Self Improving Agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:53 AM UTC
• Version: 1.0.0

Overview

The skill is not plainly malicious, but it can persist and promote conversation-derived information into future agent context with broad hooks, so it should be reviewed before use.

Before installing, decide whether you want an agent memory workflow that records task details and can influence future sessions. Prefer project-scoped hooks with restrictive matchers, avoid the global ~/.claude hook, keep .learnings private by default, redact secrets and personal data from errors and transcripts, and require human review before promoting anything into AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:346

Finding

Conversation-Derived Content Can Poison Persistent Agent Context

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` The broader workflow explicitly captures user-supplied corrections and promotes them into persistent context: ```markdown | User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` | | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ### Technical Analysis The Skill instructs agents to derive persistent knowledge from conversations, errors, and user corrections. It then directs agents to promote recurring entries into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, and `TOOLS.md`. OpenClaw automatically injects these files into later sessions. The recurrence checks establish frequency but not trustworthiness. There is no required human approval, provenance validation, separation between descriptive knowledge and imperative instructions, or screening for security-sensitive content. Consequently, repeated attacker-controlled statements can be convert ...[truncated 1593 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: hooks/openclaw/handler.js:9

Finding

Opt-In Hooks Inject Skill-Controlled Instructions into Agent Context

Content

View full analysis

{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The prompt-submit hook similarly emits instructions as model context: ```bash cat << 'EOF' After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debu ...[truncated 2269 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Installation Instructions Retrieve Mutable Unpinned Skill Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says this skill is for capturing learnings, errors, corrections, and other improvement signals. The supplied code does not implement learning capture, error logging, correction tracking, or review of prior learnings. Instead, it is a project utility that creates a new skill scaffold on disk from a skill name. That is a materially different primary purpose and includes undeclared file-creation behavior. While the comments mention creating a skill from a learning entry, the script only generates a template and does not actually record or process learnings themselves. Therefore, the description does not accurately represent the code chunk's behavior.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Writing to ~/.claude/settings.json affects the agent’s global configuration directory, creating durable behavior changes beyond a single project. In this context, that persistence is dangerous because it establishes automatic command execution for future sessions, potentially exposing unrelated work or surviving repository removal.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill whenever a command fails unexpectedly, the user corrects the agent, a better approach is discovered, or before major tasks. These conditions are very broad in normal development conversations, and the file does not define clear limits or exclusions for when the skill should not activate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill explicitly establishes persistent storage under a home-directory workspace, enabling retention of potentially sensitive operational history across sessions. Persistence is core to the skill’s design, so in this context it is more dangerous than ordinary temporary note-taking because retained content may outlive user expectations and be reused elsewhere.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill encourages sharing learnings across sessions and reading other session transcripts, which can propagate sensitive user-provided information far beyond the original context. Cross-session persistence and transmission materially increase data-retention and unauthorized-disclosure risk, especially in multi-agent environments.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The prescribed logging template asks for full context, inputs, and user context, which directly incentivizes storing sensitive user data in durable plain-text records. In a skill whose purpose is retention and later promotion, this is a clear data-handling weakness with real downstream leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The error logging format instructs agents to record actual error output, command context, and input parameters, which commonly contain credentials, tokens, URLs, file paths, prompts, or personal data. Because the data is persisted in markdown files, accidental secret retention and later exposure become likely, especially if the repository or workspace is shared.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The automatic trigger phrases are extremely common conversational patterns, so the skill may capture and persist information from ordinary dialogue without meaningful scoping or consent checks. In the context of a persistence-focused skill, this increases the chance of storing sensitive user content or internal reasoning artifacts in durable files.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to 'promote aggressively' into long-lived context files raises the chance that sensitive, user-derived, or transient information becomes embedded in durable agent memory. Once promoted into always-loaded guidance files, the blast radius and persistence of any leaked content increase substantially.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The guide instructs users to create persistent hook configuration in .claude/settings.json, causing the behavior to automatically recur across future sessions in that repository. While persistence is part of the feature, it still represents a security-relevant risk because command hooks remain enabled until explicitly removed and may be forgotten.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

An empty matcher causes the hook to run on every prompt, creating an always-on interception point for user interactions. In this skill context, broad automatic triggering increases exposure of sensitive prompts and makes any future script change or compromise much more impactful.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-level configuration installs the hook in ~/.claude/settings.json for global activation, causing it to run across all projects and sessions without contextual limits. This broad persistence magnifies risk because prompts from unrelated or sensitive work may be processed by the hook script automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The minimal setup still uses an empty matcher, so even the ‘lower overhead’ option remains always-on for every prompt. This preserves the core security issue of unnecessary broad execution despite presenting the configuration as safer or lighter-weight.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Codex CLI example repeats the empty matcher pattern, extending the same always-on behavior to another agent environment. Reproducing insecure defaults across tools increases the chance of widespread deployment and normalizes overbroad hook execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document’s security section understates script behavior by claiming the hooks only output text and do not run commands, while the configuration explicitly registers shell commands as hooks and elsewhere references a script that creates skill scaffolding. This can mislead users into granting trust or permissions under false assumptions, increasing the chance they deploy automation without appropriate review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The instructions explicitly create persistent .learnings/ storage in the workspace or skill directory, enabling retention of model-derived or user-derived content across sessions. In the context of a self-improvement skill that later reuses workspace files as prompt context, this persistence can preserve sensitive data or malicious prompt content and amplify it over time.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide recommends logging learnings to persistent workspace files and promoting them into AGENTS.md, SOUL.md, or TOOLS.md without warning that these files may later be injected into prompts or retained long-term. This creates a realistic risk of storing secrets, sensitive user data, or attacker-supplied prompt injection content in durable memory that can influence future sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The 'Detection Triggers' section lists generic conditions like 'Knowledge gaps', 'API errors', and 'User corrections' without defining boundaries, exclusions, or exact activation behavior. In a markdown skill guide, such broad natural-language triggers can overlap with many ordinary interactions and make it unclear when the skill should activate versus remain idle.

Content

No source excerpt is available for this finding.