T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:178- Finding
Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent 1 0 2 Litiao
Security checks for vulnerabilities and agentic risk
Overview
This self-improvement skill is mostly disclosed, but it broadly persists and shares learned conversation data without enough consent, scoping, or redaction controls.
Install only if you intentionally want persistent self-improvement memory. Prefer project-local setup, avoid the global hook, replace empty matchers with narrow triggers, review every write to agent instruction files, and do not log or send secrets, personal data, full transcripts, credentials, or sensitive business context.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/activator.sh:9- Finding
Broad Prompt Hook Creates a Persistent Agent-Context Injection Channel
- Content
View full analysis
After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. EOF ``` The setup guide also supports user-level activation: ```json { "hooks": { "UserPromptSubmit": [ { "matcher": "", "hooks": [ { "type": "command", "command": "~/.claude/skills/self-improvement/scripts/activator.sh" } ] } ] } } ``` ### Technical Analysis An empty `UserPromptSubmit` matcher causes `activator.sh` to execute for every prompt rather than only when the self-improvement skill is explicitly invoked. Its output is intentionally inserted as agent context and is described as “system context.” The current script contains a benign learning reminder and does not override safety controls. Nevertheless, the configuration establishes a persistent instruction-injection mechanism with the following security properties: - It execut ...[truncated 1714 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/clawdbot-integration.md:158- Finding
Cross-Session Transcript Access and Learning Propagation Lack Privacy Controls
- Content
View full analysis
--last 50 ``` ### sessions_send Send message to another session: ``` sessions_send --to --message "Learning: API requires X-Custom-Header" ``` ### Learning Sharing Pattern When discovering something valuable in session A: 1. Check if other sessions are working on related code: ``` sessions_list --active ``` 2. Share the learning: ``` sessions_send --to session-b --message "FYI: Discovered that the auth API requires refresh tokens every 30min" ``` 3. Log to workspace file if broadly applicable: - Edit `~/clawd/TOOLS.md` or appropriate file ``` The main skill summarizes these capabilities as follows: ```markdown - **sessions_list** - See active/recent sessions - **sessions_history** - Read transcript from another session - **sessions_send** - Send message to another session ``` ### Technical Analysis The integration instructs agents to enumerate sessions, read another session's transcript, and send learning messages across session boundaries. These operations can be legitimate when all sessions share the same owner and trust domain, but the documented workflow does not require: - Consent from the source or destination session owner. - Verification that sessions belong to the same user, project, or security domain. - Least-privilege authorization checks. - Redaction of credentials, personal data, proprietary source code, or customer information. - Classification of cross-session messages as untrusted. - Validation be ...[truncated 1800 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The code only performs narrow error detection on tool output and emits a logging reminder. The declared description presents a much broader continuous-improvement skill covering multiple situations beyond command failures, plus reviewing learnings before major tasks. That breadth is not reflected in the supplied code. Additionally, the code is explicitly a PostToolUse Bash hook despite no triggers being declared, and it references a specific filesystem location for logging. This is a material description-behavior mismatch rather than a mere implementation detail.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about recording learnings, failures, corrections, and other improvement signals for later review. The provided code does not capture, store, review, or analyze learnings/errors. Instead, it is a command-line helper that scaffolds a new skill on disk by creating a directory and writing a templated SKILL.md file. This is a materially different primary purpose and includes undeclared filesystem-writing capabilities. While it references 'learning entry' in comments/template text, its actual function is skill extraction/scaffolding, not continuous-improvement logging or retrieval.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 97% confidence
- Finding
The documented
sessions_sendcapability creates an outbound communication path to other sessions, which is effectively a data exfiltration channel if populated with sensitive context from the current session. Combined with transcript-reading features and broad logging guidance, this increases the risk of unauthorized lateral sharing of confidential information.- Content
md Clawdbot supports session-based communication: - **sessions_list** - See active/recent sessions - **sessions_history** - Read transcript from another session - **sessions_send** - Send message to another session ### Hybrid Setup (Claude Code + Clawdbot)
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
The documented
sessions_sendcapability creates an explicit channel for transferring information to other sessions, but the guide provides no safeguards on what may be sent. In the context of prompt-injected workspace files and multi-agent coordination, this can facilitate exfiltration of secrets or sensitive context to unintended recipients or compromised sessions.- Content
sessions_send
Send message to another session:
text sessions_send --to <session-id> --message "Learning: API requires X-Custom-Header"
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Directing users to modify ~/.claude/settings.json introduces agent configuration directory persistence, which is powerful because it changes default agent behavior across sessions. In the context of a self-improving hook that executes local scripts, this is more dangerous than a one-off project setting because it creates a durable, wide-scope execution path.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says to use the skill when a user corrects the agent, when a capability doesn't exist, when a better approach is discovered, and to 'also review learnings before major tasks.' Several of these conditions are broad and subjective, making it unclear when the skill should activate versus when it should not, which increases the risk of unintended invocation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The templates direct agents to record full details, user context, related files, and conversation-derived metadata, which materially increases the risk of persisting sensitive information. In practice, this can turn ordinary interactions into a repository of confidential prompts, business logic, file paths, or credentials if users or tools surface them during troubleshooting.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Common conversational phrases like corrections or casual requests are used as triggers for persistent logging, which can capture user content unexpectedly. Because the skill promotes immediate recording and later promotion to shared memory, ambiguous triggers increase the chance of storing sensitive or unnecessary data without clear consent.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages persistent logging and promotion of user-provided conversation content into shared memory files without any sanitization, minimization, or consent controls. This can lead to long-term retention and broader dissemination of secrets, personal data, internal URLs, credentials, or confidential business context.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Extraction Workflow
- Identify candidate: Learning meets extraction criteria
- Run helper (or create manually):
bash ./skills/self-improvement/scripts/extract-skill.sh skill-name --dry-run ./skills/self-improvement/scripts/extract-skill.sh skill-name
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs agents to read other session transcripts and send inter-agent messages, which can expose unrelated conversation data beyond the self-improvement purpose. In a multi-agent environment, this expands access to potentially sensitive context and creates a data-sharing channel that may violate least privilege.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide describes reading other sessions' transcripts and sending cross-session messages without any warning about sensitive data, authorization boundaries, or user consent. In a workspace-injection model, this can normalize lateral data access between sessions and increase the chance of leaking secrets, proprietary code, or private user context across tasks.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
Project-level hook configuration establishes session-persistent automated behavior that will continue to run in future agent sessions until removed. While this is a documented feature rather than covert persistence, it still has security relevance because it can silently reintroduce script execution and prompt-related processing over time.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
An empty matcher causes the activator hook to run on every prompt, expanding execution scope to all interactions rather than only relevant troubleshooting or learning scenarios. In this skill context, that increases exposure to unintended prompt capture, excessive automation, and execution of local scripts more often than necessary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-level configuration installs the hook in ~/.claude/settings.json, causing it to activate across all projects and sessions. That broad persistence magnifies the impact of any buggy, overreaching, or later-modified script because it executes in many more contexts than a project-local setup.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The Codex example also uses an empty matcher, so the hook may trigger for every prompt or an otherwise broad set of interactions depending on the client behavior. This creates unnecessary execution frequency and makes the operational scope ambiguous to users reviewing the setup instructions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document claims the hook scripts only output text and do not run commands, but the examples configure those scripts as shell commands executed by the agent hook system. This mismatch can cause users to underestimate the trust and execution risk of the scripts, leading them to install and run unreviewed code with agent permissions.
- Content
Static analysis
No suspicious patterns detected.