Security audit

Self Improving Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is not plainly malicious, but it can persist and promote conversation-derived information into future agent context with broad hooks, so it should be reviewed before use.

Before installing, decide whether you want an agent memory workflow that records task details and can influence future sessions. Prefer project-scoped hooks with restrictive matchers, avoid the global ~/.claude hook, keep .learnings private by default, redact secrets and personal data from errors and transcripts, and require human review before promoting anything into AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:346
Finding: Conversation-Derived Content Can Poison Persistent Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:346-360` **Additional Locations**: `SKILL.md:15-26`, `SKILL.md:262-289`, `SKILL.md:448`; `references/openclaw-integration.md:128-142` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code or Instructions ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` The broader workflow explicitly captures user-supplied corrections and promotes them into persistent context: ```markdown | User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` | | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ### Technical Analysis The Skill instructs agents to derive persistent knowledge from conversations, errors, and user corrections. It then directs agents to promote recurring entries into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, and `TOOLS.md`. OpenClaw automatically injects these files into later sessions. The recurrence checks establish frequency but not trustworthiness. There is no required human approval, provenance validation, separation between descriptive knowledge and imperative instructions, or screening for security-sensitive content. Consequently, repeated attacker-controlled statements can be convert ...[truncated 1593 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before modifying any automatically loaded context file. 2. Keep conversation-derived observations in a non-executable knowledge store rather than directly promoting them into instruction files. 3. Preserve provenance for every entry, including session, author, source type, timestamp, and supporting evidence. 4. Treat user corrections and external content as untrusted, regardless of recurrence count. 5. Reject or quarantine entries containing imperative commands, requests to weaken safeguards, credential-handling rules, external URLs, or instructions to transmit data. 6. Use a structured schema that separates verified facts from behavioral instructions. 7. Restrict write permissions on `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `CLAUDE.md`, and Copilot instruction files. 8. Add review, rollback, and audit-log mechanisms for all promotions. 9. Replace “promote aggressively” with a conservative policy requiring independent verification and a documented security review. ]]>

