T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:445- Finding
Untrusted Lessons Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent Local
Security checks for vulnerabilities and agentic risk
Overview
The skill is not overtly malicious, but it needs review because it encourages persistent agent memory, broad hooks, and cross-session sharing without enough redaction or approval controls.
Before installing, decide whether you want an agent to create persistent learning files and propose edits to files that shape future agent behavior. Keep logs local unless deliberately sharing them, redact secrets and personal or customer data, avoid global hooks unless necessary, use narrow hook matchers, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about recording and reviewing learnings from failures, corrections, and discoveries. The supplied code does not capture, store, analyze, or review learnings. Instead, it is a helper utility that scaffolds a new skill from a learning entry by creating directories and a templated SKILL.md file on disk. This is a materially different primary purpose and includes filesystem write capabilities not reflected in the declaration. While the comments mention 'from a learning entry,' the implemented behavior is skill extraction/scaffolding, not continuous-improvement logging itself.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The templates explicitly ask for full context, inputs, parameters, user context, and error/output details in persistent logs. Those fields commonly contain API keys, bearer tokens, file paths, customer data, prompts, stack traces, or internal configuration, so the skill materially increases the risk of durable sensitive-data leakage.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Directing users to modify ~/.claude/settings.json and place executable hook scripts under ~/.claude/skills creates persistent access to the agent's configuration directory. Because this location affects future sessions globally, any malicious or tampered script there gains durable influence over agent behavior across projects.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The skill explicitly establishes persistent local storage for accumulated learnings under a workspace path, which creates retention of potentially sensitive operational and conversational data across sessions. Persistence is part of the feature, but without retention, access, and sanitization controls it increases exposure if the workspace is shared, backed up, or later inspected by other tools.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The inter-session communication section normalizes reading other session transcripts and sending learnings across sessions, which can propagate confidential chat content beyond its original scope. Without access controls, consent rules, or redaction requirements, this creates a clear path for unintended disclosure between sessions or agents.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs promotion of learnings and user-provided corrections into persistent memory and prompt files without requiring sanitization. That increases the chance that sensitive conversation content, internal project data, or user-specific details become durable context loaded into future sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill encourages storing detailed errors, inputs, environment data, and reviewing other session transcripts, but it does not instruct users to redact secrets, tokens, PII, or confidential prompts first. In practice, this can cause sensitive data from commands, tool output, or prior sessions to be persisted into markdown files and shared more broadly than intended.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown template instructs authors to 'Include trigger conditions' but does not require specific, bounded trigger phrases or exclusions. Because downstream skills may follow this template, it permits ambiguous activation language that could overlap with ordinary user requests.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The minimal template says only 'What this skill does and when to use it,' which does not require precise triggers, exclusions, or context boundaries. This can lead authors to produce broad descriptions that unintentionally match common speech or unclear situations.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
Project-level hook configuration creates session-persistent behavior that automatically reappears whenever the project is opened, which can silently shape future agent interactions. In the context of a self-improvement skill that injects reminders and reads tool output, persistence increases the chance of unintended context manipulation or hidden behavioral drift over time.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
An empty matcher causes the activator hook to fire for every prompt, including unrelated or sensitive workflows. That broad trigger increases the blast radius of any buggy, compromised, or later-modified hook script and can cause persistent prompt/context injection across all sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The user-level configuration installs the hook into ~/.claude/settings.json, enabling broad cross-project activation without clear scope limitations. This makes any issue in the hooked script affect all future sessions and repositories, turning a local convenience feature into persistent agent-wide behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'minimal setup' still uses an empty matcher, so it remains globally triggered for every prompt within the project despite being presented as lower overhead. Users may interpret 'minimal' as safer, when it actually preserves the same broad activation surface.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Codex CLI example mirrors the same empty matcher pattern, causing the hook to run on all prompts in that environment as well. Reproducing the broad trigger across multiple agent platforms increases exposure and normalizes unsafe defaults.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document states that the hook scripts 'only output text' and 'don't modify files or run commands', but the same file configures those scripts as command hooks and also documents executing another shell script directly. This mismatch can mislead users into underestimating the trust and permissions granted to the scripts, increasing the chance they deploy code with broader execution capability than advertised.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The promotion workflow instructs moving 'learnings' into persistent injected prompt files such as SOUL.md, TOOLS.md, and AGENTS.md, effectively converting runtime observations into durable behavioral and workflow rules. That creates a prompt-persistence and self-reprogramming channel where mistakes, attacker-induced content, or sensitive observations can become trusted future context across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide recommends persistent logging and promotion of learnings to workspace files without any privacy, sensitivity, or retention guidance. Errors, tool outputs, user corrections, and API failures often contain secrets, personal data, or internal URLs, so storing them in durable prompt files can expose sensitive content to future sessions and other components.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This documentation extends a self-improvement/logging skill into cross-session coordination and messaging, which materially broadens the capability surface beyond its stated purpose. In a prompt-injected workspace, encouraging use of transcript access, session spawning, and message passing increases the chance that learned content is propagated across agent contexts in ways that can bypass least-privilege expectations or spread injected instructions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation advertises cross-session transcript access and messaging without warning that session history may contain sensitive user content, secrets, or privileged operational context. Normalizing transcript reads and message passing for 'learnings' creates a straightforward path for unnecessary disclosure or lateral spread of sensitive data between sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger conditions are broad and ambiguous, such as user corrections, command failures, API errors, and knowledge gaps, which can cause the skill to activate in many routine situations. Overbroad activation increases the chance of unnecessary persistence, logging of sensitive context, or accidental promotion of transient errors into durable instructions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The text states that OpenClaw is the primary platform for the skill, which introduces a platform-specific preference in natural language guidance. Although the document later includes sections for other agents, this phrasing can still be read as privileging one environment without user choice or an explicit opt-in rationale.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The OpenClaw-specific triggers map broad categories like tool call error or model behavior surprise directly to persistent logging targets, but they lack constraints on what content is safe to record or when logging should be suppressed. This underspecification makes misuse and overcollection more likely, especially in a prompt-injected environment where logged content may influence later behavior.
- Content
Static analysis
No suspicious patterns detected.