Auto Improvement

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it creates lasting agent memory and optional broad hooks without enough safeguards for sensitive content or future-session influence.

Install only if you want a persistent learning/memory workflow. Keep it project-scoped, avoid global hooks, review any hook commands before enabling them, do not store secrets or raw transcripts in .learnings, and require a human diff review before promoting anything into CLAUDE.md, AGENTS.md, copilot instructions, SOUL.md, or TOOLS.md.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:264

Finding

Untrusted Learnings Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns in ...[truncated 3213 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:90

Finding

Relative Output Validation Can Be Bypassed through Symbolic Links

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script attempts to confine output to the current workspace by rejecting absolute paths and `..` path components. These checks only validate the textual form of the supplied path. They do not verify where the path resolves on the filesystem. If `skills`, the value passed through `--output-dir`, or an intermediate path component is a symbolic link, `mkdir -p` and the shell redirection can follow that link outside the current workspace. The resulting write occurs with the privileges of the user or Agent invoking the script. The existing-directory test does not prevent this attack when a parent component is a symlink and the selected skill directory does not yet exist at the external target. ### Attack Path 1. An attacker controls or prepares content in the curre ...[truncated 1255 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code is narrowly focused on detecting likely command failures from Bash tool output and emitting a logging reminder. The declared description presents a much broader continuous-improvement skill covering multiple kinds of learnings and explicit review behavior before major tasks. This is not just an implementation detail difference: the actual code only supports one subset of the declared use cases and relies on a specific undeclared trigger and environment variable. Because the implemented behavior is materially narrower and trigger-specific than the declared purpose, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about maintaining and consulting a repository of learnings for continuous improvement after failures, corrections, or discovered better approaches. The supplied code does not capture, store, review, or analyze learnings directly. Instead, it is a helper script for extracting/promoting a learning into a new skill by creating a directory and templated SKILL.md file on disk. This is a materially different primary purpose and includes undeclared filesystem write capabilities. While related at a high level to learnings, the actual behavior is specifically skill scaffolding, not learning capture or review.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 91% confidence

Finding

Directing users to modify ~/.claude/settings.json introduces execution logic into an agent-wide configuration directory, creating persistent behavior that affects future sessions beyond the current project. In a self-improvement skill, this is more dangerous because it normalizes durable agent behavior changes and can be abused to maintain execution footholds across contexts.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 73% confidence

Finding

Creating persistent learning files in a user workspace is expected for this skill, but it still introduces a retention surface for potentially sensitive operational and conversational data. The risk is elevated here because the skill strongly encourages ongoing accumulation and reuse of those files across sessions.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages sharing learnings across sessions and reading other sessions' transcripts, but it does not define minimization, redaction, or authorization safeguards. That creates a real risk of propagating secrets, personal data, or sensitive project context beyond the original session boundary.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The logging format instructs the agent to record full context, inputs, parameters, and error output, all of which commonly contain credentials, tokens, personal data, internal URLs, or proprietary content. Because these entries are persisted to markdown files, accidental exposure can outlive the original task and spread through repos or shared workspaces.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are very broad and overlap with normal conversation, which can cause the skill to activate and persist content when the user did not intend that behavior. In a memory/logging skill, over-triggering increases the chance of collecting sensitive or irrelevant user content into durable storage.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction to 'promote aggressively' into persistent agent-context files encourages moving conversation-derived information into broader, longer-lived memory surfaces without a sensitivity review. This increases the blast radius of any secret or sensitive detail accidentally captured during logging.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Using an empty matcher causes the hook to run on every prompt or tool event, greatly expanding the skill's activation surface. For a persistence-oriented skill, that can lead to excessive data collection, noisy logs, and accidental handling of sensitive session content without clear necessity.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file includes an example SKILL.md manifest whose description says to use the skill when 'docker build fails with platform mismatch errors.' While somewhat domain-specific, it does not clearly define trigger scope, exact phrases, or negative examples, which can lead to unintended invocation for loosely related Docker issues.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The project-level hook setup establishes persistent automatic behavior for future sessions, which is a form of session persistence. While persistence is part of the feature's design, it still creates security risk because command hooks continue executing until removed, potentially outlasting user awareness or repository trust assumptions.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Using an empty matcher causes the hook to fire on every prompt, greatly expanding the trigger surface and ensuring unscoped execution of the referenced script. In this skill context, that increases exposure to prompt-driven persistence and unnecessary command execution, especially if the script is later modified or replaced.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-level setup recommends global activation from ~/.claude/settings.json without meaningful trigger constraints, causing the hook to run across all projects and sessions. That broadens blast radius from a single repository to the entire user environment and makes any malicious or buggy script behavior persistent and cross-context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document states the scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly registers them as command hooks executed by the agent. This mismatch can cause operators to underestimate the trust and execution risk of these scripts, leading to unsafe deployment of arbitrary shell code under the user's privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The instructions create persistent .learnings/ storage in the workspace or skill directory without discussing retention limits, access control, or safe content restrictions. In a self-improvement skill, persistent memory increases the chance that mistakes, sensitive prompts, or confidential operational details remain stored and later re-injected into future sessions.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide recommends logging learnings into workspace files and sending them across sessions, but it does not warn against including secrets, credentials, personal data, or proprietary context. Because these files and cross-session channels are shared persistence mechanisms, this can spread sensitive information beyond the original context and increase exposure duration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The detection triggers are described in broad, subjective terms such as user corrections, knowledge gaps, and model behavior surprise. In a self-improvement skill that writes persistent learnings, ambiguous triggers can cause over-collection, accidental logging of sensitive context, and inconsistent activation across sessions or agents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.