Self-Improvement Agent

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:47 PM UTC
• Version: 1.0.0

Overview

The skill is openly about self-improvement, but it encourages persistent agent memory, prompt-file changes, global hooks, and cross-session transcript use without enough consent or scoping.

Review this skill before installing on sensitive projects. Use it only if you are comfortable with persistent learning files and agent-memory changes, avoid global hooks, require explicit approval before reading other sessions or promoting anything into prompt/control files, and redact secrets, personal data, proprietary details, and raw error output from stored learnings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:24

Finding

Untrusted Session Learnings Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

Project uses pnpm workspaces. `npm install` fails because lock file is `pnpm-lock.yaml`. Promote to `CLAUDE.md`: ```markdown ## Build & Dependencies - Package manager: **pnpm** (not npm) — always use `pnpm install` ``` ## Recurring Pattern Detection Before logging, search for related entries: ```bash grep -r "keyword" .learnings/ ``` If similar entry exists: - Link with `**See Also**: LRN-...` - Increment `Recurrence-Count` - Consider systemic fix (promote to AGENTS.md, create tech debt ticket) **Promote to permanent prompt guidance** when a pattern: - Occurs 3+ times - Spans 2+ distinct tasks - Within a 30-day window ``` Related behavior also appears in: - `references/openclaw-integration.md:65-143` - `references/other-agents.md:34-68` - `assets/LEARNINGS.md:9-18` ### Technical Analysis The Skill treats user corrections, command failures, tool output, and conversational observations as sources of reusable learning. It then directs the agent to promote selected learning into files such as `SOUL.md`, `AGENTS.md`, `TOOLS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md`. These files are not passive logs. They are commonly loaded as agent instructions in later sessions and can influence beha ...[truncated 1892 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: hooks/openclaw/handler.js:9

Finding

Bootstrap and Per-Prompt Hooks Inject Persistent Self-Modification Instructions

Content

View full analysis

After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. EOF ``` Hook installation is documented in `references/hooks-setup.md:7-67` and `references/openclaw-integration.md:43-55`. ### Technical Analysis The OpenClaw handler modifies the agent bootstrap context by appending a virtual instruction file before workspace files are injected. The ...[truncated 2326 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:161

Finding

Cross-Session Transcript Access Is Encouraged Without Consent or Data-Minimization Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about detecting and recording learnings, errors, corrections, and other improvement signals. The supplied code does not implement that behavior. Instead, it is a standalone shell utility for creating a new skill scaffold (<skills>/<skill-name>/SKILL.md) from a template. Its primary purpose is materially different: skill extraction/scaffolding rather than learning capture or review. While the template mentions a source learning and .learnings/LEARNINGS.md, the script does not actually inspect, parse, or update learnings; it only writes boilerplate text. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Cross-session history review and sharing creates a direct pathway for one session's content to be exposed to another without clear access boundaries or sensitivity checks. In the context of a 'self-improving' memory skill, this is especially dangerous because it normalizes moving conversational data across contexts and persisting it further.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Instructing users to modify ~/.claude/settings.json places the hook in a persistent agent configuration directory, extending trust from one project to the entire local agent environment. If the referenced script path or repository contents are later altered, the agent will continue executing the hook automatically in future sessions.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Broad trigger phrases like 'actually', 'wrong', or 'why can't you' are common in normal conversation and can cause unintended activation. In a skill that persists content, accidental triggering can lead to unnecessary data retention, noisy memory, and increased chances of storing sensitive context without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description does not clearly disclose that it may persist user corrections, errors, contextual details, and potentially review other session transcripts. This lack of notice undermines informed consent and increases the risk that sensitive information is stored or reused unexpectedly.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template directs storing full context, error output, file paths, and metadata in persistent markdown. Those fields can easily contain secrets, tokens, proprietary code fragments, personal data, or sensitive operational details, creating durable natural-language leakage in workspace memory.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Feature request logging asks for the user's requested capability and context in persistent records, which can capture business intent, personal needs, or confidential project information. Even when non-malicious, persistent accumulation of such context creates avoidable privacy and confidentiality exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill expands from local learning capture into cross-session transcript access and message passing, which materially broadens data access beyond the stated purpose. Without explicit authorization, scoping, and sensitivity controls, this can expose prior conversations and propagate sensitive information across sessions or agents.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

