ClawHub
Back to skill

Security audit

self-improving-negotiation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local negotiation-logging and reminder tool, with sensitive behaviors gated and mostly project-scoped.

Install only in workspaces where local negotiation notes are appropriate. Keep .learnings private or access-controlled, review entries before committing or sharing them, use project-scoped hooks only, and review any generated SKILL.md before enabling or publishing it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code matches the narrow claim about extract-skill.sh being dry-run by default and writing SKILL.md only with --write. It also aligns with the safety claim that it does not accept terms, set pricing, or approve deals. However, the overall declared description presents the skill as something that logs negotiation learnings and supports reminder hooks, while the provided code chunk only generates a markdown scaffold for a new skill. That is a materially different primary behavior, and the core declared capabilities are absent from the code shown.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill includes a self-modification path via extract-skill.sh --write, which can generate or alter skill files. Even though the document says this is dry-run by default and requires approval, any mechanism that writes new agent instructions or skill scaffolds can persist unsafe behavior, especially if the generated content is reviewed insufficiently or later trusted automatically.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- execute legal/financial approvals
- finalize agreements
- run network calls unless you choose ClawHub install or `git clone`
- write skill files unless you run `extract-skill.sh --write`

Always require explicit human approval for high-impact concessions and for final terms.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 536)May include surrounding context.

md
Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/extract-skill.sh (reported line 28)May include surrounding context.

sh
Options:
  --dry-run      Show generated scaffold without writing files (default)
  --write        Write SKILL.md under the output directory (requires explicit user request)
  --output-dir   Relative output directory (default: ./skills)
  -h, --help     Show this help message

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill explicitly references network-capable actions (clawdhub install and git clone) but does not declare any tool scope or allowed-tools boundary. In agent environments, missing capability declarations can allow broader-than-expected execution paths and reduce the user's ability to understand or constrain external access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill instructs creation of persistent files in a user/workspace path (~/.openclaw/workspace/.learnings), enabling session persistence of negotiation-derived data. Persistent storage is risky here because even redacted summaries may still contain sensitive commercial signals, and cross-session memory can outlive the user's immediate intent or security context.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create learning files in OpenClaw workspace

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

md
| Priority | When to Use | Example |
|----------|-------------|---------|
| `critical` | High-impact unresolved risk or unauthorized concession | Liability term unresolved at close; major concession without approval |
| `high` | Recurring pattern with material impact | BATNA absent in enterprise cycles; repeated deadlocks |
| `medium` | Single-cycle issue with contained impact | One objection flow underperforming |
| `low` | Minor improvement or documentation cleanup | Non-critical wording updates |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

The skill authorizes reading other skill folders for cross-linking, which expands its visibility beyond its own namespace and can facilitate skill enumeration. In multi-skill workspaces, this can expose the presence, naming, and possibly sensitive metadata of other installed skills that were not meant to be inspected by this workflow.

Content

Scanner excerpt · SKILL.md (reported line 648)May include surrounding context.

md
### Ownership Rules
- This skill writes only to `.learnings/negotiation/` in stackable mode.
- It may read other skill folders for cross-linking, but should not rewrite their entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

Static analysis

No suspicious patterns detected.