Security audit

my-test

Security checks for vulnerabilities and agentic risk

Overview

This self-improvement skill is coherent in intent, but it gives broad persistent influence over future agent behavior and cross-session context without enough guardrails.

Review this carefully before installing. Use project-local configuration only, avoid user-level/global hooks, keep hook matchers narrow, do not allow automatic promotion into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, and redact secrets, personal data, proprietary context, and transcripts before writing any learning. Prefer an audited pinned release instead of the documented mutable git clone.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:262
Finding: Untrusted Learnings Can Be Promoted into Persistent Agent Instruction Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26`, `SKILL.md:262-289`, `SKILL.md:346-361`, `SKILL.md:448`; `references/openclaw-integration.md:125-142` **Vulnerability Type**: Persistent agent memory and instruction poisoning **Risk Level**: High ### Vulnerable Code or Instructions ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count ...[truncated 2567 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic or agent-decided promotion into prompt-bearing files. 2. Require explicit, per-entry human approval before modifying `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instructions. 3. Treat all conversation-derived learning content as untrusted data. 4. Store learnings in a non-executable knowledge repository that is not automatically injected as authoritative instructions. 5. Define an allowlisted structured schema for promotable facts and reject commands, role changes, safety-policy changes, external URLs, and instructions requesting access to secrets. 6. Record provenance, originating session, author, review status, and an immutable audit trail for each promoted item. 7. Remove the “promote aggressively” guidance and default to no promotion when trust or applicability is uncertain. 8. Require a diff preview and confirmation before creating or changing any persistent agent-context file. ]]>

