Beckmann Knowledge Graph × Self-Improving Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:19 AM UTC
• Version: 1.0.0

Overview

The skill is mostly disclosed as an orchestration workflow, but it gives unpinned third-party skills broad authority and automatically writes user-influenced analysis into persistent learning files.

Install only if you are comfortable with a skill that can shape future agent behavior through learning files. Review and pin the two dependency skills first, and treat any .learnings entries or CLAUDE.md promotion suggestions as untrusted until you approve them manually.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:30
• Finding: Global Task Redirection and Instruction-Priority Hijacking## Vulnerability Details **File Location**: `SKILL.md:30-34` and `SKILL.md:202` **Vulnerability Type**: Global instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown Follow `pskoett/self-improving-agent` for all tasks: * Log errors to `.learnings/ERRORS.md` * Log learnings to `.learnings/LEARNINGS.md` * Promote patterns after 3 repetitions * Maintain the `LRN-YYYYMMDD-XXX` log format ``` The conflict-resolution section reinforces the instruction-priority override: ```markdown |Situation|Rule| |-|-| |Self-Improving Agent says "move on"; Beckmann analysis still open|Finish the Beckmann analysis first, then log| ``` ### Technical Analysis The skill does not limit its behavior to explicit Beckmann analyses. Instead, it directs the agent to follow an external self-improvement skill “for all tasks,” including routine interactions unrelated to this skill's stated deep-reasoning purpose. The conflict-resolution rule also instructs the agent to continue the Beckmann workflow when another agent instruction says to move on. This establishes an internal instruction-priority rule that can alter task completion and session behavior. A skill should not define itself as having precedence over user, system, safety, or task-level instructions. Because the external self-improvement skill is instructed to process every task, loading this skill can globally modify the agent's current-session goals and cause persistent file writes even when the user did not request learning or logging behavior. ### Attack Path 1. The skill is installed or loaded into an agent session. 2. The user submits an ordinary task that does not require Beckmann analysis. 3. The directive to follow `pskoett/self-improving-agent` “for all tasks” becomes active. 4. The agent applies external logging and pattern-promotion instructions to the task. 5. If another instruction requests that the agent stop or move on, the conflict rule ...[truncated 642 chars]
• Remediation: ## Remediation Suggestions - Restrict the skill to explicit invocations or to Beckmann analyses that the user has affirmatively approved. - Replace “for all tasks” with a narrowly scoped statement that does not affect unrelated work. - Remove any rule claiming precedence over instructions to stop, move on, or terminate processing. - Explicitly state that system, developer, user, safety, and task-level instructions retain their normal precedence. - Make all learning and error logging opt-in, with the destination file and proposed content shown to the user before writing. - Permit immediate cancellation at every stage without requiring analysis completion or logging. - Define a capability boundary that limits this skill to generating a reasoning response and, only when separately authorized, proposing a learning entry.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:139
• Finding: Automatic Persistence and Promotion of User-Influenced Agent Memory## Vulnerability Details **File Location**: `SKILL.md:139-163` **Vulnerability Type**: Persistent memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown After every Beckmann analysis, add an entry to `.learnings/LEARNINGS.md`: ```markdown ## [LRN-YYYYMMDD-XXX] insight **Logged**: <ISO-8601 timestamp> **Priority**: medium **Status**: pending **Area**: beckmann ### Summary Beckmann analysis: <one-line description of the question> ### Details - Question type: <paradox | forecast | epistemological | strategic | ai-safety> - Graph nodes used: <comma-separated entity IDs> - Key insight: <most important finding> - New actual level: <what the problem level becomes after this analysis> ### Suggested Action <Promote to CLAUDE.md if broadly applicable. Flag as #beckmann-graph-extension-candidate if a graph gap was found.> ### Metadata - Source: beckmann-knowledge-graph v<version> - Tags: #beckmann, #<question-type> ``` ``` ### Technical Analysis The skill requires every Beckmann analysis to be written into persistent agent memory. Fields such as the question summary, key insight, suggested action, and problem-level conclusion are derived from user input and model-generated reasoning. The procedure defines no validation, sanitization, provenance enforcement, or approval boundary before this material is persisted. The template additionally suggests promotion into `CLAUDE.md`, which is commonly treated as an agent instruction or project-guidance file. Promoting untrusted or insufficiently reviewed learning content into that file can convert descriptive user-controlled text into future behavioral instructions. Repetition-based promotion compounds the problem because adversarial propositions can be submitted repeatedly until they qualify as a pattern. Markdown or instruction-like content embedded in a question may also be retained in gen ...[truncated 1390 chars]
