self-improving-conversation

• Outcome: Pass
• Latest audit: Aug 28, 2026 · 7:08 PM UTC
• Version: 1.1.1

Overview

This skill is a local conversation-learning logger with optional reminder hooks, but its learning files should be treated as sensitive because they may contain conversation excerpts.

Before installing, decide whether you are comfortable with local retention of conversation-derived notes. Keep hooks opt-in, prefer project-scoped setup, add .learnings/ to gitignore unless entries are reviewed, and redact names, account data, secrets, regulated content, and raw transcripts before anything is stored or promoted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill markets itself as narrow, review-gated, and reminder-oriented, but the documented behavior expands into tool-output scanning, multiple automatic hook points, and direct skill extraction helpers. That mismatch is dangerous because operators may grant trust or enable automation under the assumption of limited scope, while the actual workflow increases persistence, observation surface, and content-generation capability.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The skill first advises redaction and avoidance of sensitive data, then later recommends including actual conversation excerpts. That conflict can lead agents or users to store raw dialogue containing personal data, secrets, or regulated content in local files, especially during failure analysis when sensitive context is often present.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The document says hooks must be project-scoped, yet the example copies them into ~/.openclaw/hooks, a user-level persistent location. This creates a scope/persistence contradiction that can cause the skill's behavior to affect unrelated projects and future sessions, increasing the risk of unintended data capture or prompt injection across workspaces.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document materially misrepresents the behavior of the configured hooks. The setup clearly installs shell scripts as `command` hooks, so stating they only output text and do not run commands can mislead users into granting trust or permissions they would otherwise withhold, increasing the chance of unsafe deployment and underestimating execution risk.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Automatic logging based on ambiguous self-assessed conversational states like tone mismatch, frustration, or context loss can trigger excessive or unnecessary recording of user interactions. In practice, this broad trigger surface raises privacy and data-minimization concerns because sensitive conversations may be logged without a clear, deterministic threshold or explicit consent checkpoint.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs agents to append conversation excerpts and detailed interaction context to files, but it does not require a clear user-facing warning or consent step before storing that content. This is dangerous because users may reveal personal, confidential, or credential-like information during support chats, and those details can be silently retained on disk for later access or accidental commit.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The hook injects bootstrap instructions directing the agent to write dialogue excerpts, failures, and summaries into workspace files under .learnings without any explicit consent, disclosure, or enforcement of minimization at the point of collection. Even though the description mentions redacted summaries and later human review for promotion, this specific code only injects logging guidance and can lead to storage of sensitive conversational data in project files, creating privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly describes capturing dialogue learnings, injecting workspace context, and using long-term memory and daily memory files, but it does not warn about privacy, consent, retention, or access-control implications. In a conversation-improvement skill, this increases the risk that sensitive user content, account details, or frustration/escalation transcripts are stored persistently without clear boundaries or user awareness.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The setup instructions direct creation of a persistent `.learnings` directory for storing conversation-derived data, but provide no warning that these files may contain sensitive or regulated information. Because this skill is specifically designed to log misunderstandings, escalations, hallucinations, and tone issues from real conversations, the operational context makes the privacy risk more concrete rather than hypothetical.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.