Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Claude ('No, that's wrong...', 'Actually...'), (3) User requests a capability that doesn't exist, (4) An external API or tool fails, (5) Claude realizes its knowledge is outdated or incorrect, (6) A better approach is discovered for a recurring task. Also review learnings before major tasks.

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:39 AM UTC
• Version: 1.0.0

Overview

The skill is a self-improvement memory logger, but it encourages broad automatic logging and lasting changes to future agent instructions without enough approval or redaction safeguards.

Install only if you want an agent to keep durable learning logs and potentially update future agent instruction files. Keep hooks project-scoped, avoid empty global matchers, review every proposed log and promotion, redact secrets and personal or business-sensitive context, and require explicit approval before writing to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or copilot instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:346

Finding

Conversation-Derived Rules Can Poison Persistent Agent Context

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` `SKILL.md:443-448`: ```markdown 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` `hooks/openclaw/handler.ts:21-24`: ```typescript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` `hooks/openclaw/handler.ts:54-59`: ```typescript event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); ``` ### Technical Analysis The skill instructs the agent to capture corrections, discoveries, and other conversation-derived information and later promote those entries into persistent agent instruction files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md`. These files can be loaded as trusted context in future sessions. The promotion process does not def ...[truncated 3173 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about maintaining a learning or improvement log: recording failures, corrections, outdated knowledge, and better approaches. The supplied code does something materially different: it creates a filesystem scaffold for a new skill, including a templated SKILL.md file, based on a skill name argument. While the template mentions that the skill was extracted from a learning entry, the script itself does not capture learnings, process corrections, inspect failures, review prior learnings, or update any learning store. Its primary purpose is skill generation/scaffolding, not continuous-improvement knowledge capture. Therefore the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation guidance is very broad and matches common agent workflows such as failures, corrections, or discovering better approaches. In practice this can cause over-invocation of a skill that writes persistent logs and updates memory files, increasing the chance of unintended data capture and propagation across sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 73% confidence

Finding

The skill encourages creation of persistent workspace storage under the user's home directory for cross-session memory. Persistence itself is not always unsafe, but in this skill it amplifies the other data-retention risks by making stored learnings durable and likely to outlive the original context or consent expectations.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section explicitly enables inter-session communication and sharing of learnings across sessions, but provides no rules for minimizing, redacting, or blocking sensitive data. That creates a durable confidentiality risk because user content, errors, and context may be copied beyond the original session boundary and exposed to other agents or future sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The error template instructs the agent to persist actual error messages, command inputs, parameters, and environment details. Those fields commonly contain secrets, tokens, internal paths, personal data, or proprietary content, so durable logging without sanitization materially increases disclosure risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The feature-request template asks for user context and problem details to be stored in a durable file, but does not bound what may be recorded. This can lead to unnecessary retention of sensitive business context, personal information, or confidential plans in plaintext workspace files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are ordinary conversational language like corrections and feature questions, making accidental invocation likely during normal interaction. Because invocation leads to logging and possible promotion/share actions, these loose triggers can cause persistent retention of sensitive or unnecessary user content without deliberate approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown template tells authors to 'Include trigger conditions' but does not require specific trigger phrases, scope boundaries, or negative examples. Because downstream skills may copy this verbatim, it increases the chance of ambiguous or overly broad activation descriptions that could cause unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The placeholder 'What this skill does and when to use it' is very broad and does not guide authors to define precise invocation conditions. In a template for skill manifests, this can propagate vague triggers into produced skills, especially in short-form descriptions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This manifest-style description placeholder again asks only for a general statement of purpose and timing, without requiring clear activation boundaries. For script-backed skills, vague descriptions can be especially risky because they may lead to unintended invocation of executable helpers.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The guide instructs users to create persistent hook configuration in project settings so the behavior survives across sessions. Persistence increases risk because once installed, command hooks continue running automatically, making accidental over-collection, repeated execution, or abuse of later-modified scripts more likely.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

An empty matcher causes the hook to trigger on every prompt, creating overly broad activation for a command-executed script. In this context, that increases exposure to unintended execution, prompt-wide data capture, and operational overhead every time the user interacts with the agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The user-level configuration combines a global settings file with an empty matcher, causing the script to run for all prompts across all projects. This is more dangerous than project-local scope because it broadens persistence and increases the chance of sensitive data from unrelated repositories or sessions being exposed to the hook script.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Although presented as a lower-overhead option, the minimal setup still uses an empty matcher that triggers on every prompt. That preserves the main risk of indiscriminate command execution and broad prompt interception even when fewer hooks are enabled.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Codex CLI example also uses an empty matcher, extending the same unrestricted trigger pattern to another agent environment. Repeating insecure defaults across tools increases the likelihood that users adopt broad auto-execution without understanding the scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states the hook scripts 'only output text' and 'don't modify files or run commands', but the setup explicitly configures those scripts as shell commands executed by the agent hook system. This is dangerous because it downplays the trust boundary and may cause users to install and run unreviewed scripts with the agent's privileges under a false sense of safety.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The guide instructs users to create persistent .learnings/ storage in the workspace or skill directory, which can cause potentially sensitive prompts, errors, tool outputs, or corrections to be retained beyond the current session. In a self-improvement skill, this persistence is more dangerous because the stored content may later be re-injected into agent context, amplifying accidental retention of secrets or sensitive operational details.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'Detection Triggers' section uses generic conditions such as 'Knowledge gaps', 'API errors', and user corrections, which can occur in many ordinary interactions and do not clearly define boundaries for activation or logging behavior. The file also does not provide exclusion conditions or negative examples to limit when these triggers should or should not apply.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest context describes a skill used to capture learnings, errors, corrections, missing capabilities, and failed operations across multiple situations. This hook file documents only bootstrap-time reminder injection to review .learnings/ and prompt logging, which is a much narrower behavior than the stated skill purpose and operational scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The markdown instructs users to copy directories into ~/.openclaw/skills/ and ~/.openclaw/hooks/ and enable a hook, but it does not warn that these actions change local agent behavior and persistently alter the OpenClaw environment. For a setup guide that affects system-integrity-relevant configuration, a brief user warning would improve safety and transparency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.