my-test-2

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:12 PM UTC
• Version: 1.0.1

Overview

This skill is not clearly malicious, but it creates durable agent memory and optional always-on reminders with too little scoping, review, or privacy guidance.

Install only if you deliberately want persistent agent learning. Keep it project-local, avoid user-level/global hooks and empty matchers, redact secrets before logging, review every proposed write to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, and avoid cross-session transcript or message features unless explicitly needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/openclaw/handler.js:8
• Finding: Agent Bootstrap Context Injection Through the OpenClaw Hook<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:8-26, 34-52`; `scripts/activator.sh:9-19` **Vulnerability Type**: Agent instruction injection **Risk Level**: Medium ### Complete Code Snippet ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); const handler = async (event) => { // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The prompt-submit hook also emits instructions into agent context: ```bash cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the se ...[truncated 2127 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace automatic bootstrap injection with an explicitly invoked command or Skill action. 2. Obtain visible user consent before adding instructions to a session that was not started for learning management. 3. Restrict the hook to clearly identified self-improvement workflows rather than every bootstrap or prompt. 4. Keep the TypeScript and JavaScript implementations synchronized, including the sub-agent exclusion. 5. Add an explicit marker stating that the injected content is advisory and cannot override system, developer, or current user instructions. 6. Provide a documented disable or uninstall command and expose the hook’s active status to the user. 7. Add tests confirming that unrelated sessions and sub-agent sessions do not receive the reminder. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:262
• Finding: Unreviewed Promotion of Captured Content Into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26, 262-289, 328-360, 442-448`; `references/openclaw-integration.md:130-143` **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: High ### Complete Code Snippet ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` The OpenClaw workflow reinforces cross-session promotion: ```markdown ## Learning Workflow ### Capturing Learnings 1. **In-session**: Log to `.learnings/` as usual 2. **Cross-session**: Promote to workspace files ### Promotion Decision Tree Is the learning project-specific? ├── Yes → Keep in .learnings/ └── No → Is it behavioral/style-related? ├── Yes → Promote to SOUL.md └── No → Is it tool-related? ...[truncated 2526 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user approval before every write to persistent instruction files. 2. Keep `.learnings/` as non-authoritative data; never automatically promote its contents into agent instructions. 3. Display the exact proposed diff, source session, original text, and reason for promotion before obtaining approval. 4. Allow promotion only from trusted sources and record immutable provenance metadata. 5. Prohibit verbatim copying of user messages, command output, external API responses, and repository content into instruction files. 6. Validate promoted rules against system and developer policies and reject instructions involving secrets, privilege changes, safety bypasses, or unrelated tool execution. 7. Remove “promote aggressively” and replace it with a conservative, review-first policy. 8. Add rollback support and an audit log for every persistent-memory modification. 9. Treat recurrence as evidence of frequency only, not trustworthiness. 10. Separate behavioral policy files from ordinary project facts and apply stricter approval requirements to `SOUL.md`, `AGENTS.md`, and equivalent system-context files. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:106
• Finding: Workspace Write Restriction Can Be Bypassed Through Symbolic Links<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh:106-121, 176-179` **Vulnerability Type**: Symbolic-link path traversal and unintended file write **Risk Level**: Medium ### Complete Code Snippet ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" # Check if skill already exists if [ -d "$SKILL_PATH" ] && [ "$DRY_RUN" = false ]; then log_error "Skill already exists: $SKILL_PATH" log_error "Use a different name or remove the existing skill first." exit 1 fi ``` ```bash # Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE --- name: $SKILL_NAME description: "[TODO: Add a concise description of what this skill does and when to use it]" --- ``` ### Technical Analysis The script attempts to keep writes inside the current workspace by rejecting absolute paths and `..` path segments. These checks operate only on the lexical path supplied by the user. They do not resolve symbolic links or verify that the canonical destination remains under the canonical working directory. If a component of `--output-dir` is a symbolic link to a directory outside the workspace, `mkdir -p` and shell redirection follow that link. The resulting `SKILL.md` is therefore created outside the intended boundary. The skill name is strictly validated, which prevents direct traversal through `SKILL_NAME`, but it does not mitigate a symlink in `SKILLS_DIR`. ### Attack Path 1. The attacker can create or control a path within the current workspace. 2. The attac ...[truncated 1454 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the working directory and requested output parent with `realpath` before creating files. 2. Verify that the resolved destination begins with the resolved workspace path followed by a path separator. 3. Reject any symbolic-link component in the output path using `lstat`, `find -L`, or equivalent checks. 4. Create the output directory one component at a time while checking each component with no-follow semantics. 5. Use a safer implementation language and APIs supporting `O_NOFOLLOW`, directory file descriptors, and atomic exclusive creation. 6. Refuse to write when the final file already exists, including when it is a symbolic link. 7. Revalidate the canonical destination immediately before the final write to reduce time-of-check/time-of-use exposure. 8. Add automated tests covering symlinked output directories, nested symlinks, dangling symlinks, and concurrent path replacement. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented primarily as a learning-capture capability, but it also instructs the agent to create reusable skills from learnings and run helper scripts that write new files. That expanded behavior increases the skill's authority and filesystem impact beyond what a user may infer from the description, which can lead to unexpected file creation or promotion of content into durable agent instructions.

