Safe Self Improving

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.3.1

Overview

The skill is mostly transparent and consent-based, but it contradicts its own local-only storage guarantee by allowing generated skills to be installed into `skills/` or published externally.

Install only if you are comfortable with local learning records being used to generate future Skill drafts. Before approving any generated skill installation or ClawHub publication, review the full draft for commands, file paths, credentials, network behavior, and instructions copied from past conversations. Treat the advertised `.learnings/`-only guarantee as incomplete because the artifact also documents writes to `skills/` and external publishing.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:226

Finding

Generated Skills Can Escape the Declared Storage Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:226-238, SKILL.md:294-298, and SKILL.md:476
Vulnerability Type: Storage-boundary violation and activation of generated Agent instructions
Risk Level: Medium

Vulnerable Code Snippets

The synthesis workflow permits generated Skills to be installed or published:

markdown

6. After user confirmation, the draft can be:
   - Saved as a local Skill by writing it to the `skills/` directory
   - Published to ClawHub using `clawhub skill publish`

The documented security constraints contradict that workflow:

markdown

2. Never automatically modify system files, configuration files, or files belonging to other Skills.
6. Only write files under the `.learnings/` directory and never cross that boundary.

The example interaction also offers installation outside .learnings/:

markdown

1. Save to `.learnings/skill-drafts/`
2. Save and install to the `skills/` directory
3. Skip

These snippets are faithful English translations of the corresponding instructions at the cited locations.

Technical Analysis

The Skill presents .learnings/ as its exclusive write boundary, but its synthesis workflow explicitly permits writing generated content into skills/. It also permits publishing generated content through the ClawHub command-line tool.

Installing a generated SKILL.md is materially different from storing an inert learning record. Content placed in skills/ can become active Agent instructions and may influence later Agent behavior. Publishing also creates an external distribution path that is inconsistent with the claims that data remains local and that the Skill only writes beneath .learnings/.

Explicit user confirmation mitigates accidental activation, but it does not preserve the stated least-privilege boundary. Users may approve installation based on the Skill's repeated assurances that it cannot write outside `.learnin ...[truncated 1273 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict all generated artifacts to .learnings/skill-drafts/.
2. Remove direct installation into skills/ and direct publication from the Skill workflow.
3. If installation remains supported, update every security guarantee to identify skills/ as a separate privileged destination.
4. Require an independent confirmation specifically for crossing the .learnings/ boundary; prior confirmation to generate or save a draft must not count.
5. Display the complete generated file and an exact destination path before installation.
6. Require a security review that checks generated instructions for external communication, command execution, persistence, secret access, and unauthorized file access.
7. For publication, show exactly what data will leave the local environment and require separate confirmation after sanitization and review.
8. Prefer a manual export workflow in which the user independently copies a reviewed draft into the Skill directory.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:214

Finding

Untrusted Learning Content Can Be Converted into Active Skill Instructions Without Semantic Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:214-238
Vulnerability Type: Unsafe generation of Agent instructions from conversation-derived persistent data
Risk Level: Medium

Vulnerable Code Snippet

markdown

1. Scan all entries in `.learnings/LEARNINGS.md` and `.learnings/ERRORS.md`.
2. Analyze recurring patterns.
3. Generate a SKILL.md draft containing:
   - A name derived from the pattern
   - A description derived from the learning records
   - Trigger conditions extracted from the related `Suggested Action` fields
   - An operational procedure summarized from best practices
   - Security rules derived from prevention measures in error records
4. Save the draft under `.learnings/skill-drafts/`.
5. Show the draft to the user and wait for confirmation.
6. After user confirmation, the draft can be:
   - Saved as a local Skill by writing it to the `skills/` directory
   - Published to ClawHub using `clawhub skill publish`

This snippet is a faithful English translation of the corresponding workflow at the cited location.

Technical Analysis

Learning records originate from conversation context and must therefore be treated as untrusted data. The workflow extracts trigger conditions and operational instructions from those records and transforms them into a new SKILL.md.

