Security audit

Self Improving Agent 1.0.11

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent self-improvement logger, but it asks agents to persist and promote conversation-derived content into future agent instructions with broad hooks and limited safeguards.

Install only if you want durable agent memory behavior. Keep hooks project-scoped, avoid global every-prompt hooks, do not log secrets or raw transcripts, and require human review before any learning is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:264
Finding: Untrusted conversational learnings can be promoted into persistent agent instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:264-289`, with additional promotion guidance at `SKILL.md:346-361` and `SKILL.md:440-447` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code or Instructions ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` The instructions also state: ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The Skill accepts learnings originating from conversations and user feedback, then instructs the agent to promote selected content into persistent instruction files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. These destination files may be automatically loaded as trusted agent context in later sessions. The ...[truncated 1792 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit trusted-human approval before modifying any automatically loaded instruction file. 2. Store candidate promotions in a separate review file, such as `.learnings/PROMOTION_CANDIDATES.md`, rather than directly editing agent context. 3. Never copy conversational content verbatim into persistent instructions. Convert it into a restricted structured schema and preserve its provenance. 4. Reject promotion candidates that: - Request weaker safety controls. - Expand tool or filesystem permissions. - Request access to secrets or unrelated data. - Override user, system, or organizational policy. - Instruct agents to conceal activity or bypass review. 5. Remove the “promote aggressively” guidance and replace it with a conservative default of no promotion without review. 6. Add metadata including the originating user/session, evidence, reviewer identity, review date, and expiration or revalidation date. 7. Apply repository review controls, such as pull requests and CODEOWNERS approval, to changes in `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and Copilot instructions. 8. Treat all `.learnings/` entries as untrusted data when they are read by future agents. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:38
Finding: Manual installation uses an unpinned mutable remote repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:38-44` **Vulnerability Type**: Unverified supply-chain dependency **Risk Level**: Medium ### Vulnerable Code or Instructions ```markdown **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis The manual installation procedure clones the current default branch of a remote personal GitHub repository directly into OpenClaw's Skill directory. It does not pin a reviewed commit hash or immutable release and does not verify a checksum, signature, or trusted publisher identity. Consequently, the effective Skill installed by a user can differ from the version covered by this audit. Because the destination is an agent Skill directory and the project includes opt-in executable hooks, a compromised or modified upstream repository could supply altered prompt instructions or executable code. The command does not itself execute a fetched script. The risk arises when OpenClaw subsequently loads the cloned Skill or when the user enables scripts or hooks from that mutable checkout. ### Attack Path 1. The upstream repository, maintainer account, or default branch is compromised or modified after this audit. 2. Malicious Skill instructions, hook handlers, or shell scripts are committed to the mutable branch. 3. A user follows the documented `git clone` command. 4. The modified repository is placed directly under `~/.openclaw/skills/`. 5. OpenClaw loads the changed Skill instructions, or the user enables the supplied hook. 6. The malicious content executes with the permissions available to the agent or hook process. ### Impact Assessment The affected scope includes users who perform the manual installation after an upstream compromise or unautho ...[truncated 350 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin manual installation to a reviewed full commit hash or immutable signed release tag. 2. Publish a SHA-256 checksum for each release artifact and document verification before installation. 3. Use signed Git tags or release artifacts and require signature verification against a documented maintainer key. 4. Do not clone directly into an active Skill directory. Download into a staging directory, verify it, inspect executable files, and then copy the approved version. 5. Document the exact repository owner, release version, commit hash, and expected files. 6. Recommend reviewing all hook handlers and shell scripts before enabling them. 7. Add an update process that repeats signature and checksum verification rather than pulling an unreviewed mutable branch. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: hooks/openclaw/handler.js:31
Finding: Runtime JavaScript hook omits the TypeScript sub-agent exclusion<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:31-48`; expected control exists at `hooks/openclaw/handler.ts:43-48` **Vulnerability Type**: Source/runtime security-control divergence **Risk Level**: Low ### Vulnerable Code or Instructions The TypeScript source includes this exclusion: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } ``` The distributed JavaScript runtime proceeds directly from context validation to injection: ```javascript // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` ### Technical Analysis The JavaScript implementation omits the sub-agent session check present in the TypeScript source. If OpenClaw loads `handler.js`, bootstrap events for sub-agents receive `SELF_IMPROVEMENT_REMINDER.md` even though the TypeScript implementation explicitly attempts to prevent this behavior. This is a security-relevant build consistency issue: reviewers may approve controls in the TypeScript source that are absent from the actual runtime artifact. In this instance, the injected content is only a learning reminder, so the immediate severity is low. However, the divergence demonstrates that source-level safety controls are not reliably propagated to the shipped runtime. ### Attack Path 1. The hook is installed and enabled. 2. OpenClaw creates a sub-agent whose session key contains `:subagent:`. 3. An `agent:bootstrap` event is handled by `handler.js`. 4. Because the JavaScript file lacks the se ...[truncated 790 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Regenerate `handler.js` from `handler.ts` so the runtime includes the sub-agent exclusion. 2. Select one authoritative implementation where possible. Prefer compiling TypeScript during a reproducible release process rather than manually maintaining parallel files. 3. Add a test that submits an `agent:bootstrap` event with a sub-agent session key and confirms that no bootstrap file is inserted. 4. Add parity or reproducible-build checks in CI and fail releases when committed JavaScript differs from TypeScript compiler output. 5. Document which file OpenClaw loads at runtime so auditors and maintainers can review the effective implementation. 6. Include tests for malformed events, missing context, non-array `bootstrapFiles`, main-agent sessions, and sub-agent sessions. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about operational memory/learning capture: recording failures, corrections, outdated knowledge, and better approaches for future improvement. The supplied code does something materially different: it is a command-line helper that creates a new skill folder and writes a templated SKILL.md file. While the template mentions a 'Source Learning' section, the script does not actually capture learnings, parse learning entries, review prior learnings, detect failures, or update any learning repository. Its primary purpose is skill scaffolding, not continuous-improvement logging or retrieval. Therefore the description does not accurately represent the code's actual behavior.

