Security audit

SELF IMPROVING

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it persistently records conversation-derived information and promotes it into future-agent instruction files with broad triggers and weak safeguards.

Install only if you want persistent self-improvement memory. Prefer project-local setup, avoid global hooks, keep `.learnings/` out of version control unless entries are reviewed, redact secrets and personal data before logging, and require an explicit diff review before promoting anything into agent instruction files or extracting a new skill.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:263
Finding: Untrusted Lessons Can Be Promoted into Persistent Agent Instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:263-288, SKILL.md:329-360, hooks/openclaw/handler.js:18-23, hooks/openclaw/handler.ts:19-24
Vulnerability Type: Persistent agent-context poisoning
Risk Level: Medium

Vulnerable Code

markdown
## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`

The recurring-pattern workflow additionally directs the agent to promote entries into prompt-bearing files:

markdown
### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for ...[truncated 2310 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit, informed user approval before writing any lesson into an automatically loaded instruction or memory file.

Treat conversation text, command output, task summaries, and existing learning entries as untrusted data.

Permit automatic promotion only for structured factual fields; prohibit automatic promotion of commands, behavioral mandates, permission changes, external communication instructions, or safety-policy modifications.

Record provenance for every lesson, including source session, author, timestamp, related task, and review status.

Add a review state such as pending_security_review and require approval by a trusted maintainer.

Store generated lessons in a non-injected data file by default. Copy them into prompt-bearing files only through a separate reviewed process.

Detect and reject instruction-hijacking language, encoded payloads, external retrieval directives, credential requests, and attempts to override higher-priority instructions.

Make cross-session propagation opt-in and show the exact proposed diff before promotion.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:165
Finding: Raw Error Logging Can Persist Secrets in Repository-Tracked Files
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:165-190 and SKILL.md:450-459
Vulnerability Type: Plaintext sensitive-data persistence
Risk Level: Medium

Vulnerable Code

markdown
### Error Entry Append to `.learnings/ERRORS.md`: ```markdown ## [ERR-YYYYMMDD-XXX] skill_or_command_name **Logged**: ISO-8601 timestamp **Priority**: high **Status**: pending **Area**: frontend | backend | infra | tests | docs | config ### Summary Brief description of what failed ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant

The Skill also explicitly supports tracking these files in version control:

markdown
**Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge.

Technical Analysis

Command output, attempted command lines, input parameters, and environment details frequently contain secrets. Examples include API tokens, authorization headers, signed URLs, cookies, passwords embedded in connection strings, private registry credentials, private filesystem paths, and customer data.

The Skill instructs the agent to preserve the actual error output and environment details but does not require secret detection or redaction. The optional error-detection hook increases the likelihood that failures will be recorded. Although the hook itself does not print or transmit CLAUDE_TOOL_OUTPUT, its reminder can lead the agent to copy sensitive output into a persistent Markdown file.

Because the documentation recommends sharing learning files through version control, a locally exposed secret can subsequently be committed and uploaded to a remote repository.

Attack Path

A command or external API invocation fails while its output contains a credential or sensitive value.

The error detector observes an error pattern an ...[truncated 933 chars]
Remediation: View remediation
Remediation Suggestions

Add a mandatory redaction step before any command output, parameters, or environment details are written.

Remove or mask authorization headers, cookies, passwords, tokens, private keys, signed URLs, connection strings, personal data, and sensitive filesystem paths.

Store concise error classifications and sanitized excerpts instead of complete raw output.

Default .learnings/ to local-only storage through .gitignore.

Provide a separate sanitized export process for lessons intended to be shared with a team.

Add automated secret scanning before writing entries and in pre-commit or CI checks.

Warn users never to record complete environment-variable dumps or commands containing inline credentials.

If a secret is accidentally recorded, remove it from repository history and rotate or revoke it immediately.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/extract-skill.sh:95
Finding: Output Directory Containment Check Can Be Bypassed Through Symbolic Links
Content: View full analysis
Vulnerability Details

File Location: scripts/extract-skill.sh:95-155
Vulnerability Type: Symlink-based path traversal and arbitrary file placement
Risk Level: Low

Vulnerable Code

bash
# Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" # Check if skill already exists if [ -d "$SKILL_PATH" ] && [ "$DRY_RUN" = false ]; then log_error "Skill already exists: $SKILL_PATH" log_error "Use a different name or remove the existing skill first." exit 1 fi

The unchecked path is later used for file creation:

bash
# Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE --- name: $SKILL_NAME description: "[TODO: Add a concise description of what this skill does and when to use it]" ---

Technical Analysis

The script rejects absolute paths and explicit .. path segments, but performs only lexical validation. It does not canonicalize the output path or verify that each existing path component is not a symbolic link.

A relative path can therefore pass validation while resolving outside the current workspace. For example, if ./skills/external is a symbolic link to a directory outside the project, --output-dir ./skills/external is accepted. mkdir and shell redirection then follow the symbolic link.

The skill-name validation prevents command injection and direct filename traversal, but it does not mitigate traversal through filesystem indirection.

Atta

...[truncated 1109 chars]
Remediation: View remediation
Remediation Suggestions

Establish a canonical trusted workspace root with realpath.

Resolve the nearest existing parent of the requested destination and verify that its canonical path remains beneath the trusted root.

Reject the destination if any existing path component is a symbolic link.

Perform containment checks immediately before both directory creation and file writing to reduce time-of-check/time-of-use exposure.

Prefer a fixed output root rather than accepting arbitrary relative output directories.

Create files using mechanisms that reject symlink following where supported.

Fail closed if canonicalization is unavailable or if the destination parent cannot be safely resolved.

