self-improving-conversation

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 1.1.1

Overview

The skill is a disclosed local logging and reminder tool for conversation-quality learnings, with privacy and persistence caveats users should manage.

Install only if you want persistent local conversation-quality logs. Keep .learnings ignored by git, redact aggressively, never store credentials or private data even on request, and enable hooks only in projects where automatic reminders are appropriate. Prefer ClawdHub or a pinned reviewed commit over cloning a mutable branch manually.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:22

Finding

Persistent Logging Policy Permits Plaintext Storage of Secrets and Private Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-24; related conversation-excerpt guidance at SKILL.md:172-184
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

markdown

Never overwrite existing files. This is a no-op if `.learnings/` is already initialised.

Do not log personally identifiable information, auth tokens, or private user data unless the user explicitly asks for that level of detail. Prefer short summaries or redacted excerpts over raw conversation transcripts.

The dialogue issue template also encourages persistent storage of conversation content:

markdown

### Conversation Excerpt

User: [what the user said] Agent: [what the agent responded] User: [user reaction indicating failure]

text

Technical Analysis

The policy contains an exception allowing authentication tokens, personally identifiable information, and private user data to be written to persistent Markdown files when a user explicitly requests detailed logging. User consent does not make plaintext credential storage secure. Authentication tokens, private keys, session cookies, and similar secrets should never be copied into learning logs.

The skill stores entries under .learnings/, where they may persist across sessions. Although the documentation recommends redacted summaries and states that the directory is ignored by default, these are advisory controls rather than enforced redaction. The project also documents an option to track these files in version control after review. Consequently, an agent following the stated exception could persist sensitive material that later enters source control, backups, indexing systems, or other processing pipelines.

Attack Path

1. A conversation includes a credential, authentication token, personal record, or other confidential value.
2. A user or untrusted prompt explicitly requests that the complete exchange b ...[truncated 1235 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the user-request exception and establish an absolute prohibition on logging credentials, authentication tokens, private keys, session cookies, recovery codes, and comparable secrets.

2. Replace the affected policy with language such as:

   markdown

   Never log credentials, authentication tokens, private keys, session cookies, or recovery codes, even when explicitly requested. Redact or omit PII and private user data unless a documented, approved retention policy requires it.
   

3. Require redacted summaries rather than raw conversation excerpts. Replace sensitive values with stable placeholders such as [TOKEN_REDACTED], [EMAIL_REDACTED], or [ACCOUNT_ID_HASH].

4. Add automated secret and PII detection before every log write, using allowlisted fields and denylisted secret formats.

5. Keep .learnings/ excluded from version control by default and add a pre-commit secret scanner as a defense-in-depth control.

6. Apply restrictive filesystem permissions to local learning logs and define a retention and deletion policy.

7. Require explicit human review before learning logs are shared, committed, promoted into prompt files, or supplied to another agent.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Repository Installation into an Automatically Loaded Skill Directory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:46-57
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

markdown

## OpenClaw Setup (Recommended)

OpenClaw is the primary platform for this skill. It uses workspace-based prompt injection with automatic skill loading.

