Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Claude ('No, that's wrong...', 'Actually...'), (3) User requests a capability that doesn't exist, (4) An external API or tool fails, (5) Claude realizes its knowledge is outdated or incorrect, (6) A better approach is discovered for a recurring task. Also review learnings before major tasks.

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:39 AM UTC
• Version: 1.0.0

Overview

The skill is a self-improvement memory logger, but it encourages broad automatic logging and lasting changes to future agent instructions without enough approval or redaction safeguards.

Install only if you want an agent to keep durable learning logs and potentially update future agent instruction files. Keep hooks project-scoped, avoid empty global matchers, review every proposed log and promotion, redact secrets and personal or business-sensitive context, and require explicit approval before writing to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or copilot instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:346
• Finding: Conversation-Derived Rules Can Poison Persistent Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:346-360`, `SKILL.md:443-448`, `hooks/openclaw/handler.ts:21-24`, `hooks/openclaw/handler.ts:54-59` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code `SKILL.md:346-360`: ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` `SKILL.md:443-448`: ```markdown 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` `hooks/openclaw/handler.ts:21-24`: ```typescript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` `hooks/openclaw/handler.ts:54-59`: ```typescript event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); ``` ### Technical Analysis The skill instructs the agent to capture corrections, discoveries, and other conversation-derived information and later promote those entries into persistent agent instruction files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. These files can be loaded as trusted context in future sessions. The promotion process does not def ...[truncated 3173 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Require explicit owner approval** - Never promote conversation-derived content automatically. - Present the proposed destination, source, and exact diff to an authorized user. - Require an explicit confirmation before modifying persistent instruction files. 2. **Track provenance and trust** - Record who supplied each learning, the originating session, timestamp, and whether it was independently verified. - Mark user assertions as untrusted until corroborated by authoritative project documentation or test results. - Prohibit promotion of entries with unknown or untrusted provenance. 3. **Create a strict promotion allowlist** - Permit only concise, declarative project facts and verified workflow constraints. - Reject instruction overrides, shell commands, external upload destinations, authentication instructions, encoded content, and requests to suppress disclosure or review. - Do not promote secrets, credentials, personal information, raw tool output, or complete user messages. 4. **Separate knowledge from agent policy** - Keep descriptive learnings in a non-executable knowledge store. - Do not copy untrusted text directly into files treated as system or bootstrap instructions. - Generate any promoted rule from a fixed, security-reviewed template. 5. **Replace recurrence with verification** - Do not treat repetition as evidence of correctness. - Require reproducible tests, authoritative documentation, or approval from a designated maintainer. - Remove the “promote aggressively” instruction. 6. **Limit write scope** - Restrict the skill to `.learnings/` by default. - Place persistent agent-context files outside the skill’s writable scope where supported. - Use least-privilege filesystem permissions and repository review controls. 7. **Add audit and rollback controls** - Commit persistent-context changes separately with their source learning ID. - Keep an append ...[truncated 362 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about maintaining a learning or improvement log: recording failures, corrections, outdated knowledge, and better approaches. The supplied code does something materially different: it creates a filesystem scaffold for a new skill, including a templated SKILL.md file, based on a skill name argument. While the template mentions that the skill was extracted from a learning entry, the script itself does not capture learnings, process corrections, inspect failures, review prior learnings, or update any learning store. Its primary purpose is skill generation/scaffolding, not continuous-improvement knowledge capture. Therefore the description does not accurately represent the code's actual behavior.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation guidance is very broad and matches common agent workflows such as failures, corrections, or discovering better approaches. In practice this can cause over-invocation of a skill that writes persistent logs and updates memory files, increasing the chance of unintended data capture and propagation across sessions.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 73% confidence