git clone https://github.com/pskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent

text

Create log directory:
```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The template tells authors to include trigger conditions, but it does not require concrete activation boundaries, exclusions, or priority rules. In an agent skill system, vague triggers can cause over-broad invocation, making the agent apply the wrong skill in unrelated contexts and potentially execute unsafe or inappropriate workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The minimal template further weakens safety by allowing descriptions that say only what the skill does and when to use it, without forcing precise trigger language. Because this repository is for a self-improving agent that may promote learnings into reusable skills, underspecified triggers increase the chance of accidental autonomous misuse across future tasks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

Project-level hook configuration introduces persistent automatic behavior at session start, which can outlive the original user's awareness and affect future agent runs in the repository. In a self-improving-agent context, that persistence is especially sensitive because it creates recurring execution points tied to prompts and tool use.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

An empty matcher causes the hook to fire on every prompt, creating broad, unconditional execution of a local script during routine agent use. This increases attack surface and the chance that a modified or malicious script will run in unrelated contexts, while also normalizing constant background execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-level configuration enables a command hook globally with no trigger constraints, causing automatic execution across all projects and sessions. A globally installed hook amplifies the blast radius of any script compromise, path hijack, or unsafe script change because it persists beyond a single repository.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The minimal setup still uses an unconstrained matcher, so even the supposedly lighter configuration executes on every prompt. Reducing the number of hooks lowers overhead but does not address the core security issue of broad, unconditional script execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Codex setup mirrors the same empty-matcher pattern, enabling command execution for every prompt without scope limitation. In an agent environment, repeated automatic invocation expands the opportunity for abuse and unintended data exposure through hook processing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document states that the hook scripts only output text and do not run commands, yet the configuration explicitly invokes shell scripts via command hooks. This is a misleading security claim that can cause users to underestimate the trust and execution risk of installing the hooks, especially because those scripts execute with the agent's permissions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The guide instructs users to create persistent .learnings/ storage in the workspace or skill directory, enabling retention of model-observed errors, corrections, and possibly sensitive operational context. In a self-improving agent, persistent memory materially raises the risk of storing secrets, personal data, or prompt-injection artifacts that can influence later sessions.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The documentation explicitly describes cross-session transcript access and messaging but provides no warning, consent model, or access-control guidance around potentially sensitive session contents. In a self-improving/memory-oriented skill, this increases the chance that user data, credentials, or sensitive task context could be propagated across sessions without clear privacy boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The empty matcher causes the UserPromptSubmit hook to fire for every submitted prompt, which can trigger the self-improvement script on all user input rather than only on intended cases. In this skill context, that broad trigger increases exposure of sensitive prompts to the hook script and creates unnecessary automation on unscoped input, making mislogging, privacy leakage, or unsafe side effects more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The example trigger phrases "Save this as a skill" and especially "This would be useful elsewhere" are natural, common utterances that could appear in ordinary conversation without intending to invoke extraction behavior. The document does not provide negative examples or clearer scope boundaries to distinguish explicit extraction requests from casual remarks.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

Docker build fails on M1 Mac because base image python:3.11-slim has no ARM64 variant. Must add --platform linux/amd64 or use FROM --platform=linux/amd64.

Extracted skill (skills/docker-m1-fixes/SKILL.md):

yaml

---

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/skill-extraction.md (reported line 58)May include surrounding context.

Docker build fails on M1 Mac because base image python:3.11-slim has no ARM64 variant. Must add --platform linux/amd64 or use FROM --platform=linux/amd64.

Extracted skill (skills/docker-m1-fixes/SKILL.md):

yaml

---

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Promoting learnings into broad control files like SOUL.md, AGENTS.md, TOOLS.md, or workspace prompt files can turn incidental conversation-derived content into persistent instruction-layer memory. That increases the blast radius of bad, sensitive, or manipulative content because it may influence future agent behavior across unrelated tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.