T01 · Skill Instruction Hijacking

Error

Location: hooks/openclaw/handler.js:8
Finding: Global Hooks Inject Skill-Controlled Instructions into Agent Sessions<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:8-52`, `hooks/openclaw/handler.ts:10-60`, `scripts/activator.sh:10-19`, `references/hooks-setup.md:38-57` **Vulnerability Type**: Bootstrap and per-prompt instruction injection **Risk Level**: High ### Vulnerable Code ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); ``` ```javascript const handler = async (event) => { // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The per-prompt shell hook emits another instruction block: ```bash cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern lea ...[truncated 2568 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace global activation with explicit, task-scoped invocation. 2. Do not inject instruction-like content into bootstrap files for unrelated sessions. 3. If reminders are necessary, emit non-authoritative metadata and require user confirmation before any write or promotion. 4. Limit hook matchers to narrowly defined debugging or learning workflows. 5. Add the sub-agent exclusion to `handler.js`. 6. Generate JavaScript from TypeScript in a reproducible build and verify artifact parity in CI. 7. Add tests confirming that sub-agent, unrelated project, and disabled contexts receive no injection. 8. Clearly disclose installation scope and provide a single-command removal or disable procedure. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/openclaw-integration.md:159
Finding: Learning Workflow Encourages Access to Other Sessions' Transcripts<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:87-92`; `references/openclaw-integration.md:159-186` **Vulnerability Type**: Cross-session data access beyond minimum required scope **Risk Level**: Medium ### Vulnerable Instructions ```markdown ### Inter-Session Communication OpenClaw provides tools to share learnings across sessions: - **sessions_list** — View active/recent sessions - **sessions_history** — Read another session's transcript - **sessions_send** — Send a learning to another session - **sessions_spawn** — Spawn a sub-agent for background work ``` ```markdown ## Inter-Agent Communication OpenClaw provides tools for cross-session communication: ### sessions_list View active and recent sessions: ``` sessions_list(activeMinutes=30, messageLimit=3) ``` ### sessions_history Read transcript from another session: ``` sessions_history(sessionKey="session-id", limit=50) ``` ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ``` ### sessions_spawn Spawn a background sub-agent: ``` sessions_spawn(task="Research X and report back", label="research") ``` ``` ### Technical Analysis A local learning logger does not inherently require permission to enumerate sessions, read unrelated transcripts, transmit instructions between sessions, or create additional agents. Session transcripts may include private prompts, proprietary source code, command output, credentials, access tokens, or data belonging to unrelated projects. The workflow provides direct examples for reading up to 50 transcript entries without requiring explicit user consent, validating session ownership, limiting retrieval to a specific purpose, or redacting sensitive values before persistence. Cross-session content is also untrusted. If transcript-derived material is promoted to shared learning or instruction files, malicious instructions from one session can contaminate anoth ...[truncated 969 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `sessions_history` and session enumeration from the default learning workflow. 2. Require explicit user authorization for each cross-session access operation. 3. Require the user to identify the exact session and intended purpose rather than allowing broad discovery. 4. Retrieve the minimum necessary number of messages. 5. Redact credentials, tokens, personal information, and proprietary data before storage or transmission. 6. Prevent transcript-derived material from being automatically promoted into agent instruction files. 7. Add provenance labels identifying all cross-session content as untrusted. 8. Restrict `sessions_send` and `sessions_spawn` to separately approved workflows with clear scope and audit logging. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:39
Finding: Manual Installation Uses a Mutable and Unpinned Git Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:39-44` **Vulnerability Type**: Unpinned external Skill source **Risk Level**: Medium ### Vulnerable Installation Instruction ```markdown **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis The manual installation procedure clones the current default branch without pinning an audited commit, signed release tag, checksum, or verified package version. Consequently, the effective installed content can differ from the audited version if the repository changes or is compromised. The cloned repository contains instruction files and executable hooks intended to run with the agent's permissions. This increases the security impact of upstream substitution. The audited project does not pipe downloaded data directly into a shell and no remote payload execution was found in the packaged scripts. The risk is specifically that the documented installation source is mutable and later content may not match the reviewed artifact. ### Attack Path 1. The upstream repository is modified legitimately, compromised, or transferred to a malicious maintainer. 2. A user follows the documented `git clone` command. 3. Git retrieves the current default branch rather than the audited release. 4. The unreviewed files are installed into the OpenClaw Skill directory. 5. The user enables the downloaded hook. 6. Modified instructions or scripts execute with the agent's existing permissions. ### Impact Assessment A compromised upstream version could modify agent instructions, read accessible files, alter workspace content, or execute commands through enabled hooks. The maximum impact is bounded by the permissions of the user or agent process installing and in ...[truncated 21 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin manual installation to a specific audited commit hash or signed release tag. 2. Publish SHA-256 checksums for release archives and document verification commands. 3. Prefer immutable release archives over cloning a mutable default branch. 4. Verify repository ownership and release signatures before installation. 5. Require users to inspect the exact hook and script files before enabling them. 6. Record the expected Skill version and source commit in installation metadata. 7. Add a reproducible release process that confirms packaged files match the reviewed source. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract-skill.sh:107
Finding: Output Path Validation Can Be Bypassed through Symbolic Links<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh:107-125`, `scripts/extract-skill.sh:174-177` **Vulnerability Type**: Filesystem write-boundary bypass **Risk Level**: Medium ### Vulnerable Code ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" # Check if skill already exists if [ -d "$SKILL_PATH" ] && [ "$DRY_RUN" = false ]; then log_error "Skill already exists: $SKILL_PATH" log_error "Use a different name or remove the existing skill first." exit 1 fi ``` ```bash # Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script rejects absolute paths and literal `..` path segments, but it does not resolve the canonical destination or check whether any path component is a symbolic link. A relative directory accepted by these checks can be a symlink to a location outside the current workspace. Both `mkdir -p` and shell redirection follow symlinks, allowing the script to create a directory and `SKILL.md` outside the intended boundary. The validated Skill name limits the filename and directory name to lowercase letters, numbers, and hyphens. This reduces arbitrary overwrite flexibility but does not prevent an out-of-workspace write. A check performed only before writing may also be exposed to a time-of-check/time-of-use race if an attacker can replace a directory with a symlink between validation and creation. ### Attack Path 1. An attacker with write access to the workspace creates a relative ...[truncated 960 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve both the workspace root and destination with `realpath` before writing. 2. Verify that the canonical destination starts with the canonical workspace root followed by a path separator. 3. Reject any destination for which an existing path component is a symbolic link. 4. Revalidate the canonical path immediately before directory creation and file opening. 5. Use no-follow file-opening semantics where supported. 6. Create output beneath a trusted directory controlled by the script rather than accepting arbitrary relative output directories. 7. Add tests covering symlinks, nested symlinks, race conditions, absolute paths, and `..` traversal attempts. 8. Fail closed if canonicalization cannot be completed safely. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description is about maintaining and using learnings: capturing mistakes, corrections, failures, outdated knowledge, and better approaches for future improvement. The supplied code does not implement learning capture, error logging, correction recording, or review of prior learnings. Instead, it is a project scaffolding utility that generates a new skill directory and template markdown file from a skill name. While its comments mention creating a skill from a learning entry, that is only a loose workflow relationship; the concrete behavior is skill extraction/scaffolding, not continuous-improvement learning management as declared. This is a material purpose mismatch.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 91% confidence
Finding: Directing users to modify ~/.claude/settings.json establishes persistence in the agent's global configuration directory, affecting all future sessions. Any command hook placed there executes with the agent's privileges, so compromising or replacing the referenced script can create durable cross-project behavior and significantly expand impact beyond a single repository.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The description says to use the skill when a user corrects Claude, when a capability doesn't exist, when knowledge is outdated, or when a better approach is discovered, and also to review learnings before major tasks. These conditions are very broad and lack exclusion criteria or negative examples, which increases the chance of unintended invocation during normal conversation.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 78% confidence
Finding: Creating persistent learning directories in a home/workspace path is not inherently malicious, but it establishes session persistence by design. In this skill's context, persistence materially increases risk because conversational data, errors, and cross-task learnings may accumulate in a durable location without clear retention limits or sensitivity controls.

