Security audit
Security checks for vulnerabilities and agentic risk
This skill is an analytics learning logger with disclosed, mostly project-scoped writes and opt-in hooks; it has some documentation ambiguity around persistence but no hidden exfiltration or destructive behavior.
Install only if you want persistent analytics learning logs. Prefer project-local .learnings and project-local hooks, review any hook configuration before enabling it, keep PostToolUse disabled unless you specifically need output-based reminders, and do not promote entries into AGENTS.md, MEMORY.md, hooks, or new skills without reviewing the diff.
The skill claims to capture analytics issues, but it also scaffolds files, provides extraction workflows, and supports generating new skill artifacts. That mismatch can cause users or automated systems to grant broader filesystem trust than intended, increasing the chance of unauthorized or surprising writes.
The skill claims to capture analytics issues, but it also scaffolds files, provides extraction workflows, and supports generating new skill artifacts. That mismatch can cause users or automated systems to grant broader filesystem trust than intended, increasing the chance of unauthorized or surprising writes.
Referenced artifact was not completely inspected
Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.
Without declared permissions the skill's intent is opaque and cannot be validated.
The skill directs creation of persistent files under ~/.openclaw/workspace, causing data and behavioral state to survive across sessions. Persistent workspace modification increases the blast radius of mistakes, sensitive data retention, and future-session influence, especially because the skill centers on logging operational incidents.
└── FEATURE_REQUESTS.md
### Create Learning Files
```bash
mkdir -p ~/.openclaw/workspace/.learnings
The skill instructs ingesting recurring patterns from another skill while later stating it must not read other skill folders or log entries. Cross-skill ingestion can violate isolation expectations and become a path for prompt-content contamination or unauthorized data sharing between skills.
Lines L523-L530 explicitly say to leave PostToolUse disabled and not attach error-detector.sh broadly, yet the same file's Multi-Agent Support table states detection is automatic via error-detector.sh for Claude Code and Codex. This is an active contradiction in the skill's own operational guidance, not merely an omission.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
### Ownership Rules
- This skill writes only to `.learnings/analytics/` in stackable mode.
- Do not read other skill folders, their SKILL.md files, or their log entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.
The documentation states that the scripts 'only output text' and 'do not run commands,' but the hook configuration explicitly invokes shell commands via the agent hook system. This misleading security guidance can cause users to underestimate the execution risk of enabling the hooks, especially since hook scripts run with the same permissions as the agent and therefore can perform arbitrary actions if modified or replaced.
The integration guide instructs users to install a persistent hook under .openclaw/hooks, which causes skill behavior to survive across sessions and potentially trigger automatically on lifecycle events. Even though persistence is expected for hook-based integrations, this increases attack surface because a compromised or overly broad hook can continue influencing future sessions without explicit per-session consent.
mkdir -p .openclaw/hooks
cp -r hooks/openclaw .openclaw/hooks/self-improving-analytics
Line L098 says the skill logs notes 'in this workspace only,' implying confinement to the active workspace. However, the document's setup and storage paths repeatedly target global locations such as ~/.openclaw/skills/, ~/.openclaw/hooks/, and ~/.openclaw/workspace/, which are not limited to a single current workspace and can persist across sessions.
The manifest describes a skill focused on capturing analytics problems such as data quality issues, metric drift, pipeline failures, and related diagnostics. This script instead scaffolds new skill directories and writes SKILL.md files, which is repository content generation rather than analytics monitoring, diagnosis, or remediation support.
The header comments say this helper 'Creates a new skill from an analytics learning entry,' implying some extraction or conversion from existing learning data. In practice, the code only takes a skill name and emits a boilerplate SKILL.md template with TODO placeholders, without reading .learnings/LEARNINGS.md or any source entry.
The comments and usage framing indicate an extraction workflow from an existing analytics learning entry. However, the implementation never parses or imports any learning content; it simply creates a templated SKILL.md with TODO fields, which contradicts the documented intent.
No suspicious patterns detected.