Security audit

lua

Security checks for vulnerabilities and agentic risk

Overview

The skill is not evidently malicious, but it encourages broad persistent logging and cross-session promotion of agent/user context with weak privacy and scope controls.

Install only if you are comfortable with agents keeping long-lived learning notes. Prefer project-local `.learnings/`, avoid global hooks unless you explicitly want always-on reminders, review entries before promotion, and redact secrets, customer data, private prompts, internal URLs, and sensitive command arguments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:38
Finding: Unpinned Third-Party Repository Used as an Installation Source<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-44 **Vulnerability Type**: Unpinned and mutable third-party supply-chain dependency **Risk Level**: Medium ### Vulnerable Code ```markdown **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis The documented manual installation clones the default branch of a third-party GitHub repository directly into OpenClaw's trusted skill directory. The command does not pin an immutable commit, verify a release signature, or validate a cryptographic checksum. Consequently, the content installed by a user can differ from the artifact reviewed during this audit. If the upstream repository, maintainer account, or default branch is compromised, an attacker could modify `SKILL.md`, hook handlers, or shell scripts. OpenClaw could then load the altered instructions, and users could enable or invoke altered executable components. This is a supply-chain trust issue rather than confirmed malicious behavior in the audited package. No malicious remote payload was found in the current artifact. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, or the default branch. 2. The attacker replaces skill instructions or hook scripts with malicious content. 3. A user follows the documented `git clone` command without selecting a reviewed commit. 4. The mutable repository content is copied into `~/.openclaw/skills/self-improving-agent`. 5. OpenClaw loads the modified skill instructions. 6. If the user follows the optional hook setup, modified hook code may also run with the permissions of the OpenClaw process. ### I ...[truncated 553 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin manual installation to a reviewed commit rather than the mutable default branch: ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent git -C ~/.openclaw/skills/self-improving-agent checkout --detach <reviewed-commit-sha> ``` 2. Prefer immutable, signed release artifacts over direct default-branch clones. 3. Publish a SHA-256 checksum for each supported release and instruct users to verify it before installation. 4. Use signed Git tags or commits and document signature verification. 5. Treat hooks as executable code and require a separate review before enabling them. 6. Document the exact version and commit corresponding to the audited package. 7. If ClawdHub provides integrity locking or publisher verification, require and document those controls. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract-skill.sh:92
Finding: Workspace Write Restriction Can Be Bypassed Through a Symlinked Output Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh`, lines 92-106 and 174-177 **Vulnerability Type**: Path validation bypass through symbolic-link traversal **Risk Level**: Medium ### Vulnerable Code ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" ``` The validated lexical path is later used directly as a filesystem destination: ```bash # Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script attempts to confine generated files to the current workspace by rejecting absolute paths and `..` path segments. These checks validate only the textual representation of the path. They do not resolve the canonical destination or verify whether any existing path component is a symbolic link. A relative directory accepted by the validation can therefore be a symlink to a directory outside the workspace. Both `mkdir -p` and shell redirection follow symlinked parent directories, allowing the generated `SKILL.md` to be written outside the boundary claimed by the script. The skill-name validation prevents direct path traversal through `SKILL_NAME`, and the existing-directory check reduces overwrite opportunities. However, it does not prevent creation of a new skill directory and file beneath a symlinked external parent. ### Attack Path 1. An attacker or untrusted workspace creates a relative symlink: ```bash ln -s /tmp/external-target out ``` 2. The attacker causes the user or automation to invoke: ...[truncated 1293 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Capture and canonicalize the workspace root before constructing the output path: ```bash WORKSPACE_ROOT="$(realpath -e -- "$PWD")" ``` 2. Reject output paths containing symlink components. For example, walk each existing component with `lstat` or `test -L` before creating directories. 3. Resolve the closest existing parent with `realpath -e`, then verify that it remains beneath `WORKSPACE_ROOT`. 4. After directory creation, resolve the final skill directory and enforce a boundary check: ```bash RESOLVED_SKILL_PATH="$(realpath -e -- "$SKILL_PATH")" case "$RESOLVED_SKILL_PATH" in "$WORKSPACE_ROOT"/*) ;; *) log_error "Resolved output path escapes the workspace." exit 1 ;; esac ``` 5. Perform the validation and creation using directory file descriptors and no-follow semantics where the target platform supports them, reducing time-of-check/time-of-use race opportunities. 6. Refuse operation when the output directory or any parent component is writable by an untrusted party. 7. Add regression tests covering: - Absolute paths. - `..` traversal. - A symlinked output directory. - A symlink in an intermediate path component. - Replacement of a checked directory with a symlink between validation and file creation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about maintaining and using learnings: capturing failures/corrections, recording continuous-improvement notes, and reviewing learnings before tasks. The actual code does not capture learnings, log errors/corrections, review prior learnings, or interact with a learning store except mentioning .learnings/LEARNINGS.md in a template. Instead, it is a filesystem scaffolding utility that creates a new skill directory and templated SKILL.md file from a skill name. That is a materially different primary purpose and includes undeclared file-creation capabilities. While the script is thematically related to learnings because it says it creates a skill from a learning entry, it does not implement the described learning-capture behavior.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill explicitly encourages sharing learnings across sessions and storing them in workspace memory files, creating a natural-language persistence and cross-session disclosure channel. Sensitive user data, secrets, proprietary code context, or internal incident details could be retained and later resurfaced to unrelated tasks or agents without consent.

