Security audit

Self Improving Agent Shared

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent self-improvement logger, but it encourages broad persistent memory, prompt-file promotion, hooks on every prompt, and cross-session sharing without enough privacy controls.

Install only if you are comfortable with agents keeping self-improvement notes across sessions. Before enabling hooks or promotion, add a rule to store only sanitized summaries, never secrets, credentials, raw transcripts, customer data, or sensitive file contents; require human approval before writing to AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or Copilot instructions; and avoid global hook activation unless you want reminders on every prompt.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:23
Finding: Conversation-Derived Learnings Can Be Promoted into Persistent Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:23-26`, `SKILL.md:262-289`, `SKILL.md:346-360` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` ```markdown Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable ``` ### Technical Analysis The skill directs agents to derive learnings from conversations, user corrections, errors, and tool behavior, then promote selected content into persistent files such as `SOUL.md`, `AGENTS.md`, `TOOLS.md`, and `CLAUDE.md`. These files can be injected into subsequent sessions and can influence future agent behavior. The promotion criteria focus on recurrence, applicability, and time windows. They do not require validation of the source's trust level, explicit human approval, or a security review of the proposed in ...[truncated 1574 chars]
Remediation: ## Remediation Suggestions 1. Require explicit human approval before writing any conversation-derived rule into persistent agent-context files. 2. Track provenance for every learning, including the originating user, session, task, and supporting evidence. 3. Treat recurrence as supporting evidence only; do not treat it as proof that content is trustworthy. 4. Prohibit promoted rules from changing safety boundaries, authorization requirements, trusted tool definitions, credential handling, or instruction priority. 5. Sanitize and rewrite promoted content instead of copying raw user or tool output. 6. Introduce a review queue that displays the exact proposed change and destination before modification. 7. Limit automatic writes to `.learnings/`; reserve `SOUL.md`, `AGENTS.md`, `TOOLS.md`, and similar prompt files for reviewed changes. 8. Add rollback metadata and an audit log for all promotions.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract-skill.sh:89
Finding: Output-Directory Validation Can Be Bypassed through Symlink Traversal## Vulnerability Details **File Location**: `scripts/extract-skill.sh:89-105`, `scripts/extract-skill.sh:154-158` **Vulnerability Type**: Filesystem path validation weakness **Risk Level**: Medium ### Vulnerable Code Snippet ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" # Check if skill already exists if [ -d "$SKILL_PATH" ] && [ "$DRY_RUN" = false ]; then log_error "Skill already exists: $SKILL_PATH" log_error "Use a different name or remove the existing skill first." exit 1 fi ``` ```bash # Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script attempts to confine writes to the current workspace by rejecting absolute paths and `..` components. This is only lexical validation. It does not resolve the destination to its canonical path and does not reject symbolic links in existing path components. If `./skills` or a user-selected `--output-dir` path is a symbolic link to a location outside the workspace, `mkdir -p` and the shell redirection follow that link. The generated `SKILL.md` is consequently written outside the intended directory boundary. The skill-name validation prevents metacharacter and direct traversal attacks through `SKILL_NAME`, but it does not mitigate symlink-based traversal through `SKILLS_DIR`. ### Attack Path 1. An attacker with write access to the project creates or replaces `skills` with a symbolic ...[truncated 1079 chars]
Remediation: ## Remediation Suggestions 1. Resolve the workspace root and intended destination to canonical paths before writing: ```bash WORKSPACE_ROOT="$(realpath -e .)" PARENT_PATH="$(realpath -m "$SKILLS_DIR")" ``` 2. Verify that the resolved destination is equal to or strictly beneath the canonical workspace root. 3. Reject any existing symbolic link in every destination path component. 4. Create directories one component at a time and verify each with `lstat` or an equivalent no-follow operation. 5. Refuse to overwrite an existing `SKILL.md`, including one reached through a symbolic link. 6. Where supported, create files with no-follow and exclusive-creation semantics. 7. Document that the script must only be run in a trusted workspace, while retaining technical enforcement rather than relying solely on documentation. 8. Add automated tests covering a symlinked `skills` directory and symlinks inside `--output-dir`.

