ClawHub
Back to skill

Security audit

self-improving-support

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed support-learning logger with optional reminder hooks, but users should keep its hooks project-scoped and avoid logging sensitive customer data.

Install only from a version or commit you trust. Keep hooks project-scoped, narrow the matcher before enabling them, use the activator-only setup unless command-output inspection is needed, and review .learnings entries for PII, credentials, tokens, and privileged support details before sharing or committing them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:49
Finding

Unpinned Remote Skill Installation Creates a Mutable Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
``` 2. Prefer signed, versioned releases over the repository's mutable default branch. 3. Publish SHA-256 checksums for release archives and require verification before installation. 4. Verify release or commit signatures against a documented maintainer key. 5. Pin the ClawdHub installation to an exact version if the platform supports version constraints. 6. Review the downloaded `SKILL.md`, hook handlers, and shell scripts before enabling any hook. 7. Keep hooks project-scoped and disabled by default, as already recommended by the project. 8. Document the exact audited version or commit in the installation instructions so users can reproduce the reviewed artifact. ]]>

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as a support-learning logger, but it also instructs the agent to install hooks, create persistent files, and run helper scripts that scaffold and extract new skills. This broader behavior can mislead users and agents into granting filesystem persistence and code-generation capabilities that were not clearly disclosed, increasing the risk of unintended workspace modification and propagation of unreviewed artifacts.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 536)May include surrounding context.

md
Extracted skills are untrusted until a human reviews the generated `SKILL.md`. Do not keep or publish an extracted skill without explicit user approval.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill instructs creation of persistent directories and files under ~/.openclaw/workspace/.learnings and notes that hooks persist across future sessions. Session-persistent storage can accumulate sensitive operational data and silently influence future agent behavior, especially because support logs may contain customer-impact details even if anonymization is recommended.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 644)May include surrounding context.

md
### Ownership Rules
- This skill writes only to `.learnings/support/` in stackable mode.
- It may read other skill folders for cross-linking, but should not rewrite their entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The regex matcher uses broad, common support terms like "customer", "resolve", and partial stems such as "diagnos" and "escalat", which are likely to trigger on ordinary conversations unrelated to actual post-incident learning capture. Because the hook injects command output into agent context automatically, over-triggering can cause prompt/context pollution, unnecessary exposure of sensitive workflow signals, and make users habituate to or ignore injected content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Although this section discourages global installation, it still provides a user-level example with the same vague matcher, which risks persistent activation across unrelated repositories and sessions. If copied as-is, the hook could inject support-improvement prompts into unrelated work, amplifying context contamination and increasing chances that sensitive or irrelevant data is processed by the hook path.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The "minimal setup" reduces the number of hooks but retains the same overly broad keyword matcher, so accidental triggering remains likely. In a support-oriented skill, frequent false activations can still alter agent behavior at sensitive moments and encourage indiscriminate capture of operational details that were not meant to be processed for self-improvement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The Codex configuration repeats the same ambiguous matcher, extending the same overbroad auto-trigger behavior to another agent platform. Reuse across tools increases the blast radius: an imprecise pattern can repeatedly inject hook output into multiple development or support contexts, reducing trust boundaries and increasing accidental processing of unrelated content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 50)May include surrounding context.

openclaw hooks enable self-improving-support

text

### 3. Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Static analysis

No suspicious patterns detected.