self-improving-security

• Outcome: Pass
• Latest audit: Sep 29, 2026 · 2:50 PM UTC
• Version: 1.2.2

Overview

This is a disclosed local security-learning logger with optional reminder hooks, not evidence of credential theft or malicious behavior.

Install only if you want a local, persistent record of security findings. Keep the learning files private unless entries have been reviewed and redacted, use project-scoped hooks only, avoid the optional PostToolUse detector in sensitive environments, and require a reviewed diff before promoting anything into AGENTS.md, SOUL.md, TOOLS.md, MEMORY.md, hooks, rules, or generated skills.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description suggests an operational/security knowledge capture capability that records vulnerabilities, secrets exposure, access violations, compliance findings, incident-response patterns, and threat intelligence when such events occur. The supplied code instead functions as a local project scaffolding tool: it validates a skill name, optionally validates an output directory, performs symlink/path traversal safety checks, and in write mode creates a new folder plus a templated SKILL.md file. While the generated template is security-themed, the primary purpose is materially different from the declared one. It does not ingest findings, detect security issues, extract data from logs/incidents, or otherwise capture the listed categories of security information. Therefore this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

|----------------|---------------|
| API keys | `REDACTED_API_KEY` |
| Passwords | `REDACTED_PASSWORD` |
| Access tokens (JWT, bearer, session) | `REDACTED_TOKEN` |
| Private keys | `REDACTED_PRIVATE_KEY` |
| Connection strings | `REDACTED_CONNECTION_STRING` |
| PII (emails, SSNs) | `REDACTED_PII` |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

If you want automatic reminders or setup assistance, use the opt-in hook workflow described in [Hook Integration](#hook-integration).

No credentials or access tokens are required by this skill.

## Quick Reference

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/hooks-setup.md (reported line 202)May include surrounding context.

md

If you want automatic reminders or setup assistance, use the opt-in hook workflow described in [Hook Integration](#hook-integration).

No credentials or access tokens are required by this skill.

## Quick Reference

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 519)May include surrounding context.

md

Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/hooks-setup.md (reported line 137)May include surrounding context.

md

### Test Error Detector Hook

1. Enable PostToolUse hook for Bash
2. Run a command that produces security-relevant output: `curl -k https://expired.badssl.com/`
3. Verify you see `<security-finding-detected>` reminder

### Dry Run Extract Script

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Broad activation language for security-related topics can cause the skill to trigger in many contexts, including routine debugging, logs, or conversations containing sensitive material. In a security-focused skill that writes to persistent files, overbroad invocation increases the chance of unintended retention of sensitive operational details or noisy autonomous actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'Automatically log when you notice' section defines many vague triggers, which can lead an agent to persist data based on heuristic pattern matching rather than clear user direction. In practice, that can capture sensitive incident context, create durable records unexpectedly, and amplify prompt-injection or false-positive security signals into filesystem writes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented skill-extraction workflow expands the skill from passive logging into generating new reusable skills, which can propagate unsafe guidance or preserve sensitive incident details in a more durable artifact. Even though the text says extracted skills are untrusted until reviewed, automatic or semi-automatic content generation from security findings increases the risk of prompt-injection persistence and accidental leakage into new artifacts.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 639)May include surrounding context.

md

### Ownership Rules
- This skill writes only to `.learnings/security/` in stackable mode.
- Do not read other skill folders, their SKILL.md files, or their log entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation states that the scripts 'do not modify files or run commands,' but the setup clearly configures command hooks and references a Bash PostToolUse detector. This contradiction can mislead users about the execution model and trust boundary, causing them to enable hooks under a false assumption of safety.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 53)May include surrounding context.

Copy the hook to OpenClaw's hooks directory:

bash

mkdir -p .openclaw/hooks
cp -r hooks/openclaw .openclaw/hooks/self-improving-security

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The stated purpose is to capture security-relevant learnings and incidents for continuous improvement. Multiple sections instruct promotion of findings into general agent-control and workspace documentation files, which is a broader behavior than the manifest's plain-language description of capturing security findings.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.