Self-Evolving Agent (Lorin)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:43 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a self-learning reminder and scaffolding package, but it can persist agent guidance across sessions and modify skill/instruction files without enough scoping, review, or privacy safeguards.

Install only if you want a persistent self-improvement workflow and are willing to review what it records. Prefer project-local hooks, avoid the global ~/.claude/settings.json setup, use narrow matchers, sanitize logs for secrets and private data, require explicit approval before promoting anything into agent instruction files or new skills, and replace the rm -rf deletion pattern with archival or manual removal.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: hooks/openclaw/handler.js:8

Finding

Persistent poisoning of agent behavior and long-term state through promoted learnings

Content

View full analysis

{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` ### Technical Analysis The bootstrap hook injects standing instructions that encourage the agent to capture information originating from user corrections, failures, and observed workflows, and then promote that information into `SOUL.md`, `AGENTS.md`, and `TOOLS.md`. The main skill also identifies `MEMORY.md` and newly generated skil ...[truncated 1654 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: hooks/openclaw/handler.js:29

Finding

Runtime JavaScript omits the sub-agent exclusion implemented in TypeScript

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:91

Finding

Lexical path validation permits output-directory escape through symbolic links

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script rejects absolute paths and explicit `..` segments, but it only validates the textual form of `SKILLS_DIR`. It does not resolve the canonical destination or verify that every path component is a real directory beneath the current workspace. A relative path such as `./skills` can therefore pass validation while being a symbolic link to a location outside the workspace. `mkdir -p` and shell redirection follow symbolic links, allowing `SKILL.md` to be created outside the intended boundary. The skill name itself is constrained to lowercase letters, digits, and hyphens, so direct command injection through `SKILL_NAME` was not identified. ### Attack Path 1. An attacker with write access to the workspace creates `./skills`, or another permitted output path component, as a symbolic link to an external directory. 2. A user o ...[truncated 876 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

声明描述的是一个具备主动、自主改进能力的系统，核心能力包括自动记录错误、总结经验并生成新的技能。而实际代码只是一个 hook：监听 agent:bootstrap 事件，并注入一段静态提醒文本到虚拟文件中。它没有监控任务执行、没有捕获失败事件、没有分析或提炼经验、没有写入任何学习文件，也没有生成或修改 skill 文件。触发方式也与宣称的持续进化能力不匹配：代码只在 bootstrap 时运行一次，而非在错误发生或任务完成时自动处理。因此描述显著夸大了实际功能，存在明显不符。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description promises a broader autonomous self-improvement system: automatic error capture, proactive lesson extraction, and automatic SKILL generation. The supplied code only performs lightweight error-pattern detection on tool output and prints advisory text encouraging manual logging. It does not actually record errors, summarize lessons, or generate any SKILL artifacts. This is a material description-to-behavior mismatch, not just an implementation detail. Additionally, the code comments indicate a PostToolUse hook for Bash, while the declared triggers are empty.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明描述的是一个具备较强自治能力的系统：能够自动发现错误、总结学习经验，并进一步自动产出技能，实现持续自我改进。但提供的代码只完成了其中非常有限的一部分，而且还是手动执行的模板脚手架创建功能。它不会监控或捕获错误，不会解析学习记录或提炼经验，也不会基于实际错误/学习内容自动生成完整技能内容；生成的只是带有 TODO 的 SKILL.md 模板。尽管脚本中的注释提到“from a learning entry”，但并没有读取任何 learning 文件或执行提炼逻辑。因此，代码的实际主要用途与声明的核心能力明显不符，属于实质性描述不匹配。

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The full rm -rf ~/.openclaw/workspace/skills/// command is a real destructive primitive, not merely a theoretical concern. Because the skill encourages autonomous skill lifecycle management, including this command without hard safety controls materially raises the chance of accidental or over-broad deletion.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

当 Skill 不再适用时：

bash

rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/

4. Skill 提取自动化

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The full rm -rf ~/.openclaw/workspace/skills/// command is a real destructive primitive, not merely a theoretical concern. Because the skill encourages autonomous skill lifecycle management, including this command without hard safety controls materially raises the chance of accidental or over-broad deletion.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

当 Skill 不再适用时：

bash

rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/

4. Skill 提取自动化

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The full rm -rf ~/.openclaw/workspace/skills/// command is a real destructive primitive, not merely a theoretical concern. Because the skill encourages autonomous skill lifecycle management, including this command without hard safety controls materially raises the chance of accidental or over-broad deletion.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