• Remediation: ## Remediation Suggestions - Do not automatically write user-influenced analysis into persistent memory. - Present a proposed learning entry to the user and require explicit approval before saving it. - Store observations as inert structured data rather than executable Markdown instructions. - Separate untrusted observations from trusted agent policy and never automatically copy learning entries into `CLAUDE.md`. - Remove automatic repetition-based promotion for content derived from user prompts. - Require human review and independent validation before any learning becomes project-wide guidance. - Record provenance, including the originating user request, timestamp, model, dependency version, and validation status. - Sanitize or reject instruction syntax, role directives, tool commands, embedded markup, and references to privileged configuration files. - Enforce length and schema constraints on all persisted fields. - Provide a rollback and deletion mechanism for individual learning entries and promoted rules.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Unpinned External Skills Receive Delegated Instruction Authority## Vulnerability Details **File Location**: `SKILL.md:8`, `SKILL.md:95`, and `README.md:36-42` **Vulnerability Type**: Unpinned third-party skill dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml requires: "pskoett/self-improving-agent, matthiasbeckmann987-spec/beckmann-knowledge-graph" ``` The external graph skill is granted instruction authority: ```markdown Follow `beckmann-knowledge-graph/SKILL.md` exactly: ``` Installation documentation does not specify immutable dependency versions or integrity checks: ```markdown ## Install ``` openclaw skills install beckmann-x-self-improving-agent ``` ## Requires - `pskoett/self-improving-agent` - `matthiasbeckmann987-spec/beckmann-knowledge-graph` ``` ### Technical Analysis Both required skills are identified only by mutable names. No immutable release version, commit identifier, content hash, signature, or trusted registry constraint is provided. Their source was not included in the audited project, so their effective behavior could not be verified as part of this review. This is especially significant because the current skill directs the agent to follow one dependency for all tasks and to follow the other dependency's `SKILL.md` “exactly.” A future, replaced, or compromised dependency can therefore alter the effective instructions without any modification to this repository. The risk is a supply-chain trust failure rather than confirmed malicious code in the reviewed files. The combination of mutable resolution and broad delegated authority gives dependency maintainers or a compromised distribution source a path to control agent behavior and persistent state. ### Attack Path 1. An attacker compromises a dependency publisher account, distribution source, or mutable dependency release. 2. The attacker changes a required skill while retaining the same dependency name. 3. A user installs or updates the combination skill and resolves t ...[truncated 1002 chars]
• Remediation: ## Remediation Suggestions - Pin each dependency to an immutable version or commit identifier. - Publish and verify cryptographic hashes or signed manifests for all dependency files. - Resolve dependencies only from an authenticated, allowlisted registry or repository. - Vendor reviewed dependency content when reproducible immutable resolution is unavailable. - Replace “follow exactly” with a narrowly defined interface describing permitted inputs, outputs, and capabilities. - Prevent dependencies from inheriting filesystem, network, shell, or memory-write privileges unless explicitly required and approved. - Review dependency changes before upgrades and generate a lock file recording exact resolved artifacts. - Fail closed when dependency identity or integrity verification cannot be completed. - Include the complete dependency tree in future audits because the effective behavior cannot be assessed from this orchestration repository alone.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Ae1

High

• Category: analysis-evasion

Content

1. Delete this `SKILL.md`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Static analysis

No suspicious patterns detected.