T09 · Insecure Skill Coding Practices

Note

Location: hooks/openclaw/handler.js:25
Finding: Shipped JavaScript Hook Omits the TypeScript Sub-Agent Exclusion## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:25-52`; comparison source at `hooks/openclaw/handler.ts:43-48` **Vulnerability Type**: Runtime/source security-control divergence **Risk Level**: Low ### Vulnerable Code Snippet The TypeScript source contains an intended sub-agent exclusion: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } ``` The shipped JavaScript runtime proceeds directly from context validation to injection and omits that check: ```javascript const handler = async (event) => { // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` ### Technical Analysis The TypeScript source explicitly excludes session keys containing `:subagent:`, but the corresponding JavaScript implementation does not. If OpenClaw loads `handler.js`, the effective runtime behavior is broader than the reviewed TypeScript behavior. This is a source-to-artifact integrity problem. Security and behavior checks performed against the TypeScript source do not accurately describe the shipped runtime. The current injected payload is a static self-improvement reminder and does not contain an explicit safe ...[truncated 1043 chars]
Remediation: ## Remediation Suggestions 1. Regenerate `handler.js` from `handler.ts` so the runtime includes the sub-agent exclusion. 2. Use a single authoritative source and avoid manually maintaining parallel implementations. 3. Add a build or continuous-integration check that fails when committed JavaScript differs from compiled TypeScript. 4. Add tests confirming that normal bootstrap events receive the reminder and `:subagent:` sessions do not. 5. Document which file OpenClaw executes so reviewers can audit the effective runtime artifact. 6. Consider distributing only the authoritative runtime file or compiling it during a reproducible release process.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about recording and reviewing learnings from failures, corrections, outdated knowledge, and better approaches. The supplied code does not implement a learning capture or review mechanism. Instead, it is a helper script for creating a new skill scaffold from a learning entry by making directories and writing a templated SKILL.md file. While related at a high level to 'learnings' becoming skills, the primary behavior is materially different from the declared purpose, so this is a clear mismatch.

Ssd 3

High

Confidence: 96% confidence
Finding: The inter-session communication and promotion guidance encourages transmitting learnings between sessions and elevating them into long-term context files without any confidentiality controls. This increases blast radius by turning a single-session disclosure into cross-session, potentially multi-agent persistence.

Ssd 3

High

Confidence: 97% confidence
Finding: The templates direct recording of full context, input parameters, error output, and user needs in plain markdown. Those fields can easily capture API keys, file paths, proprietary code details, customer data, or sensitive operational context, creating a durable disclosure risk.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The 'Use when' list includes broad triggers such as any unexpected command failure, any user correction, any missing capability request, and any realization that knowledge is outdated. These conditions are common across many sessions and do not clearly constrain when this skill should activate versus when ordinary handling is sufficient, increasing the risk of unintended or excessive invocation.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to persist corrections, requests, and task learnings into shared logs and to promote them into broader memory files. Without data minimization, consent, or redaction rules, this can retain sensitive user content and propagate it across future sessions or agents.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 89% confidence
Finding: The skill instructs creation of persistent workspace storage under the user's home directory, which creates session persistence and expands the lifetime of collected data. Persistence alone is not always unsafe, but in this skill it compounds the documented retention of conversational and operational details.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Phrases like 'Can you also...', 'Is there a way to...', and conditions like 'Unexpected output or behavior' are broad and likely to occur in ordinary interaction unrelated to durable learnings. The section labels these as automatic logging triggers without enough specificity or exclusion criteria, which could cause over-triggering.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The manifest describes this skill as capturing learnings, errors, and corrections for continuous improvement, plus reviewing learnings before major tasks. This section adds a separate capability to generate new reusable skills and create new skill directories/files, which is not an obvious or necessary part of merely logging and promoting learnings.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: This markdown file defines `"matcher": ""` for `UserPromptSubmit`, which means the hook activates for any prompt rather than a narrowly scoped condition. That broad trigger overlaps with ordinary usage and does not provide exclusion conditions or examples to limit when the skill should run.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The guide instructs users to add the hook to `~/.claude/settings.json` for global activation while also using an empty matcher. This combines system-wide scope with no trigger specificity, increasing the chance of unintended invocation during normal interactions.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The Codex configuration repeats the same `"matcher": ""` pattern, so the hook would activate on all prompts without clear boundaries. The file does not pair this broad trigger with negative examples or constraints that would reduce accidental invocation.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 90% confidence
Finding: The instructions direct users to create a persistent `.learnings/` directory in the workspace or skill directory, enabling retention of model-derived notes across sessions without any retention limits, sensitivity checks, or warnings. In the context of a self-improvement skill, persistent memory is core functionality, but it becomes a security/privacy weakness when the documentation does not constrain what may be stored there.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly encourages promoting learnings from ephemeral notes into persistent workspace files such as SOUL.md, TOOLS.md, and AGENTS.md without any guidance to sanitize or minimize content. Because learnings may originate from failures, user corrections, API errors, or session context, this can cause sensitive prompts, secrets, internal paths, or private user data to be retained long-term and re-injected into future sessions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file documents cross-session transcript reading, message passing, and spawning without any warning about privacy boundaries, authorization, or content minimization. In a self-improvement skill, this is more dangerous because session content is likely to include errors, corrections, and operational context that may contain sensitive information, which can then be propagated across sessions unnecessarily.

Static analysis

No suspicious patterns detected.