T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:262- Finding
Untrusted Learnings Can Be Promoted into Persistent Agent Instruction Files
- Content
View full analysis
- Remediation
View remediation
Security audit
my-test
Security checks for vulnerabilities and agentic risk
Overview
This self-improvement skill is coherent in intent, but it gives broad persistent influence over future agent behavior and cross-session context without enough guardrails.
Review this carefully before installing. Use project-local configuration only, avoid user-level/global hooks, keep hook matchers narrow, do not allow automatic promotion into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, and redact secrets, personal data, proprietary context, and transcripts before writing any learning. Prefer an audited pinned release instead of the documented mutable git clone.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
hooks/openclaw/handler.js:8- Finding
Global Hooks Inject Skill-Controlled Instructions into Agent Sessions
- Content
View full analysis
{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The per-prompt shell hook emits another instruction block: ```bash cat << 'EOF' After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern lea ...[truncated 2568 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/openclaw-integration.md:159- Finding
Learning Workflow Encourages Access to Other Sessions' Transcripts
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:39- Finding
Manual Installation Uses a Mutable and Unpinned Git Repository
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/extract-skill.sh:107- Finding
Output Path Validation Can Be Bypassed through Symbolic Links
- Content
View full analysis
"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script rejects absolute paths and literal `..` path segments, but it does not resolve the canonical destination or check whether any path component is a symbolic link. A relative directory accepted by these checks can be a symlink to a location outside the current workspace. Both `mkdir -p` and shell redirection follow symlinks, allowing the script to create a directory and `SKILL.md` outside the intended boundary. The validated Skill name limits the filename and directory name to lowercase letters, numbers, and hyphens. This reduces arbitrary overwrite flexibility but does not prevent an out-of-workspace write. A check performed only before writing may also be exposed to a time-of-check/time-of-use race if an attacker can replace a directory with a symlink between validation and creation. ### Attack Path 1. An attacker with write access to the workspace creates a relative ...[truncated 960 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description is about maintaining and using learnings: capturing mistakes, corrections, failures, outdated knowledge, and better approaches for future improvement. The supplied code does not implement learning capture, error logging, correction recording, or review of prior learnings. Instead, it is a project scaffolding utility that generates a new skill directory and template markdown file from a skill name. While its comments mention creating a skill from a learning entry, that is only a loose workflow relationship; the concrete behavior is skill extraction/scaffolding, not continuous-improvement learning management as declared. This is a material purpose mismatch.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 91% confidence
- Finding
Directing users to modify ~/.claude/settings.json establishes persistence in the agent's global configuration directory, affecting all future sessions. Any command hook placed there executes with the agent's privileges, so compromising or replacing the referenced script can create durable cross-project behavior and significantly expand impact beyond a single repository.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description says to use the skill when a user corrects Claude, when a capability doesn't exist, when knowledge is outdated, or when a better approach is discovered, and also to review learnings before major tasks. These conditions are very broad and lack exclusion criteria or negative examples, which increases the chance of unintended invocation during normal conversation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
Creating persistent learning directories in a home/workspace path is not inherently malicious, but it establishes session persistence by design. In this skill's context, persistence materially increases risk because conversational data, errors, and cross-task learnings may accumulate in a durable location without clear retention limits or sensitivity controls.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions explicitly encourage reading session history, sending learnings to other sessions, and sharing persistent workspace memory. In a skill designed to store natural-language summaries, that creates a realistic cross-session data leakage channel where sensitive user context may be retained and redistributed beyond the original interaction.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The templates direct the agent to store full context, inputs, parameters, environment details, and user context in durable markdown logs. Because those fields naturally capture secrets, internal paths, tokens, incident details, or personal data, the format itself encourages retention of sensitive information that may later be exposed or reused improperly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The automatic trigger phrases are so common that the skill can capture and persist routine user dialogue, corrections, and requests without meaningful boundary checks. In the context of a memory/logging skill, this increases the chance of collecting sensitive or unnecessary information into durable files, which can later be read, promoted, or shared across sessions.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file documents a hook configuration with an empty
matcher, which provides no constraint on when the skill activates. Because it applies to every user prompt, it overlaps with ordinary interaction rather than a narrowly defined trigger condition.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This recommends installing a command hook in the user-level agent configuration with an empty matcher, causing it to trigger across all future sessions and repositories. Broad, persistent activation in a global config increases the blast radius of any later script modification, path hijack, or unsafe hook behavior, especially because hooks run with the agent's permissions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Although presented as a lower-overhead configuration, this example still activates on every prompt because the
matcheris empty. The documentation does not clarify intended boundaries for activation or provide narrower alternatives in the primary example.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Codex setup mirrors the same unconstrained trigger pattern by leaving
matcherempty. In documentation, this is an ambiguous activation condition because users are not given a clear boundary for when the hook should or should not run.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The "Detection Triggers" section lists generic conditions like user corrections, API errors, and knowledge gaps without defining clear thresholds or exclusions. In a markdown skill guide, these broad natural-language triggers can overlap with normal operation and make it unclear when the skill should activate or record learnings versus when it should not.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown template instructs authors to include trigger conditions, but the placeholder wording remains generic and does not require concrete trigger phrases, scope limits, or negative examples. Because this file is a reusable template for skill manifests, it may propagate ambiguous activation descriptions into downstream skills.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The minimal template's description field says only 'What this skill does and when to use it,' which does not instruct authors to define narrow activation criteria. In a template intended for broad reuse, this omission can lead to vague or collision-prone trigger descriptions.
- Content