Ssd 3

Medium

Confidence: 95% confidence
Finding: These instructions explicitly encourage reading session history, sending learnings to other sessions, and sharing persistent workspace memory. In a skill designed to store natural-language summaries, that creates a realistic cross-session data leakage channel where sensitive user context may be retained and redistributed beyond the original interaction.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The templates direct the agent to store full context, inputs, parameters, environment details, and user context in durable markdown logs. Because those fields naturally capture secrets, internal paths, tokens, incident details, or personal data, the format itself encourages retention of sensitive information that may later be exposed or reused improperly.

Vague Triggers

Medium

Confidence: 98% confidence
Finding: The automatic trigger phrases are so common that the skill can capture and persist routine user dialogue, corrections, and requests without meaningful boundary checks. In the context of a memory/logging skill, this increases the chance of collecting sensitive or unnecessary information into durable files, which can later be read, promoted, or shared across sessions.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: This markdown file documents a hook configuration with an empty `matcher`, which provides no constraint on when the skill activates. Because it applies to every user prompt, it overlaps with ordinary interaction rather than a narrowly defined trigger condition.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: This recommends installing a command hook in the user-level agent configuration with an empty matcher, causing it to trigger across all future sessions and repositories. Broad, persistent activation in a global config increases the blast radius of any later script modification, path hijack, or unsafe hook behavior, especially because hooks run with the agent's permissions.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Although presented as a lower-overhead configuration, this example still activates on every prompt because the `matcher` is empty. The documentation does not clarify intended boundaries for activation or provide narrower alternatives in the primary example.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The Codex setup mirrors the same unconstrained trigger pattern by leaving `matcher` empty. In documentation, this is an ambiguous activation condition because users are not given a clear boundary for when the hook should or should not run.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The "Detection Triggers" section lists generic conditions like user corrections, API errors, and knowledge gaps without defining clear thresholds or exclusions. In a markdown skill guide, these broad natural-language triggers can overlap with normal operation and make it unclear when the skill should activate or record learnings versus when it should not.

Vague Triggers

Low

Confidence: 86% confidence
Finding: This markdown template instructs authors to include trigger conditions, but the placeholder wording remains generic and does not require concrete trigger phrases, scope limits, or negative examples. Because this file is a reusable template for skill manifests, it may propagate ambiguous activation descriptions into downstream skills.

Vague Triggers

Low

Confidence: 90% confidence
Finding: The minimal template's description field says only 'What this skill does and when to use it,' which does not instruct authors to define narrow activation criteria. In a template intended for broad reuse, this omission can lead to vague or collision-prone trigger descriptions.

Static analysis

No suspicious patterns detected.