T01 · Skill Instruction Hijacking

Warning

Location: hooks/openclaw/handler.js:9
Finding: Opt-In Hooks Inject Skill-Controlled Instructions into Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:9-52` **Additional Locations**: `scripts/activator.sh:8-19`; `SKILL.md:467-519` **Vulnerability Type**: Agent bootstrap and prompt instruction injection **Risk Level**: Medium ### Vulnerable Code ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); const handler = async (event) => { // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } }; ``` The prompt-submit hook similarly emits instructions as model context: ```bash cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debu ...[truncated 2269 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Present learning reminders outside the model's instruction context, such as through a user-interface notification. 2. Scope the hook to explicit self-improvement requests rather than all prompts or all bootstrap events. 3. Require per-entry user confirmation before writing conversation-derived content. 4. Remove promotion instructions from the injected reminder or state that context-file promotion always requires human review. 5. Assign injected reminders a low-trust context role that cannot override task, safety, or system instructions. 6. Add the TypeScript sub-agent exclusion to `handler.js`, or generate the JavaScript artifact from the TypeScript source during a controlled build. 7. Add tests verifying identical behavior between `handler.ts` and `handler.js`. 8. Clearly disclose the exact activation scope, affected sessions, injected content, and disable procedure before installation. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Installation Instructions Retrieve Mutable Unpinned Skill Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-44` **Additional Location**: `references/openclaw-integration.md:29-40` **Vulnerability Type**: Unpinned third-party installation source **Risk Level**: Medium ### Vulnerable Instructions ```markdown ### Installation **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis Both installation methods resolve mutable upstream state. The registry command does not specify an audited version, while the Git command clones the repository's current default branch without pinning a commit or verifying a signature or checksum. The reviewed project does not itself fetch or execute a remote payload at runtime. The risk occurs during installation: content installed in the future may differ from the audited artifact. Because the package contains hooks and executable shell scripts that run with the agent user's permissions, compromise of the registry package, repository, maintainer account, or release process could introduce malicious behavior. ### Attack Path 1. An attacker compromises the package registry entry, upstream repository, maintainer account, or publishing process. 2. The attacker replaces or modifies hook and script content in the mutable upstream source. 3. A user follows the documented unpinned installation command. 4. The altered package is installed into the agent's Skill or hook directory. 5. The user enables the hook or invokes an included script. 6. The substituted code runs with the same operating-system permissions as the agent process. ### Impact Assessment A malicious replacement could obtain all privileges already held by the agent ...[truncated 441 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin registry installation to a specific audited version. 2. For Git installation, check out an immutable commit hash rather than the default branch. 3. Publish and verify SHA-256 checksums or signed release manifests. 4. Use signed Git tags and document how users should verify the signer. 5. Record the expected package owner, repository, release version, commit hash, and integrity digest. 6. Require review of installed hooks and scripts before enabling execution. 7. Separate hook installation from documentation-only Skill installation so executable components require an additional explicit trust decision. 8. Use an update process that displays diffs and requires approval before replacing installed executable files. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says this skill is for capturing learnings, errors, corrections, and other improvement signals. The supplied code does not implement learning capture, error logging, correction tracking, or review of prior learnings. Instead, it is a project utility that creates a new skill scaffold on disk from a skill name. That is a materially different primary purpose and includes undeclared file-creation behavior. While the comments mention creating a skill from a learning entry, the script only generates a template and does not actually record or process learnings themselves. Therefore, the description does not accurately represent the code chunk's behavior.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Writing to ~/.claude/settings.json affects the agent’s global configuration directory, creating durable behavior changes beyond a single project. In this context, that persistence is dangerous because it establishes automatic command execution for future sessions, potentially exposing unrelated work or surviving repository removal.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The description says to use the skill whenever a command fails unexpectedly, the user corrects the agent, a better approach is discovered, or before major tasks. These conditions are very broad in normal development conversations, and the file does not define clear limits or exclusions for when the skill should not activate.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 84% confidence
Finding: The skill explicitly establishes persistent storage under a home-directory workspace, enabling retention of potentially sensitive operational history across sessions. Persistence is core to the skill’s design, so in this context it is more dangerous than ordinary temporary note-taking because retained content may outlive user expectations and be reused elsewhere.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill encourages sharing learnings across sessions and reading other session transcripts, which can propagate sensitive user-provided information far beyond the original context. Cross-session persistence and transmission materially increase data-retention and unauthorized-disclosure risk, especially in multi-agent environments.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The prescribed logging template asks for full context, inputs, and user context, which directly incentivizes storing sensitive user data in durable plain-text records. In a skill whose purpose is retention and later promotion, this is a clear data-handling weakness with real downstream leakage risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The error logging format instructs agents to record actual error output, command context, and input parameters, which commonly contain credentials, tokens, URLs, file paths, prompts, or personal data. Because the data is persisted in markdown files, accidental secret retention and later exposure become likely, especially if the repository or workspace is shared.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The automatic trigger phrases are extremely common conversational patterns, so the skill may capture and persist information from ordinary dialogue without meaningful scoping or consent checks. In the context of a persistence-focused skill, this increases the chance of storing sensitive user content or internal reasoning artifacts in durable files.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The instruction to 'promote aggressively' into long-lived context files raises the chance that sensitive, user-derived, or transient information becomes embedded in durable agent memory. Once promoted into always-loaded guidance files, the blast radius and persistence of any leaked content increase substantially.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 86% confidence
Finding: The guide instructs users to create persistent hook configuration in .claude/settings.json, causing the behavior to automatically recur across future sessions in that repository. While persistence is part of the feature, it still represents a security-relevant risk because command hooks remain enabled until explicitly removed and may be forgotten.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: An empty matcher causes the hook to run on every prompt, creating an always-on interception point for user interactions. In this skill context, broad automatic triggering increases exposure of sensitive prompts and makes any future script change or compromise much more impactful.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The user-level configuration installs the hook in ~/.claude/settings.json for global activation, causing it to run across all projects and sessions without contextual limits. This broad persistence magnifies risk because prompts from unrelated or sensitive work may be processed by the hook script automatically.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The minimal setup still uses an empty matcher, so even the ‘lower overhead’ option remains always-on for every prompt. This preserves the core security issue of unnecessary broad execution despite presenting the configuration as safer or lighter-weight.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The Codex CLI example repeats the empty matcher pattern, extending the same always-on behavior to another agent environment. Reproducing insecure defaults across tools increases the chance of widespread deployment and normalizes overbroad hook execution.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document’s security section understates script behavior by claiming the hooks only output text and do not run commands, while the configuration explicitly registers shell commands as hooks and elsewhere references a script that creates skill scaffolding. This can mislead users into granting trust or permissions under false assumptions, increasing the chance they deploy automation without appropriate review.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 90% confidence
Finding: The instructions explicitly create persistent `.learnings/` storage in the workspace or skill directory, enabling retention of model-derived or user-derived content across sessions. In the context of a self-improvement skill that later reuses workspace files as prompt context, this persistence can preserve sensitive data or malicious prompt content and amplify it over time.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide recommends logging learnings to persistent workspace files and promoting them into AGENTS.md, SOUL.md, or TOOLS.md without warning that these files may later be injected into prompts or retained long-term. This creates a realistic risk of storing secrets, sensitive user data, or attacker-supplied prompt injection content in durable memory that can influence future sessions.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The 'Detection Triggers' section lists generic conditions like 'Knowledge gaps', 'API errors', and 'User corrections' without defining boundaries, exclusions, or exact activation behavior. In a markdown skill guide, such broad natural-language triggers can overlap with many ordinary interactions and make it unclear when the skill should activate versus remain idle.

Static analysis

No suspicious patterns detected.