• Finding: The skill encourages creation of persistent workspace storage under the user's home directory for cross-session memory. Persistence itself is not always unsafe, but in this skill it amplifies the other data-retention risks by making stored learnings durable and likely to outlive the original context or consent expectations.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: This section explicitly enables inter-session communication and sharing of learnings across sessions, but provides no rules for minimizing, redacting, or blocking sensitive data. That creates a durable confidentiality risk because user content, errors, and context may be copied beyond the original session boundary and exposed to other agents or future sessions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The error template instructs the agent to persist actual error messages, command inputs, parameters, and environment details. Those fields commonly contain secrets, tokens, internal paths, personal data, or proprietary content, so durable logging without sanitization materially increases disclosure risk.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The feature-request template asks for user context and problem details to be stored in a durable file, but does not bound what may be recorded. This can lead to unnecessary retention of sensitive business context, personal information, or confidential plans in plaintext workspace files.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are ordinary conversational language like corrections and feature questions, making accidental invocation likely during normal interaction. Because invocation leads to logging and possible promotion/share actions, these loose triggers can cause persistent retention of sensitive or unnecessary user content without deliberate approval.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: This markdown template tells authors to 'Include trigger conditions' but does not require specific trigger phrases, scope boundaries, or negative examples. Because downstream skills may copy this verbatim, it increases the chance of ambiguous or overly broad activation descriptions that could cause unintended invocation.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The placeholder 'What this skill does and when to use it' is very broad and does not guide authors to define precise invocation conditions. In a template for skill manifests, this can propagate vague triggers into produced skills, especially in short-form descriptions.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: This manifest-style description placeholder again asks only for a general statement of purpose and timing, without requiring clear activation boundaries. For script-backed skills, vague descriptions can be especially risky because they may lead to unintended invocation of executable helpers.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 84% confidence
• Finding: The guide instructs users to create persistent hook configuration in project settings so the behavior survives across sessions. Persistence increases risk because once installed, command hooks continue running automatically, making accidental over-collection, repeated execution, or abuse of later-modified scripts more likely.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: An empty matcher causes the hook to trigger on every prompt, creating overly broad activation for a command-executed script. In this context, that increases exposure to unintended execution, prompt-wide data capture, and operational overhead every time the user interacts with the agent.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The user-level configuration combines a global settings file with an empty matcher, causing the script to run for all prompts across all projects. This is more dangerous than project-local scope because it broadens persistence and increases the chance of sensitive data from unrelated repositories or sessions being exposed to the hook script.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: Although presented as a lower-overhead option, the minimal setup still uses an empty matcher that triggers on every prompt. That preserves the main risk of indiscriminate command execution and broad prompt interception even when fewer hooks are enabled.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The Codex CLI example also uses an empty matcher, extending the same unrestricted trigger pattern to another agent environment. Repeating insecure defaults across tools increases the likelihood that users adopt broad auto-execution without understanding the scope.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document states the hook scripts 'only output text' and 'don't modify files or run commands', but the setup explicitly configures those scripts as shell commands executed by the agent hook system. This is dangerous because it downplays the trust boundary and may cause users to install and run unreviewed scripts with the agent's privileges under a false sense of safety.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 89% confidence
• Finding: The guide instructs users to create persistent `.learnings/` storage in the workspace or skill directory, which can cause potentially sensitive prompts, errors, tool outputs, or corrections to be retained beyond the current session. In a self-improvement skill, this persistence is more dangerous because the stored content may later be re-injected into agent context, amplifying accidental retention of secrets or sensitive operational details.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The 'Detection Triggers' section uses generic conditions such as 'Knowledge gaps', 'API errors', and user corrections, which can occur in many ordinary interactions and do not clearly define boundaries for activation or logging behavior. The file also does not provide exclusion conditions or negative examples to limit when these triggers should or should not apply.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The manifest context describes a skill used to capture learnings, errors, corrections, missing capabilities, and failed operations across multiple situations. This hook file documents only bootstrap-time reminder injection to review `.learnings/` and prompt logging, which is a much narrower behavior than the stated skill purpose and operational scope.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The markdown instructs users to copy directories into `~/.openclaw/skills/` and `~/.openclaw/hooks/` and enable a hook, but it does not warn that these actions change local agent behavior and persistently alter the OpenClaw environment. For a setup guide that affects system-integrity-relevant configuration, a brief user warning would improve safety and transparency.

Static analysis

No suspicious patterns detected.