 'Include trigger conditions' but does not require specific, bounded trigger phrases or exclusions. Because downstream skills may follow this template, it permits ambiguous activation language that could overlap with ordinary user requests.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The minimal template says only 'What this skill does and when to use it,' which does not require precise triggers, exclusions, or context boundaries. This can lead authors to produce broad descriptions that unintentionally match common speech or unclear situations.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 82% confidence
• Finding: Project-level hook configuration creates session-persistent behavior that automatically reappears whenever the project is opened, which can silently shape future agent interactions. In the context of a self-improvement skill that injects reminders and reads tool output, persistence increases the chance of unintended context manipulation or hidden behavioral drift over time.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: An empty matcher causes the activator hook to fire for every prompt, including unrelated or sensitive workflows. That broad trigger increases the blast radius of any buggy, compromised, or later-modified hook script and can cause persistent prompt/context injection across all sessions.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The user-level configuration installs the hook into ~/.claude/settings.json, enabling broad cross-project activation without clear scope limitations. This makes any issue in the hooked script affect all future sessions and repositories, turning a local convenience feature into persistent agent-wide behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The 'minimal setup' still uses an empty matcher, so it remains globally triggered for every prompt within the project despite being presented as lower overhead. Users may interpret 'minimal' as safer, when it actually preserves the same broad activation surface.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex CLI example mirrors the same empty matcher pattern, causing the hook to run on all prompts in that environment as well. Reproducing the broad trigger across multiple agent platforms increases exposure and normalizes unsafe defaults.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document states that the hook scripts 'only output text' and 'don't modify files or run commands', but the same file configures those scripts as command hooks and also documents executing another shell script directly. This mismatch can mislead users into underestimating the trust and permissions granted to the scripts, increasing the chance they deploy code with broader execution capability than advertised.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The promotion workflow instructs moving 'learnings' into persistent injected prompt files such as SOUL.md, TOOLS.md, and AGENTS.md, effectively converting runtime observations into durable behavioral and workflow rules. That creates a prompt-persistence and self-reprogramming channel where mistakes, attacker-induced content, or sensitive observations can become trusted future context across sessions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide recommends persistent logging and promotion of learnings to workspace files without any privacy, sensitivity, or retention guidance. Errors, tool outputs, user corrections, and API failures often contain secrets, personal data, or internal URLs, so storing them in durable prompt files can expose sensitive content to future sessions and other components.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This documentation extends a self-improvement/logging skill into cross-session coordination and messaging, which materially broadens the capability surface beyond its stated purpose. In a prompt-injected workspace, encouraging use of transcript access, session spawning, and message passing increases the chance that learned content is propagated across agent contexts in ways that can bypass least-privilege expectations or spread injected instructions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation advertises cross-session transcript access and messaging without warning that session history may contain sensitive user content, secrets, or privileged operational context. Normalizing transcript reads and message passing for 'learnings' creates a straightforward path for unnecessary disclosure or lateral spread of sensitive data between sessions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger conditions are broad and ambiguous, such as user corrections, command failures, API errors, and knowledge gaps, which can cause the skill to activate in many routine situations. Overbroad activation increases the chance of unnecessary persistence, logging of sensitive context, or accidental promotion of transient errors into durable instructions.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The text states that OpenClaw is the primary platform for the skill, which introduces a platform-specific preference in natural language guidance. Although the document later includes sections for other agents, this phrasing can still be read as privileging one environment without user choice or an explicit opt-in rationale.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The OpenClaw-specific triggers map broad categories like tool call error or model behavior surprise directly to persistent logging targets, but they lack constraints on what content is safe to record or when logging should be suppressed. This underspecification makes misuse and overcollection more likely, especially in a prompt-injected environment where logged content may influence later behavior.

Static analysis

No suspicious patterns detected.