### Installation

**Via ClawdHub (recommended):**
```bash
clawdhub install self-improving-conversation

Manual:

bash

git clone https://github.com/jose-compu/self-improving-conversation.git ~/.openclaw/skills/self-improving-conversation

text

### Technical Analysis

The manual installation command clones the current default branch of a personal GitHub repository without pinning a reviewed commit, verifying a signed release, or checking a cryptographic digest. The destination is an OpenClaw skill directory whose contents are automatically loaded into agent sessions.

This creates a supply-chain trust gap: the repository contents retrieved during installation can differ from the files that were audited. If the upstream repository, maintainer account, branch, or distribution path is compromised, modified skill instructions can be loaded into the agent. Modified hook scripts could also run with the agent's permissions if a user subsequently follows the documented optional hook-enablement procedure.

The observed project does not itself fetch and execute a runtime payload, and the included hook scripts were not found to contain malicious behavior. The risk arises from installing mutable, unauthenticated upstream content into an automatically trusted location.

### Attack Path

1. An attacker compromises the upstream repository, maintainer credentials, or mutable default branch.
2. The attacker changes `SKILL.md`, hook handlers, or shell scripts in the upstream repository.
3. A user follows the documented `git clone` command without selecting a reviewed commit or validating a signature or
...[truncated 1203 chars]

Remediation

View remediation

Remediation Suggestions

1. Install from a reviewed, immutable commit rather than the repository's default branch:

   bash

   git clone https://github.com/jose-compu/self-improving-conversation.git /tmp/self-improving-conversation
   cd /tmp/self-improving-conversation
   git checkout --detach APPROVED_COMMIT_HASH
   

2. Publish signed, versioned releases and verify the release signature before copying files into the OpenClaw skill directory.

3. Publish SHA-256 digests for release artifacts and require checksum verification during installation.

4. Stage downloaded content outside automatically loaded skill and hook directories. Review the exact diff before installation.

5. Separate skill installation from hook activation and require an additional explicit review before executable hook files are enabled.

6. Pin the ClawdHub installation to a specific reviewed version if the package manager supports version constraints and integrity metadata.

7. Document an update process that presents upstream changes for human review instead of automatically replacing trusted content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims extracted skills or promotions require explicit human diff review, yet the described extraction helper creates directories and SKILL.md scaffolds directly under ./skills. This is dangerous because it turns a logging utility into a code/content generation mechanism that can seed new trusted artifacts without any technical approval gate, enabling persistence or policy drift.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill claims extracted skills or promotions require explicit human diff review, yet the described extraction helper creates directories and SKILL.md scaffolds directly under ./skills. This is dangerous because it turns a logging utility into a code/content generation mechanism that can seed new trusted artifacts without any technical approval gate, enabling persistence or policy drift.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims extracted skills or promotions require explicit human diff review, yet the described extraction helper creates directories and SKILL.md scaffolds directly under ./skills. This is dangerous because it turns a logging utility into a code/content generation mechanism that can seed new trusted artifacts without any technical approval gate, enabling persistence or policy drift.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 506)May include surrounding context.

md

Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · assets/ERRORS.md (reported line 1)May include surrounding context.

md

# Dialogue Issues Log

Conversation failures, misunderstandings, tone mismatches, and escalation problems.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill describes installation and use of external resources such as clawdhub install, git clone, and hook scripts, but it declares no explicit tool scope or permission boundary. In an agent environment, missing tool constraints can allow a seemingly documentation-only skill to induce networked actions without clear review, increasing the chance of unintended code fetches or remote content execution paths.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill encourages creating persistent files under ~/.openclaw/workspace/.learnings, which stores dialogue-derived data across sessions in a user-scoped location. Persistent session memory is risky here because the stored content may include sensitive conversational details, and the home-directory scope increases the chance of reuse, over-retention, or unintended access by other sessions and tools.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs storing conversation excerpts, full context, emotional state, and related metadata in local files, but it does not provide a strong user-facing consent and retention model for logging user conversation data. Even with redaction guidance, this can lead to inadvertent storage of sensitive personal, business, or credential-bearing content in workspace files that may later be committed, shared, or processed by other tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document states hooks should remain project-scoped, but the setup copies them into a user home directory under ~/.openclaw/hooks/, creating cross-project persistence. Persistent user-level hooks are risky because they can affect unrelated future sessions and silently expand the blast radius of any bad logic or compromised script.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 642)May include surrounding context.

md

### Ownership Rules
- This skill writes only to `.learnings/conversation/` in stackable mode.
- It may read other skill folders for cross-linking, but should not rewrite their entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The injected reminder explicitly instructs agents to persist dialogue excerpts, user frustration, escalation requests, and hallucination-related summaries into workspace files. Even though the skill description mentions redacted summaries, the hook text itself encourages durable retention of sensitive conversational metadata and excerpts, which can lead to privacy leakage, over-collection, or accidental inclusion of confidential user content in repos, diffs, or downstream tooling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown example states that the agent currently responds in English regardless of the user's input language. Forcing a specific language without user opt-in matches the language/locale policy violation criteria, and the text does not present that behavior as justified or optional.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The matcher uses broad substrings like 'conversation', 'tone', and 'intent', which can trigger on many normal prompts and silently inject hook output into unrelated sessions. Because hook scripts run automatically with agent permissions, overbroad activation increases the chance of unnecessary context injection, accidental exposure of sensitive prompt context to local scripts, and user confusion about when monitoring/logging behavior is occurring.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation states that 'Scripts only output text; they don't modify files or run commands,' which describes all hook-related scripts broadly. Earlier in the same file, however, the guide instructs users to invoke extract-skill.sh, a script whose stated purpose is to perform skill extraction and therefore goes beyond mere text output; even in dry-run form, that contradicts the blanket claim about script behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 50)May include surrounding context.

openclaw hooks enable self-improving-conversation

text

### 3. Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description says optional hooks use a narrow matcher, and L625-L629 later repeats that only conversation signals should trigger the skill automatically. But the example matcher at L479 matches broad terms like dialogue, conversation, and chatbot, which can fire for many benign prompts unrelated to failures or learnings.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.