当 Skill 不再适用时：

bash

rm -rf ~/.openclaw/workspace/skills/<category>/<skill-name>/

4. Skill 提取自动化

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The guidance instructs users to modify ~/.claude/settings.json, which is a sensitive agent configuration location controlling behavior across sessions. Writing persistent command hooks into a global config increases the blast radius of mistakes or malicious script changes and creates durable agent-level influence.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 181)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Instructing the agent to persist user corrections and contextual details into learning logs risks storing sensitive user-provided data beyond the original interaction. Because corrections often include exact prompts, examples, or operational details, durable logging can create secondary disclosure channels.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages automatic logging of errors, task context, commands, and related details into local files but provides no privacy or data-handling constraints. This can persist secrets, tokens, proprietary content, and user-sensitive data into durable plaintext artifacts that may later be exposed or reused unsafely.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The learning log template explicitly asks for complete context and source conversation details, which normalizes copying user content into persistent files. This increases the risk of retaining confidential prompts, proprietary code, or personal information in a location that may not have equivalent access controls.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The error log format directs storage of actual error messages, attempted commands, and inputs/parameters, all of which frequently contain credentials, file paths, tokens, internal hostnames, or customer data. In operational environments this can create a durable plaintext secret leak that is easy to overlook and difficult to fully scrub later.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents destructive deletion of entire skill directories using rm -rf, which exceeds the narrow need of learning/logging and can permanently erase data if parameters are wrong or expanded unexpectedly. In an agent setting, even documented destructive patterns are risky because downstream automation may execute them without adequate review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Presenting rm -rf deletion instructions without warnings, confirmations, or rollback guidance creates a sharp edge for accidental destructive actions. In an agent context, omission of safety gates materially increases the chance of irreversible loss from path mistakes or over-broad substitutions.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 74% confidence

Finding

The documentation promotes creating persistent hook configuration in .claude/settings.json, causing behavior to survive across future sessions in the project. In this skill's context, session persistence is security-relevant because it establishes durable automatic execution/influence rather than a one-time manual action.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

An empty matcher causes the hook to run on every prompt, creating a very broad automatic trigger surface. In a self-improving agent context, that can inject persistent unsolicited behavior into all interactions and increase exposure to sensitive prompt content or unintended side effects from the hooked script.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Placing an always-on command hook in ~/.claude/settings.json enables broad automatic execution across all sessions and repositories. This amplifies risk because a single trusted script path gains persistent access to future prompts and agent activity, potentially affecting unrelated work and sensitive contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Codex CLI example repeats the empty matcher pattern, so the hook activates for all prompts in that environment as well. This broadens the operational footprint of the self-improvement mechanism and can cause unintended prompt inspection or persistent workflow modification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document states that hook scripts 'only output text' and 'don't modify files or run commands,' but the configuration explicitly invokes shell scripts via command hooks. That contradiction can mislead users into underestimating the trust boundary and privileges of the hooked scripts, increasing the chance they enable code execution they would otherwise scrutinize.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The documentation directs users to create a persistent .learnings directory for ongoing storage of agent-derived information without discussing retention, sensitivity, or poisoning risk. Because OpenClaw injects workspace context at session start, persisted learnings may later influence model behavior, causing both privacy leakage and long-lived prompt injection from previously logged content.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide explicitly instructs the agent to persist learnings into workspace files and promote them into AGENTS.md, SOUL.md, and TOOLS.md, but it does not warn that these files may accumulate sensitive data from prompts, errors, tool output, or cross-session context. In a prompt-injected workspace system, persistent files also become future injected context, so unsafe logging can both leak data and reinforce poisoned instructions across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed triggers include broad conditions like "Knowledge gaps," "API errors," and generic user corrections, without defining scope, thresholds, or exclusion cases. Because this is a markdown file and these are activation-like conditions for the skill's behavior, the lack of specificity could lead to the skill activating in many ordinary situations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill content, examples, headings, and prescribed formats are written as Chinese-first operational instructions, with no indication that users may choose another language or locale. This creates a natural-language policy concern because the skill appears to impose a specific language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Although presented as a 'minimal' setup, the empty matcher still makes the activator run for every prompt. The lower complexity reduces moving parts, but it still creates broad, persistent behavioral injection that may capture or influence all interactions in the project.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:276