Add regression tests covering symlinks to external directories, nested symlinks, broken symlinks, and path replacement during execution.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a logging/review aid, but it also instructs agents to create files, enable hooks, share data across sessions, and scaffold entirely new skills. That hidden expansion of capability can cause operators to invoke it in lower-trust situations than they would if its full behavior were disclosed, increasing the chance of unintended persistence or prompt-surface expansion.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Documenting installation into ~/.claude/settings.json directs users to modify a sensitive agent configuration directory that affects all future sessions. In the context of executable command hooks, writing to this location creates durable, broad-scope behavior and can be abused for cross-project persistence if the referenced scripts are altered or replaced.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation criteria are broad enough to match many ordinary interactions, making the skill likely to trigger frequently and collect more information than necessary. Over-broad triggering raises the chance of routine user content being persisted or promoted without meaningful need.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The skill directs creation of persistent learning files under a home-directory workspace, establishing long-lived memory outside the immediate task context. Persistent storage is not inherently malicious, but without consent, scoping, and retention controls it can accumulate sensitive operational and user information across sessions.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The inter-session features instruct agents to inspect other sessions' history and send learnings between sessions, which materially expands data access beyond simple self-improvement logging. In a multi-user or multi-task environment, this can lead to unintended disclosure of prior prompts, outputs, or sensitive task context across isolation boundaries.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill recommends sharing learnings across sessions and reading session transcripts, which can spread user-provided content into broader persistent or semi-persistent channels. This increases the blast radius of any sensitive information disclosed in one task and undermines data minimization and session separation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The logging templates instruct the agent to retain full context, including user inputs, error output, environment details, and related files. Such broad retention can capture secrets, proprietary code fragments, tokens, or personal data and store them in persistent markdown files where future agents or users may access them.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The automatic logging triggers match common conversational phrases and corrections without clear exclusion rules or consent checks. That design can cause routine user statements, requests, and clarifications to be persisted automatically, creating unnecessary retention of potentially sensitive data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Default logging of user corrections, requests, and newly provided information encourages the agent to persist conversational content that may be sensitive or unnecessary for future work. This creates a quiet memory channel where user data is stored without clear consent or minimization safeguards.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill-extraction workflow turns logged learnings into new reusable skills, which is a capability escalation from note-taking into persistent prompt/code generation. If learnings contain flawed, sensitive, or adversarial content, this mechanism can propagate it into durable agent behavior and broaden its impact across future tasks.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: Creating a project .claude/settings.json with command hooks establishes session-persistent behavior that automatically re-executes in later agent runs. While persistence is part of the feature, it is security-relevant because it can silently continue invoking scripts after the original setup is forgotten, especially in shared or long-lived repositories.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: An empty matcher on UserPromptSubmit causes the hook to fire on every prompt, creating always-on execution of the configured script. In this skill context, that broad trigger scope increases the chance of unnecessary data exposure, performance overhead, and repeated execution of any future script changes without meaningful scoping.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The user-level configuration recommends global activation from ~/.claude/settings.json, which makes the hook persist across all projects and sessions without scope boundaries. That persistence magnifies risk because one script path gains broad access to future prompts and agent contexts, including unrelated repositories and potentially sensitive work.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document's security section claims the scripts only output text and do not run commands, yet the entire setup explicitly configures those scripts to be executed as hook commands. This is misleading because any shell script executed via the hook mechanism can perform arbitrary actions with the agent's permissions, causing users to underestimate the trust and review required before enabling them.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The setup explicitly creates a persistent .learnings directory, enabling retention of model observations and user/context-derived data across sessions. In the context of a self-improvement skill, this persistence increases risk because stored content may include sensitive information and may later influence agent behavior if not reviewed, sanitized, or expired.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.
openclaw hooks enable self-improvement

text
### 3. Create Learning Files Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation instructs users to persist learnings into workspace files and promote them into AGENTS.md, SOUL.md, and TOOLS.md, but it does not warn about storing secrets, personal data, or sensitive operational context. Because these files are injected into future sessions, unsafe persistence can create long-lived prompt injection, privacy leakage, and propagation of bad or confidential data across sessions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list is broad and loosely defined, which can cause the self-improvement skill to activate in many normal interactions such as generic 'knowledge gaps' or vague 'model behavior surprise' cases. In a system that writes persistent learnings and promotes them into workspace prompt files, over-activation can unintentionally capture sensitive context or alter future agent behavior without clear user intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script's documented purpose is to 'create a new skill from a learning entry,' and the implementation supports custom output directories and file generation. Creating executable skill scaffolds is a broader repository-authoring capability than the manifest's scope of capturing learnings, failures, and corrections for continuous improvement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a self-improvement skill focused on recording learnings and corrections for later review. This script instead scaffolds entirely new skills by creating directories and writing SKILL.md templates, which is a different operational purpose than capturing or reviewing learnings.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The activation criteria are broad enough to match many ordinary interactions, making the skill likely to trigger frequently and collect more information than necessary. Over-broad triggering raises the chance of routine user content being persisted or promoted without meaningful need.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Atta

Remediation Suggestions

SkillSpector

Tp4

Agent Config Directory Access

Option 2: User-Level Configuration

Exfiltration Commands

sessions_send

Vague Triggers

Session Persistence

Context-Inappropriate Capability

Ssd 3

Ssd 3

Vague Triggers

Ssd 3

Context-Inappropriate Capability

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Intent-Code Divergence

Session Persistence

Missing User Warnings

Vague Triggers

Context-Inappropriate Capability

Description-Behavior Mismatch

Vague Triggers

Static analysis