Ssd 3

High

Confidence: 97% confidence
Finding: Cross-session transcript reading and message sending materially expands the blast radius of any sensitive content captured in one session. Framing this as collaboration does not remove the risk that private prompts, code, secrets, or internal discussions could be disclosed to unrelated sessions or agents without need-to-know controls.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Directing users to place executable hook configuration in ~/.claude/settings.json modifies an agent-wide trusted config location. Because hooks run as commands, this creates durable code execution across all sessions, making compromise or misconfiguration of that directory especially sensitive.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The invocation guidance is broad enough that the skill may activate during many ordinary interactions, causing routine conversations, mistakes, or requests to be persistently logged. In a coding-agent environment, over-triggering increases privacy risk and can normalize unnecessary writes to workspace memory files without strong user intent.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill encourages persistent logging of learnings, errors, and corrections and later sharing or promotion of that content, but it provides no guardrails for secrets, personal data, customer content, or confidential prompts. In practice, error output, user corrections, and operational context frequently contain sensitive material, so this design can cause durable data leakage across sessions and files.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 76% confidence
Finding: Creating persistent directories in a user workspace is not inherently malicious, but it establishes session persistence for collected content and normalizes writing memory artifacts outside the immediate task scope. In the context of this skill, that persistence becomes riskier because the stored content may include corrections, errors, and other potentially sensitive details.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The templates explicitly instruct storing full context, actual error output, and inputs or parameters, all of which commonly contain API keys, access tokens, internal file paths, proprietary prompts, stack traces, and user data. Persisting such raw material to markdown files creates an easily overlooked but durable sensitive-data sink.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The automatic triggers match common conversational phrases like routine corrections or follow-up requests, so the agent may classify normal dialogue as something to store permanently. That creates a realistic path for unintended retention of user content and operational details, especially when combined with persistent logs and downstream promotion rules.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Telling agents to 'promote aggressively' into persistent memory and instruction files increases the chance that transient sensitive content becomes part of future operating context. Once promoted, the information may be repeatedly surfaced to later sessions or agents, compounding leakage and making cleanup difficult.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: This markdown template tells authors to 'Include trigger conditions' but does not require those triggers to be specific, scoped, or accompanied by exclusions. Because the file is a template for future skill descriptions, this can propagate ambiguous activation wording into downstream skills.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 84% confidence
Finding: Project-level hook installation creates persistent behavior that automatically reappears in future sessions. In this skill context, persistence is more dangerous because the hook is designed to observe prompts and failures over time, so an unsafe or altered script can continuously influence or collect session data.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: An empty matcher causes the UserPromptSubmit hook to run on every prompt, making the trigger overly broad and effectively always-on. In a self-improvement skill, this expands exposure to prompt contents and increases the chance of unnecessary data capture, instruction interference, or abuse if the hooked script is modified.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The user-level configuration enables global activation from ~/.claude/settings.json without meaningful trigger constraints. That broad persistence applies the hook across projects and sessions, magnifying the blast radius if the script misbehaves, is replaced, or processes sensitive prompts from unrelated work.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document claims the hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly invokes shell scripts via a command hook. That mismatch can cause users to trust hooks as harmless when they execute arbitrary script logic with the agent's permissions, increasing the chance of unsafe deployment.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 88% confidence
Finding: The instructions create a persistent `.learnings/` storage location, which is consistent with the skill's purpose but still introduces durable retention of agent-observed data. In this skill context, persistence is expected, yet without retention limits, sanitization rules, or lifecycle controls it can accumulate sensitive information and increase exposure over time.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation tells the agent to log significant errors to persistent learnings, but it does not warn against storing secrets, personal data, prompts, or sensitive operational context. In a self-improvement skill, failures and corrections often contain exactly that kind of data, so this omission can lead to unintended retention of sensitive information across sessions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file documents cross-session transcript access via `sessions_history` without any privacy or authorization warning. Transcript history can contain user data, secrets, or sensitive instructions, so normalizing unrestricted access increases the risk of inappropriate lateral data exposure between sessions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `sessions_send` example encourages sending learned information to another session without warning that the message may contain sensitive workspace or user data. In a multi-session agent environment, this creates an easy path for lateral data propagation and accidental exfiltration beyond the original task context.

Vague Triggers

Low

Confidence: 81% confidence
Finding: The Quick Reference table uses '[Trigger 1]' and '[Trigger 2]' placeholders without any instruction that triggers must be narrow and non-ambiguous. In a template, such generic placeholders can lead authors to supply broad natural-language triggers that overlap with ordinary conversation.

Static analysis

No suspicious patterns detected.