The documented sanitization rules only replace categories such as credentials, personal identifiers, IP addresses, email addresses, phone numbers, and user-specific paths. They do not perform semantic validation for:

• Prompt or instruction injection
• Destructive shell commands
• Requests for elevated privileges
• External network destinations
• Persistence mechanisms
• Attempts to read unrelated files or secrets
• Instructions that weaken Agent safety controls
• Misleading trigger conditions or concealed side effects

User review is valuable but is not a sufficient security boundary when the genera ...[truncated 1951 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every learning and error record as untrusted input, regardless of whether it was previously sanitized.
2. Separate factual observations from executable instructions. Do not copy Suggested Action, prevention, or workflow text directly into a generated Skill.
3. Apply semantic validation to reject or quarantine instructions involving shell execution, privilege elevation, external communication, persistence, credential access, unrelated file access, or modification of safety constraints.
4. Generate Skills from a strict allowlisted schema with narrowly defined actions and destinations.
5. Add provenance metadata for every generated trigger, step, and rule, linking it to the exact source record.
6. Present a security diff that highlights all commands, file paths, URLs, tools, permissions, and side effects before approval.
7. Require a separate security-review stage before installation or publication; confirmation to create a draft must not authorize activation.
8. Keep drafts inert under .learnings/skill-drafts/ unless they pass validation.
9. Reject embedded meta-instructions that attempt to control the reviewing Agent, override higher-priority instructions, conceal behavior, or bypass approval.
10. Add tests using poisoned learning records to verify that unsafe directives cannot become generated Skill instructions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims it only writes inside .learnings/, but later allows saving generated output into skills/ and publishing to ClawHub. That inconsistency weakens user trust boundaries and can lead to broader filesystem modification or external distribution of content derived from local records, including potentially sensitive or prompt-injected material.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document repeats a hard safety guarantee that all data stays within .learnings/, yet other sections permit writing to skills/ and external publication. Such contradictory constraints are dangerous because downstream agents or users may rely on the stronger guarantee while the actual behavior enables persistence outside the declared boundary and outbound dissemination.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 464)May include surrounding context.

md

1. ✅ 内存限制是否设置（--memory）
2. ✅ depends_on 是否配置健康检查
3. ✅ 端口映射是否冲突
4. ✅ 环境变量是否从 .env 读取（非硬编码）

## 来源
- [LRN-003] Docker OOM 教训 × 3

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

md

| Auto-executing hooks | Often present | ❌ **None** |
| Cross-session communication | Sometimes present | ❌ **None** |
| Silent file modification | Sometimes present | ❌ **None** (`.learnings/` only) |
| Auto-execute improvements | Often automatic | ❌ **User confirms all** |
| Sensitive data masking | Rarely available | ✅ **Auto-masked** (6 types) |
| Duplicate detection | Rarely available | ✅ **Keyword matching + tracking** |
| 🆕 Smart Skill Synthesis | Not available | ✅ **Auto-generate skills from patterns** |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage section presents all invocation examples exclusively in Chinese, which implies the skill is intended to be triggered in a specific language. There is no accompanying note that other languages are supported or that Chinese is required for a justified region-specific reason.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

md

| "记下这个错误" | Log an error with root cause analysis |
| "这是个好方法" | Record a best practice |
| "回顾学习记录" | Review all learnings with stats |
| "怎么改进" | Get improvement suggestions (won't auto-execute!) |
| "打个分" | Evaluate current task performance |
| 🆕 "生成技能" | Auto-generate a new skill from recurring patterns |
| 🆕 "导出学习记录" | Export all records as JSON + Markdown |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 94)May include surrounding context.

md

| "记下这个错误" | Log an error with root cause analysis |
| "这是个好方法" | Record a best practice |
| "回顾学习记录" | Review all learnings with stats |
| "怎么改进" | Get improvement suggestions (won't auto-execute!) |
| "打个分" | Evaluate current task performance |
| 🆕 "生成技能" | Auto-generate a new skill from recurring patterns |
| 🆕 "导出学习记录" | Export all records as JSON + Markdown |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill is presented entirely in Chinese and labels itself with a Chinese-only title/tagline, but does not state that language is selectable or that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases include broad everyday expressions like '记下来', '最佳实践', and '怎么改进', which could be invoked unintentionally during normal conversation. In a skill that writes files and synthesizes new artifacts, accidental activation can cause unwanted persistence of conversation content, including material the user did not intend to store.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Adding a capability to publish generated skills to ClawHub expands the skill from local self-improvement into external data distribution. Because generated skills are synthesized from learning records and errors, publication risks leaking internal practices, environment details, or insufficiently sanitized sensitive information beyond the local system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 7)May include surrounding context.

text

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

No suspicious patterns detected.