ClawHub
Back to skill

Security audit

self-improving-robotics

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent robotics incident-logging and learning workflow with disclosed local files, optional scoped hooks, and no evidence of hidden exfiltration or destructive behavior.

Install only in a robotics workspace where persistent learning logs are desired. Keep hooks project-scoped, avoid PostToolUse unless you explicitly want output-term detection, redact telemetry and infrastructure details before logging, and require a reviewed diff before promoting anything into agent memory, core prompt docs, hooks, or new skills.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as a robotics incident-learning logger, but it also performs setup, file creation, hook installation guidance, promotion into core workspace docs, and skill extraction workflows. That mismatch is dangerous because users or agents may invoke it in safety-sensitive contexts expecting passive documentation, while it actually changes the workspace and can expand its influence into persistent agent behavior.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

---|------------|---------| | Safety-critical incident patterns | Safety checklist | "Require sensor freshness checks before enabling autonomous motion" | | Calibration/sync workflows | Calibration playbook | "Camera-lidar-imu time sync verification sequence" | | Stable tuning methods | Tuning runbook | "PID retune order under payload changes" | | Robotics behavior principles | SOUL.md | "Never bypass safety interlocks for speed" | | Multi-agent robotics workflow | AGENTS.md | "Separate sim, HIL, and field validation owners" | | Tooling integration standards | TOOLS.md | "Always record synchronized telemetry bundles" | | Reusable failure mitigations | New reusable skill | "narrow-passage-planning-resilience" |

Optional: Enable Hook

Opt-in and workspace-local. Do not copy this hook to ~/.openclaw/hooks/ (that path is user-global). Skip it unless you want reminders in this workspace:

bash
mkdir -p .openclaw/hooks
cp -r hooks/openclaw .openclaw/hooks/self-improving-robot

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 550)May include surrounding context.

md
Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
| Calibration and sync workflows | Calibration playbook | "Camera-lidar extrinsic and timestamp validation sequence" |
| Stable tuning procedures | Tuning runbook | "PID retuning order under payload change" |
| Multi-agent operations workflow | `AGENTS.md` | "Split sim validation and field validation across agents" |
| Behavioral guardrails | `SOUL.md` | "Never bypass safety interlocks for rapid testing" |
| Tool and telemetry integration | `TOOLS.md` | "Always export synchronized clocks for replay analysis" |

### Promotion Decision Tree

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 71)May include surrounding context.

md
| Calibration and sync workflows | Calibration playbook | "Camera-lidar extrinsic and timestamp validation sequence" |
| Stable tuning procedures | Tuning runbook | "PID retuning order under payload change" |
| Multi-agent operations workflow | `AGENTS.md` | "Split sim validation and field validation across agents" |
| Behavioral guardrails | `SOUL.md` | "Never bypass safety interlocks for rapid testing" |
| Tool and telemetry integration | `TOOLS.md` | "Always export synchronized clocks for replay analysis" |

### Promotion Decision Tree

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
| Calibration and sync workflows | Calibration playbook | "Camera-lidar extrinsic and timestamp validation sequence" |
| Stable tuning procedures | Tuning runbook | "PID retuning order under payload change" |
| Multi-agent operations workflow | `AGENTS.md` | "Split sim validation and field validation across agents" |
| Behavioral guardrails | `SOUL.md` | "Never bypass safety interlocks for rapid testing" |
| Tool and telemetry integration | `TOOLS.md` | "Always export synchronized clocks for replay analysis" |

### Promotion Decision Tree

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 71)May include surrounding context.

md
| Calibration and sync workflows | Calibration playbook | "Camera-lidar extrinsic and timestamp validation sequence" |
| Stable tuning procedures | Tuning runbook | "PID retuning order under payload change" |
| Multi-agent operations workflow | `AGENTS.md` | "Split sim validation and field validation across agents" |
| Behavioral guardrails | `SOUL.md` | "Never bypass safety interlocks for rapid testing" |
| Tool and telemetry integration | `TOOLS.md` | "Always export synchronized clocks for replay analysis" |

### Promotion Decision Tree

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs network-capable operations such as cloning from GitHub and installing via an external package source, yet it declares no explicit tool scope or permissions. In an agent environment, undeclared network access increases the chance of unreviewed remote content retrieval, supply-chain exposure, and behavior that operators did not authorize.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill instructs creation of persistent files under ~/.openclaw/workspace/.learnings, which can outlive a single session and affect future agent behavior or data retention. Even though it warns against global hooks, writing to a home-directory workspace still creates cross-session persistence and may store sensitive operational details if used carelessly.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation says Claude Code and Codex detection is automatic via error-detector.sh, implying PostToolUse-based output inspection is part of the supported behavior. Earlier hook guidance explicitly says to leave PostToolUse disabled and not attach error-detector.sh broadly, so the later table contradicts the documented operational setup.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 638)May include surrounding context.

md
### Ownership Rules
- This skill writes only to `.learnings/robotics/` in stackable mode.
- Do not read other skill folders, their SKILL.md files, or their log entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 46)May include surrounding context.

2. Install the Hook (Optional)

bash
mkdir -p .openclaw/hooks
cp -r hooks/openclaw .openclaw/hooks/self-improving-robotics

Static analysis

No suspicious patterns detected.