Ai Trainer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:53 AM UTC
• Version: 1.0.0

Overview

The skill openly learns from websites, but it also allows automatic changes to long-term memory and operational rule files without clear review controls.

Install only if you are comfortable with a skill that can fetch online documentation and write derived guidance into agent rule and memory files. Before use, require manual review of proposed changes to AGENTS.md and MEMORY.md, keep source provenance, and avoid pointing it at untrusted or broad documentation sites.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:4

Finding

Untrusted Web Content Can Poison Persistent Agent Memory and Operational Rules

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4-9 and 19
Vulnerability Type: Persistent memory poisoning through untrusted web content
Risk Level: High

Vulnerable Code Snippet

markdown

## Overview
This skill empowers the assistant to autonomously learn from online resources, distill complex documentation (like Anthropic Skilljar or MCP guides), and integrate these findings into the system's long-term memory (MEMORY.md) and operational rules (AGENTS.md).

## Capabilities
- **Deep Web Fetching**: Recursively fetch and summarize multi-page documentation sites.
- **Knowledge Distillation**: Extract core primitives, transport patterns, and tool-use strategies from technical docs.
- **System Integration**: Automatically update workspace rules (AGENTS.md) and memory (MEMORY.md) with newly acquired insights.
- **Routing Optimization**: Advise on model selection (e.g., local Ollama vs. Cloud) based on learned task complexity.

markdown

- `edit`/`write`: Update system configuration and memory files.

The same unsafe workflow is confirmed by README.md, lines 3-11:

markdown

A skill designed to help the assistant autonomously learn, distill, and integrate complex technical documentation (like Anthropic Skilljar or MCP guides) into the OpenClaw system's long-term memory (MEMORY.md) and operational rules (AGENTS.md).

## Capabilities
- **Technical Distillation**: Automatically fetch and summarize technical resources.
- **System Integration**: Update AGENTS.md and MEMORY.md with new insights.
- **Resource Optimization**: Advise on model selection based on task complexity.

## Setup & Training
To use this skill, point the assistant to a URL or documentation site. It will then fetch, summarize, and integrate the findings according to the guidelines in SKILL.md.

Technical Analysis

The Skill combines recursive retrieval of externally controlled documentation with auto ...[truncated 3465 chars]

Remediation

View remediation

Remediation Suggestions

1. Prohibit automatic modification of operational rules. Remove AGENTS.md from the Skill's writable targets. Documentation summarization does not require permission to alter Agent instructions.
2. Require explicit approval before persistence. Display a complete diff of any proposed MEMORY.md change and obtain informed user confirmation immediately before writing.
3. Quarantine retrieved material. Initially store summaries in a dedicated, non-executable review file rather than in memory or instruction files.
4. Treat web content only as data. Explicitly prohibit obeying instructions found in fetched pages. Extract factual claims into a strict schema and reject imperative text, tool directives, requests for secrets, and attempts to override existing rules.
5. Apply source controls. Use an allowlist of approved domains, enforce HTTPS, limit redirects, cap recursion depth and page count, and record source URLs and retrieval timestamps.
6. Preserve provenance. Attribute every persisted claim to its exact source and keep externally derived content clearly separated from trusted local instructions.
7. Enforce rule precedence. Make system and workspace security policies immutable to this Skill and ensure retrieved content cannot override them.
8. Minimize tool privileges. Grant web retrieval by default, but provide write access only to a designated output file. Avoid general edit, write, or exec access unless separately approved for a specific operation.
9. Add injection review. Scan fetched content and generated summaries for instruction-hijacking patterns, encoded directives, secret requests, and attempts to trigger tool calls. Treat detection as a reason to stop and request user review rather than as a complete security boundary.
10. Support rollback and auditing. Back up approved state files, log reviewed changes and their provenance, and provide a reliable way to revert po ...[truncated 15 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly states that the skill will update AGENTS.md and MEMORY.md, which are sensitive local control and memory files, but it does not warn users that these files may be modified automatically. In the context of an autonomous learning skill, this is dangerous because external or mis-summarized content could be persisted into long-term instructions, causing configuration drift, prompt poisoning, or durable behavior changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to point the skill at a URL or documentation site and says it will fetch and integrate the results, but it does not disclose network access or the risks of ingesting external untrusted data. This increases the chance of silent data exfiltration, SSRF-like behavior in connected environments, or prompt/content poisoning from hostile documentation sources that may later be written into persistent files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states it can autonomously integrate learned content into AGENTS.md and MEMORY.md, which are high-trust workspace files that can alter future agent behavior and retained knowledge. Allowing such writes without an explicit user-facing approval step or strong scoping creates a prompt-injection and persistence risk, especially because the skill also ingests untrusted online documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The allowed tools and capability descriptions authorize automatic updates to system configuration and memory files, but the skill does not clearly disclose the integrity and persistence implications of those actions. Because the skill combines web_search/web_fetch with edit/write access, untrusted external content could be transformed into durable rule changes that influence later sessions or tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.