self-improving-engineering

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:49 AM UTC
• Version: 1.2.2

Overview

This skill is a disclosed engineering-learning logger with optional reminder hooks, but users should enable persistence and hooks deliberately.

Install only if you want persistent engineering-learning logs. Keep `.learnings/` project-local unless you intentionally want OpenClaw-wide memory, review entries for secrets before committing or promoting them, and enable hooks only after narrowing matchers and reviewing the hook scripts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents this as a skill used to capture engineering learnings and operational/code-quality issues when specific events occur (build failures, architecture violations, dependency CVEs, performance regressions, etc.). However, the supplied code does not inspect builds, deployments, tests, dependencies, performance, architecture, or tech debt. Instead, it is a helper script for creating a new skill scaffold under a skills directory, generating a templated SKILL.md file, and validating paths and names. This is a materially different primary purpose and includes filesystem-writing behavior not reflected in the declaration.

Ae1

High

• Category: analysis-evasion

Content

Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 84% confidence
• Finding: Creating learning files under `~/.openclaw/workspace/.learnings` introduces persistent state in a user-home workspace that may survive across sessions and tasks. Even though intended for convenience, session-persistent logs can accumulate sensitive operational details, and the skill context makes this more dangerous because it explicitly captures build failures, dependency issues, and engineering incidents that often contain internal paths, configs, and error data.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Broad automatic triggers such as matching common terms like `build`, `test`, `fix`, `debug`, or `error` can activate the skill in many unrelated contexts. Unintended activation increases the chance of unnecessary file writes, noisy persistence, and accidental logging of sensitive debugging output despite the document's warning not to record secrets.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document warns against user-level or global hooks, but the provided commands copy hooks into `~/.openclaw/hooks/...`, which is a user-home persistent location. That contradiction can cause hooks to affect future sessions beyond a single project boundary, creating unintended persistence and expanding the trust boundary if the hook scripts are later modified or triggered in other contexts.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

### Ownership Rules
- This skill writes only to `.learnings/engineering/` in stackable mode.
- It may read other skill folders for cross-linking, but should not rewrite their entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: L648 says 'Standalone mode writes to this project's `.learnings/*.md` log files only.' However, the document elsewhere instructs adding references to `AGENTS.md`, `CLAUDE.md`, or `.github/copilot-instructions.md` (L128-L137) and creating `.claude/settings.json` for hooks (L528-L542), which are writes outside `.learnings/*.md`. That is an active contradiction in the skill's own documentation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The suggested matcher terms are broad and likely to trigger on ordinary prompts such as 'fix', 'debug', or 'error', causing frequent automatic execution of local hook scripts. In this skill context, that increases the attack surface and normalizes background command execution on many sessions, which is risky because hooks run with the same permissions as the coding agent.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Although the guide warns against empty matchers, it continues to recommend example patterns that remain broad and ambiguous, which can still trigger unnecessarily across normal development conversations. This is less severe than direct command injection, but in a hook-based system it still promotes overbroad automatic execution and unnecessary exposure of prompt/tool context to scripts.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document states that the scripts 'don't modify files or run commands,' yet the hook configuration explicitly invokes shell scripts via a command hook. That mismatch can cause users to underestimate execution risk and install the hooks inappropriately, especially because hook scripts run with the agent's permissions and may access sensitive context or perform arbitrary actions if changed later.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improving-engineering
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.