ClawHub
Back to skill

Security audit

self-improving-legal

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed legal note-taking and reminder skill that stores redacted legal learnings locally, with optional project-scoped hooks.

Install only if you want persistent local records of legal operations lessons. Keep `.learnings/` out of version control unless entries are reviewed, never record privileged communications or confidential matter details, enable hooks only in project scope after reviewing the scripts, and require a reviewed diff before any promotion into AGENTS.md, SOUL.md, TOOLS.md, MEMORY.md, rules, hooks, or generated skills.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a substantive legal-operations skill for detecting or recording legal risks and compliance/regulatory issues when specific legal events occur. The code instead is an extraction/scaffolding utility: it parses command-line options, validates a skill name and output directory, performs safe-path checks, and optionally creates a new skill folder with a templated SKILL.md file. Its primary purpose is developer tooling for creating skill documentation, not legal risk capture or continuous legal operations improvement. This is a material purpose mismatch, even though the template text references legal findings.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 520)May include surrounding context.

md
Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs creation and appending of persistent local files containing legal/compliance learnings, which may still include sensitive matter context even when abstracted. Without an immediate, prominent disclosure at the action point, users may not realize the skill is writing durable records to disk, creating confidentiality, privacy, and retention risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill expands from logging legal learnings into advising promotion to AGENTS.md, TOOLS.md, and SOUL.md, which are higher-impact instruction and governance files. Even though later sections require explicit user approval for promotion, this broadens the blast radius from simple note-taking to persistent workspace-behavior modification, increasing prompt-injection and policy-drift risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The OpenClaw setup directs creation of persistent files under a home-directory workspace path, which enables cross-session retention of sensitive legal/compliance summaries. Persistent storage in a shared or long-lived workspace increases the chance of unintended disclosure, over-retention, or reuse without fresh consent.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This section formalizes modification of permanent standards such as clause libraries, playbooks, risk registers, and agent instruction files. Persistent updates to these artifacts can propagate mistakes or adversarial content across future sessions, so the danger is not immediate code execution but durable cross-session influence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Automatic skill extraction turns logged material into a reusable capability, which can amplify any bad guidance, hidden prompt injection, or overshared sensitive content into a persistent artifact. The file does warn that extracted skills are untrusted until reviewed, but the extraction workflow still expands the trust boundary beyond the skill's core purpose.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 641)May include surrounding context.

md
### Ownership Rules
- This skill writes only to `.learnings/legal/` in stackable mode.
- Do not read other skill folders, their SKILL.md files, or their log entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md
**Log when:**
- Clause risk identified (unfavorable terms, missing protections) → \`.learnings/LEARNINGS.md\` (clause_risk)
- Compliance gap discovered (regulatory requirement not met) → \`.learnings/LEARNINGS.md\` (compliance_gap)
- Contract deviation found (non-standard terms without approval) → \`.learnings/LEGAL_ISSUES.md\` (contract_deviation)
- Regulatory change impacts organization → \`.learnings/LEARNINGS.md\` (regulatory_change)
- Precedent shift in relevant jurisdiction → \`.learnings/LEARNINGS.md\` (precedent_shift)
- Litigation exposure identified → \`.learnings/LEGAL_ISSUES.md\` (litigation_exposure)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · hooks/openclaw/handler.js (reported line 18)May include surrounding context.

js
**Log when:**
- Clause risk identified (unfavorable terms, missing protections) → \`.learnings/LEARNINGS.md\` (clause_risk)
- Compliance gap discovered (regulatory requirement not met) → \`.learnings/LEARNINGS.md\` (compliance_gap)
- Contract deviation found (non-standard terms without approval) → \`.learnings/LEGAL_ISSUES.md\` (contract_deviation)
- Regulatory change impacts organization → \`.learnings/LEARNINGS.md\` (regulatory_change)
- Precedent shift in relevant jurisdiction → \`.learnings/LEARNINGS.md\` (precedent_shift)
- Litigation exposure identified → \`.learnings/LEGAL_ISSUES.md\` (litigation_exposure)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · hooks/openclaw/handler.ts (reported line 19)May include surrounding context.

ts
**Log when:**
- Clause risk identified (unfavorable terms, missing protections) → \`.learnings/LEARNINGS.md\` (clause_risk)
- Compliance gap discovered (regulatory requirement not met) → \`.learnings/LEARNINGS.md\` (compliance_gap)
- Contract deviation found (non-standard terms without approval) → \`.learnings/LEGAL_ISSUES.md\` (contract_deviation)
- Regulatory change impacts organization → \`.learnings/LEARNINGS.md\` (regulatory_change)
- Precedent shift in relevant jurisdiction → \`.learnings/LEARNINGS.md\` (precedent_shift)
- Litigation exposure identified → \`.learnings/LEGAL_ISSUES.md\` (litigation_exposure)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 350)May include surrounding context.

md
### Metadata
- Source: contract_review
- Jurisdiction: US-Federal
- Related Files: skills/contract-review-checklist/SKILL.md
- Tags: contract-review, checklist, vendor, renewal, clause-risk
- See Also: LEG-20260412-001, LRN-20260412-001, LRN-20260215-003

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide states that hook scripts 'only output text' and 'do not modify files or run commands', but the documented configuration uses command hooks that execute shell scripts. This contradiction can mislead users into underestimating the trust boundary and runtime capabilities of the hooked scripts, increasing the chance they enable code execution in sensitive environments without appropriate review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 54)May include surrounding context.

Copy the hook to OpenClaw's hooks directory:

bash
mkdir -p .openclaw/hooks
cp -r hooks/openclaw .openclaw/hooks/self-improving-legal

Static analysis

No suspicious patterns detected.