Ssd 3

High

• Confidence: 94% confidence
• Finding: The skill encourages reading other session transcripts and sending learnings across sessions, which expands the audience and lifetime of potentially sensitive content. Cross-session propagation can bypass user expectations about data isolation and turn one-session disclosures into broader workspace memory exposure.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The templates instruct the agent to capture full context, input parameters, user context, related files, and actual error output. Error messages and command contexts commonly contain credentials, file paths, environment values, API payloads, or proprietary code details, so these templates materially increase the likelihood of sensitive-data leakage into durable logs.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Instructing users to modify ~/.claude/settings.json establishes persistence in an agent configuration directory, affecting all future sessions for that user. In the context of a self-improvement skill that auto-triggers hooks, this is more dangerous because it creates long-lived behavioral changes and expands any misconfiguration or abuse beyond a single repository.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The manifest description lists many invocation conditions without clear exclusion boundaries, encouraging frequent or automatic use. While not directly malicious, this makes accidental activation more likely and compounds the privacy and persistence risks elsewhere in the skill.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly directs the agent to retain corrections, errors, failures, and other user-provided content in persistent local files and to promote them into shared memory/instruction files. This creates a real risk of storing secrets, proprietary prompts, personal data, or sensitive operational details far beyond the original session.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 72% confidence
• Finding: The skill establishes persistent storage under a home-directory workspace, causing retained state across sessions. Persistent memory is not inherently unsafe, but in this context it increases the blast radius of the logging behaviors by making accidental collection durable and broadly reusable.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation triggers are broad natural-language phrases like common chat requests, so the skill may activate during ordinary conversation and start logging or promoting content without a strong signal that the user intended persistence. In a coding-agent context, overbroad activation increases the chance of collecting sensitive prompts, corrections, or contextual details into durable files.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 82% confidence
• Finding: Creating project-level hook configuration introduces session persistence by causing future sessions in the repository to automatically load the self-improvement hooks. While this is part of the feature design, it still alters agent behavior beyond the immediate task and can silently persist broad auto-triggering if users forget it was enabled.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: An empty matcher causes the activator hook to run on every prompt, creating broad, automatic interception of all user interactions. In a self-improvement skill, this increases the chance of unnecessary context injection, sensitive prompt exposure to hook logic, and persistent behavior amplification across the session.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The user-level configuration installs the hook in ~/.claude/settings.json for global activation, extending the unconstrained trigger scope across all projects and sessions. This magnifies the blast radius of any script bug, prompt leakage, or unintended persistence because every future interaction can invoke the hook automatically.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The 'minimal' setup still uses an empty matcher, so it remains a universal trigger despite being presented as lower overhead. This framing can mislead users into adopting broad always-on behavior while believing the setup is reduced-risk.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document states the hook scripts only output text and do not run commands, but the hooks are explicitly configured as shell commands and the guide also references an extraction script invocation. This is a misleading security claim that can cause users to underestimate the trust boundary and grant execution to local scripts without appropriate review.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 83% confidence
• Finding: Creating a persistent .learnings directory in the workspace or skill directory establishes session-to-session retention of model observations and user-derived content. In a self-improvement context, this increases the risk of storing sensitive information long-term and of persisting unsafe or adversarial content that later influences behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document tells the agent to log significant errors and learnings to persistent files but does not warn against storing secrets, personal data, or sensitive session content. Persistent memory files can accumulate API keys, proprietary prompts, user corrections containing confidential information, or other sensitive artifacts that survive beyond the current session.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The guide expands a self-improvement skill into using cross-session capabilities such as listing sessions, reading other session history, messaging them, and spawning sub-agents. Those powers are broader than needed for local learning capture and can expose unrelated conversation data or enable unintended data flow between sessions if used without strict scope and consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The integration introduces session history access and cross-session messaging without any privacy notice, consent model, or scope restriction. This can normalize reading unrelated transcripts and forwarding information between sessions, increasing the chance of privacy leakage or unauthorized reuse of prior user data.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The OpenClaw-specific trigger table instructs the agent to promote observations into injected behavior files like AGENTS.md, SOUL.md, and TOOLS.md. Because those files shape future agent behavior, writing to them based on runtime events creates a prompt-persistence channel that can amplify mistakes, preserve prompt injection, or silently alter agent policy over time.

Vague Triggers

Low

• Confidence: 89% confidence
• Finding: This markdown template explicitly instructs authors to include trigger conditions, but the placeholder text is very general and does not require concrete trigger phrases, scope limits, or negative examples. Because this is a reusable template for skill descriptions, it may lead authors to publish overly broad activation criteria that collide with ordinary language.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: The template's Quick Reference table uses placeholder entries like '[Trigger 1]' and '[Trigger 2]' without any instruction that triggers must be narrow, domain-specific, or disambiguated from everyday speech. In a template intended for broad reuse, this omission can propagate ambiguous activation descriptions into downstream skills.

Static analysis

No suspicious patterns detected.