T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:264- Finding
Untrusted conversational learnings can be promoted into persistent agent instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent 1.0.11
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent self-improvement logger, but it asks agents to persist and promote conversation-derived content into future agent instructions with broad hooks and limited safeguards.
Install only if you want durable agent memory behavior. Keep hooks project-scoped, avoid global every-prompt hooks, do not log secrets or raw transcripts, and require human review before any learning is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:38- Finding
Manual installation uses an unpinned mutable remote repository
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
hooks/openclaw/handler.js:31- Finding
Runtime JavaScript hook omits the TypeScript sub-agent exclusion
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about operational memory/learning capture: recording failures, corrections, outdated knowledge, and better approaches for future improvement. The supplied code does something materially different: it is a command-line helper that creates a new skill folder and writes a templated SKILL.md file. While the template mentions a 'Source Learning' section, the script does not actually capture learnings, parse learning entries, review prior learnings, detect failures, or update any learning repository. Its primary purpose is skill scaffolding, not continuous-improvement logging or retrieval. Therefore the description does not accurately represent the code's actual behavior.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Cross-session transcript reading and message sending materially expands the blast radius of any sensitive content captured in one session. Framing this as collaboration does not remove the risk that private prompts, code, secrets, or internal discussions could be disclosed to unrelated sessions or agents without need-to-know controls.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Directing users to place executable hook configuration in ~/.claude/settings.json modifies an agent-wide trusted config location. Because hooks run as commands, this creates durable code execution across all sessions, making compromise or misconfiguration of that directory especially sensitive.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation guidance is broad enough that the skill may activate during many ordinary interactions, causing routine conversations, mistakes, or requests to be persistently logged. In a coding-agent environment, over-triggering increases privacy risk and can normalize unnecessary writes to workspace memory files without strong user intent.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill encourages persistent logging of learnings, errors, and corrections and later sharing or promotion of that content, but it provides no guardrails for secrets, personal data, customer content, or confidential prompts. In practice, error output, user corrections, and operational context frequently contain sensitive material, so this design can cause durable data leakage across sessions and files.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
Creating persistent directories in a user workspace is not inherently malicious, but it establishes session persistence for collected content and normalizes writing memory artifacts outside the immediate task scope. In the context of this skill, that persistence becomes riskier because the stored content may include corrections, errors, and other potentially sensitive details.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The templates explicitly instruct storing full context, actual error output, and inputs or parameters, all of which commonly contain API keys, access tokens, internal file paths, proprietary prompts, stack traces, and user data. Persisting such raw material to markdown files creates an easily overlooked but durable sensitive-data sink.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The automatic triggers match common conversational phrases like routine corrections or follow-up requests, so the agent may classify normal dialogue as something to store permanently. That creates a realistic path for unintended retention of user content and operational details, especially when combined with persistent logs and downstream promotion rules.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Telling agents to 'promote aggressively' into persistent memory and instruction files increases the chance that transient sensitive content becomes part of future operating context. Once promoted, the information may be repeatedly surfaced to later sessions or agents, compounding leakage and making cleanup difficult.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown template tells authors to 'Include trigger conditions' but does not require those triggers to be specific, scoped, or accompanied by exclusions. Because the file is a template for future skill descriptions, this can propagate ambiguous activation wording into downstream skills.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Project-level hook installation creates persistent behavior that automatically reappears in future sessions. In this skill context, persistence is more dangerous because the hook is designed to observe prompts and failures over time, so an unsafe or altered script can continuously influence or collect session data.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
An empty matcher causes the UserPromptSubmit hook to run on every prompt, making the trigger overly broad and effectively always-on. In a self-improvement skill, this expands exposure to prompt contents and increases the chance of unnecessary data capture, instruction interference, or abuse if the hooked script is modified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-level configuration enables global activation from ~/.claude/settings.json without meaningful trigger constraints. That broad persistence applies the hook across projects and sessions, magnifying the blast radius if the script misbehaves, is replaced, or processes sensitive prompts from unrelated work.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document claims the hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly invokes shell scripts via a command hook. That mismatch can cause users to trust hooks as harmless when they execute arbitrary script logic with the agent's permissions, increasing the chance of unsafe deployment.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The instructions create a persistent
.learnings/storage location, which is consistent with the skill's purpose but still introduces durable retention of agent-observed data. In this skill context, persistence is expected, yet without retention limits, sanitization rules, or lifecycle controls it can accumulate sensitive information and increase exposure over time.- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation tells the agent to log significant errors to persistent learnings, but it does not warn against storing secrets, personal data, prompts, or sensitive operational context. In a self-improvement skill, failures and corrections often contain exactly that kind of data, so this omission can lead to unintended retention of sensitive information across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file documents cross-session transcript access via
sessions_historywithout any privacy or authorization warning. Transcript history can contain user data, secrets, or sensitive instructions, so normalizing unrestricted access increases the risk of inappropriate lateral data exposure between sessions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The
sessions_sendexample encourages sending learned information to another session without warning that the message may contain sensitive workspace or user data. In a multi-session agent environment, this creates an easy path for lateral data propagation and accidental exfiltration beyond the original task context.- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The Quick Reference table uses '[Trigger 1]' and '[Trigger 2]' placeholders without any instruction that triggers must be narrow and non-ambiguous. In a template, such generic placeholders can lead authors to supply broad natural-language triggers that overlap with ordinary conversation.
- Content
Static analysis
No suspicious patterns detected.