Ssd 3

High

Confidence: 98% confidence
Finding: The workflow instructs the agent to record broad context, commands, inputs, parameters, and environment details into persistent markdown logs. In practice, these fields often contain credentials, tokens, file paths, internal URLs, customer data, or confidential prompts, making ordinary note-taking a data leakage mechanism.

Ssd 3

High

Confidence: 99% confidence
Finding: The templates request 'full context,' 'user context,' and raw input/parameter details, which strongly biases agents toward persisting sensitive user-provided material verbatim. Because these logs are durable and may be reviewed or promoted later, the risk is not just immediate storage but repeated downstream exposure.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Directing users to place persistent hook configuration in ~/.claude/settings.json affects the agent's global config directory, which is a high-value persistence location. If a skill promotes command hooks there, any compromise, unsafe script update, or path substitution can silently affect all future sessions, increasing the risk of durable agent-behavior manipulation.

Vague Triggers

High

Confidence: 98% confidence
Finding: The user-level configuration installs an always-on hook in ~/.claude/settings.json with an empty matcher, causing the command to execute across all sessions and repositories. This widens the blast radius of any future script change, path hijack, or unintended behavior, making persistence and cross-project influence more dangerous than a project-scoped setup.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description says to use the skill when a command fails, when the user corrects the agent, when a capability is missing, when knowledge is outdated, and even to review learnings before major tasks. This covers very common situations without clear boundaries or exclusions, increasing the chance of unintended or over-frequent invocation.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 84% confidence
Finding: The skill directs creation of persistent storage under a user workspace/home path, enabling session persistence of collected information outside the immediate task context. Persistence alone is not always unsafe, but in this skill it materially compounds the logging and cross-session leakage risks because the stored data may survive indefinitely and be accessed later.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: Phrases like 'Actually, it should be...', 'Can you also...', and 'Is there a way to...' are common conversational patterns that can appear in many contexts unrelated to durable learning capture. Because the section says to automatically log when these are noticed, the trigger set is too broad and may cause accidental activation.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The guidance to 'promote aggressively' into long-term memory and instruction files increases retention scope and lifetime for whatever was logged, including accidentally captured sensitive material. This magnifies both accidental disclosure and prompt contamination risk because future sessions may inherit or resurface inappropriate context.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: This markdown template instructs authors to 'Include trigger conditions' but does not require those triggers to be specific, bounded, or accompanied by negative examples. Because this is a reusable template, it may propagate ambiguous activation descriptions into many downstream skill manifests or SKILL.md files.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The Quick Reference table uses generic placeholders '[Trigger 1]' and '[Trigger 2]' without guidance on the level of specificity required. In a template, this omission can cause authors to supply broad or unclear triggers, increasing the risk of unintended invocation.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The minimal template says 'What this skill does and when to use it,' but does not instruct authors to define precise activation conditions or exclusions. For markdown templates, this can result in broad invocation descriptions that collide with common user language.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 78% confidence
Finding: The document instructs creation of persistent project configuration that automatically runs hook commands on future agent interactions. Even though persistence is presented as a legitimate feature, it creates an enduring execution pathway that can outlast user intent and increases exposure if the referenced scripts are later modified or abused.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: This markdown file documents a `UserPromptSubmit` hook with `"matcher": ""`, which is an effectively unbounded activation condition. Because the guide does not provide exclusion conditions or narrower trigger scope, it could cause the skill to run on routine everyday prompts rather than only relevant self-improvement situations.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Although described as lower overhead, the minimal setup still activates on every `UserPromptSubmit` event because the matcher is empty. The documentation does not clarify boundaries or provide negative examples, so the trigger remains overly broad despite the reduced hook count.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The Codex configuration mirrors the same unrestricted `UserPromptSubmit` matcher, resulting in universal activation. As written, the guide lacks specificity about the trigger scope and does not distinguish relevant prompts from ordinary conversation.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The setup steps direct the user to copy a skill and hook into persistent OpenClaw directories and enable the hook, which changes local agent behavior and configuration. The document does not include an explicit warning that these actions modify the user's environment or may affect future sessions.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: This markdown file defines 'Standard Triggers' using very general conditions such as 'User corrections', 'API errors', and 'Knowledge gaps' without narrowing scope or giving exclusion examples. Those phrases are ambiguous enough to overlap with many normal interactions, making it unclear when the skill should trigger versus remain inactive.

Static analysis

No suspicious patterns detected.