perrytest

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:22 PM UTC
• Version: 1.0.0

Overview

This self-improvement skill is not clearly malicious, but it needs review because it can persist and share conversation-derived content in ways that affect future agent sessions.

Install only if you want an agent memory and learning-log workflow, and keep it project-scoped where possible. Review every learning before it is written or promoted, avoid storing raw prompts, secrets, customer data, stack traces, or transcripts, and be especially cautious with global hooks and cross-session transcript or messaging features.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:343

Finding

Untrusted Session Content Can Poison Persistent Agent Instructions

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` Related promotion instructions also appear at `SKILL.md:23-26`, `SKILL.md:269-289`, and `references/openclaw-integration.md:116-142`. ### Technical Analysis The Skill directs the agent to convert session-derived corrections, user feedback, errors, and behavioral observations into persistent instruction files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, and `TOOLS.md`. These files are subsequently injected into future agent sessions and treated as operational guidance. The recurrence threshold is not a security boundary. An attacker can repeat the same malicious correction across multiple tasks until it qualifies for promotion. The workflow does not require: - Verification that the source is trusted. - Explicit approval from an authorized workspace owner. - Separation of quoted observations from executable agent instructions. - Review for prompt injection or unsafe tool-use directives. - Restrictions preventing modifications to security, authorization, or data-handling rules. Consequently, attacker-controlled conversational content can become durable agent policy. ### Attack Path 1. An attacker submits a crafted correction or alleged workflow rule during a normal session. 2. The agent records it in `.learnings/LEARNINGS.md`. 3. The attacker repeats the sa ...[truncated 1011 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/openclaw-integration.md:159

Finding

Cross-Session Transcript Access and Messaging Lack Trust-Boundary Controls

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Manual Installation Uses an Unpinned Mutable Repository Source

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:100

Finding

Output Directory Validation Can Be Bypassed Through Symbolic Links

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script attempts to confine output to the current workspace by rejecting absolute paths and lexical `..` components. It does not resolve symbolic links before creating the destination. A relative path can pass both checks while an existing path component is a symbolic link to a directory outside the workspace. `mkdir -p` and shell redirection follow that symbolic link, allowing creation or replacement of `SKILL.md` beneath the external target. The skill-name validation limits the final directory name to lowercase letters, digits, and hyphens, but it does not address symlink traversal in `SKILLS_DIR`. ### Attack Path 1. An attacker who can modify the workspace creates a relative symbolic link: ```bash ln -s /external/writable/path safe-output ``` 2. The victim or agent runs: ```bash ./scripts/extract-skill.sh injected-skill --output-dir safe-output ``` 3. `safe-output` is relative and ...[truncated 722 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is about a meta-skill for recording and reviewing learnings after failures, corrections, or discoveries. The supplied code does not capture learnings, monitor failures, review prior learnings, or update a learning store. Instead, it is a filesystem-oriented helper that creates a new skill scaffold from a skill name, including directory creation and template file generation. While the comments mention creating a skill from a learning entry, the implementation primarily scaffolds a skill file and does not implement the declared continuous-improvement behavior. This is a material purpose mismatch, not just an implementation detail.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The cross-session tooling explicitly allows reading another session's transcript and sending learnings between sessions, which creates a direct path for disclosure of prior-session content. In a memory/logging skill, this is especially dangerous because it normalizes movement of potentially sensitive context beyond the originating session boundary.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The error template directs logging of actual error output, inputs, and environment details, all of which commonly contain secrets, API keys, file paths, hostnames, stack traces, or customer data. Persisting that information in markdown files creates a durable disclosure surface and may expose secrets to future sessions, repositories, or teammates.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 92% confidence

Finding

Writing hook configuration into ~/.claude/settings.json places executable hook behavior in an agent config directory that affects future sessions globally. If a malicious or unsafe script path is inserted there, it can persist and execute automatically in unrelated contexts, increasing privilege and persistence concerns.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

The documented sessions_send capability enables information to be transmitted across sessions, creating a real cross-context exfiltration channel if sensitive workspace data, prompts, or secrets are included in a 'learning' message. In a prompt-injection-heavy environment like OpenClaw, normalizing inter-session messaging without strict data-classification rules increases the risk that adversarial content persuades the agent to relay confidential information elsewhere.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill when a user corrects the agent, when a capability doesn't exist, when an external tool fails, and to 'also review learnings before major tasks.' These conditions are expansive and lack clear boundaries or exclusion cases, so the skill could be invoked during a wide range of normal conversations and routine work.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs persistent logging of learnings and errors and later promotion into broader memory files, which creates a durable record of conversation-derived content. Without mandatory minimization or redaction rules, this can leak sensitive user information across future sessions, collaborators, or tools that read those files.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow tells the agent to log user corrections, missing features, and API/tool failures into persistent files as a routine action, but it does not require consent, redaction, or sensitivity screening. That makes it easy for private user statements, business context, or operational details to be retained unnecessarily.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The learning template asks for full context, details, related files, and metadata from conversations, encouraging rich persistence of material that may contain sensitive information. Because the template is normative, users or agents may store far more than is necessary to preserve the lesson.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Feature-request logging preserves the user's requested capability and contextual motivation, which may reveal internal priorities, product plans, or personal/business needs. Making that persistence routine without minimization or consent introduces unnecessary retention of potentially confidential information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list is so broad that it can cause automatic logging of routine user messages, corrections, and newly provided information into persistent storage. In this skill's context, over-triggering is security-relevant because it materially increases the chance that sensitive user content is retained or propagated without deliberate review.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Automatic triggers for corrections, knowledge gaps, and feature requests create standing retention of user-supplied content whenever the agent notices it. This is dangerous because it converts ordinary conversation into persistent memory without a clear necessity, consent boundary, or sensitivity filter.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

Project-level hook setup in .claude/settings.json introduces session-persistent behavior that automatically reappears on future agent runs in the repository. While not inherently malicious, persistence of automatic command hooks can surprise users, survive context changes, and continue triggering after the original need has passed.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

An empty matcher causes the activator to run on every prompt, creating broad, automatic execution without meaningful scoping. That increases exposure to unintended behavior, prompt-surface amplification, and operational risk because any session interaction triggers the hook regardless of task sensitivity or need.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The user-level configuration installs the hook in ~/.claude/settings.json for global activation, so the script runs across all projects and sessions rather than a single repository. That widens blast radius and makes accidental persistence of a risky or buggy hook more dangerous.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation states the scripts only output text and do not run commands, but the very hook configuration shown uses command-type hooks that execute shell scripts, and the extract script is explicitly invoked from Bash. This misrepresents the trust boundary and can cause operators to enable auto-executed scripts with fewer precautions than they otherwise would.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

Persistent storage of .learnings/ in the workspace or skill directory creates a memory surface that can retain sensitive prompts, failures, environment details, or user-provided data beyond the current session. In an injection-prone system, attacker-influenced content can be written into durable memory and later reintroduced into future sessions, enabling persistence of malicious instructions or privacy leakage.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger 'User corrections ("No, that's wrong...")' is presented as a standard activation condition without clear boundaries. Ordinary back-and-forth corrections are common in conversation, so this wording can lead to unintended or excessive triggering unless narrowed further.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file defines detection triggers, and 'Knowledge gaps' does not specify what observable condition qualifies or when the trigger should not apply. Because it is a common and subjective condition in normal interactions, it risks overly broad invocation of the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.