Security audit

Jose Self Improving Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned, but it needs review because it encourages persistent logging of conversation-derived content and promotion into files that affect future agent behavior.

Before installing, decide whether you want an agent to retain learning logs and update future prompt/context files. Keep hooks project-scoped, avoid global activation unless necessary, require confirmation before writes, review diffs to CLAUDE.md/AGENTS.md/SOUL.md/TOOLS.md/copilot instructions, and redact secrets, personal data, raw transcripts, and credentials from learning entries.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:262
Finding: Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:262-289, SKILL.md:326-360, and SKILL.md:440-449
Vulnerability Type: Persistent agent memory poisoning
Risk Level: High

Vulnerable Code

markdown
## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`

markdown
### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write ...[truncated 2614 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit human approval before writing any learning into persistent agent-context files.

Remove the “promote aggressively” instruction and make promotion deny-by-default.

Store observations as quoted, non-executable data rather than agent directives.

Preserve provenance for every entry, including the originating user, session, task, date, and supporting evidence.

Reject or quarantine entries containing imperative instructions, role changes, requests to bypass safeguards, tool-use directives, credential handling rules, or external download commands.

Use an allowlisted schema for promotable facts, such as package manager, test command, or documented repository convention.

Require independent validation against trusted project files before promotion.

Present a reviewable diff and require confirmation before modifying CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, SOUL.md, or TOOLS.md.

Record promotions in an audit log and provide a rollback mechanism.

T01 · Skill Instruction Hijacking

Warning

Location: hooks/openclaw/handler.js:8
Finding: Opt-In Hooks Inject Secondary Behavioral Instructions into Agent Context
Content: View full analysis
Vulnerability Details

File Location: scripts/activator.sh:8-19, hooks/openclaw/handler.js:8-22, 43-49, and hooks/openclaw/handler.ts:10-25, 52-58
Vulnerability Type: Agent-session instruction hijacking
Risk Level: Medium

Vulnerable Code

bash
# Output reminder as system context cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. </self-improvement-reminder> EOF

javascript
const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); }

The TypeScript implementation contains an additional scope guard that is absent from the shipped JavaScript implementation:

typescript
// Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like ...[truncated 2303 chars]
Remediation: View remediation
Remediation Suggestions

Replace behavioral instruction injection with a passive notification that does not direct file writes or promotion.

Require explicit per-event user confirmation before recording a learning or modifying any file.

Scope hook activation to dedicated self-improvement tasks rather than every prompt or bootstrap.

Add restrictive event matchers and disable the hook for untrusted repositories and conversations.

Add the sub-agent exclusion from handler.ts to handler.js, and generate the JavaScript artifact from TypeScript to prevent implementation drift.

Keep hook output clearly separated as untrusted advisory content rather than system-equivalent instructions.

Remove promotion directives from hook content; promotion should occur only through a separately authorized review workflow.

Add tests confirming that the hook does not run for sub-agents, does not write files, and cannot trigger persistent-context updates without confirmation.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is about maintaining a learning/improvement log: recording failures, corrections, outdated knowledge, and reviewing learnings before major tasks. The supplied code does something materially different: it is a helper script to create a new skill folder and templated SKILL.md file from a skill name. While the script references 'learning entry' in comments and template text, it does not actually capture learnings, inspect failures, review prior learnings, or update a learning store. Its primary purpose is skill scaffolding, which is an undeclared capability and a materially different behavior from the declared continuous-improvement logging function.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Cross-session transcript reading and sending learnings to other sessions expands the audience and lifetime of conversation-derived data. Without strict access controls, minimization, or redaction requirements, this can propagate secrets, proprietary code details, or sensitive user context across agents and sessions.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The templates explicitly ask for full context, inputs, error output, and user context, which are common places for secrets, credentials, internal paths, tokens, and personal information to appear. Persisting these verbatim in markdown files creates a durable local record that may later be committed, indexed, or injected into future prompts.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Instructing users to modify ~/.claude/settings.json directs them to a persistent agent configuration directory that can affect all future agent behavior. Because this file configures automatic command hooks, changes here can create durable execution paths and trust expansion beyond a single repository, which is security-sensitive even if the documented intent is convenience.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill encourages persistent logging of learnings and errors and later promotion into broader memory files, but it does not define safeguards for secret handling, personal data minimization, or retention limits. That creates a realistic path for sensitive user or environment data to be copied into long-lived files and resurfaced in future sessions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 83% confidence
Finding: Creating persistent files under a workspace or home directory is not inherently dangerous, but it does introduce session persistence for conversation-derived data. In this skill's context, persistence becomes security-relevant because other sections encourage storing detailed logs and reusing them later, increasing retention risk.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction to promote learnings aggressively into persistent agent context files increases the blast radius of any sensitive information mistakenly captured earlier. Once moved into always-loaded context files, the information is more likely to be exposed in unrelated future tasks and to additional tools or agents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Automatically treating generic correction phrases as a signal to persist a learning can capture user-provided text, corrections, or surrounding context without adequate review. Because the skill encourages durable storage and later promotion, this broad trigger can unintentionally turn ordinary conversation into retained memory.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The feature-request triggers are so broad that routine user conversation can cause automatic logging of content the user did not intend to persist. In the context of a persistence-oriented skill, over-activation increases the chance of unnecessary retention of user prompts and project details, which is a privacy and data-minimization issue.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file documents a UserPromptSubmit hook with "matcher": "", which is an extremely broad activation condition equivalent to matching any prompt. Because the guide presents this as the default setup and does not provide exclusions or negative examples, it risks unintended invocation on ordinary conversation rather than a narrowly defined context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guidance to place the hook in ~/.claude/settings.json enables the skill across all sessions, which increases the blast radius of any later script change, path hijack, or misconfiguration. In a skill that executes shell commands on agent events, global activation makes unintended invocation more dangerous because it applies outside the project context where the user may expect it.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Creating persistent .learnings/ storage in the workspace or skill directory establishes a retention mechanism for model-generated content that may include sensitive information, erroneous instructions, or attacker-controlled prompt material. In this skill's context, persistence is especially risky because stored learnings may later influence behavior across sessions and become difficult for users to notice or review.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.
openclaw hooks enable self-improvement

text
### 3. Create Learning Files Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document instructs the agent to log learnings into local workspace files and shared prompt files without an explicit warning or consent boundary for modifying user data. Because these files are reinjected into future sessions, silent writes can persist mistakes, leak sensitive information, or create self-reinforcing prompt manipulation across sessions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The detection triggers are broad enough to fire on many normal interactions, which can cause the skill to log or promote content without sufficiently clear boundaries. In a system that writes to persistent workspace files and influences future prompts, over-triggering can amplify prompt-injection effects, store incorrect or sensitive data, and create unintended autonomous behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a skill focused on recording and reviewing learnings for continuous improvement. This script instead performs filesystem scaffolding to generate an entirely new skill directory and SKILL.md template, which is a promotion/authoring workflow rather than capturing a learning entry itself.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Creating directories and authoring a new SKILL.md file is a content-generation and repository-modification capability. That goes beyond the manifest's stated role of storing learnings and reviewing them before tasks, and instead enables expanding the skill set itself.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Tp4

Ssd 3

Ssd 3

Agent Config Directory Access

Option 2: User-Level Configuration

Exfiltration Commands

sessions_send

Ssd 3

Session Persistence

Ssd 3

Vague Triggers

Vague Triggers

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Session Persistence

Missing User Warnings

Vague Triggers

Description-Behavior Mismatch

Context-Inappropriate Capability

Static analysis