lua

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:09 AM UTC
• Version: 1.0.0

Overview

The skill is not evidently malicious, but it encourages broad persistent logging and cross-session promotion of agent/user context with weak privacy and scope controls.

Install only if you are comfortable with agents keeping long-lived learning notes. Prefer project-local `.learnings/`, avoid global hooks unless you explicitly want always-on reminders, review entries before promotion, and redact secrets, customer data, private prompts, internal URLs, and sensitive command arguments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned Third-Party Repository Used as an Installation Source

Content

View full analysis

Remediation

View remediation

``` 2. Prefer immutable, signed release artifacts over direct default-branch clones. 3. Publish a SHA-256 checksum for each supported release and instruct users to verify it before installation. 4. Use signed Git tags or commits and document signature verification. 5. Treat hooks as executable code and require a separate review before enabling them. 6. Document the exact version and commit corresponding to the audited package. 7. If ClawdHub provides integrity locking or publisher verification, require and document those controls. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:92

Finding

Workspace Write Restriction Can Be Bypassed Through a Symlinked Output Directory

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The script attempts to confine generated files to the current workspace by rejecting absolute paths and `..` path segments. These checks validate only the textual representation of the path. They do not resolve the canonical destination or verify whether any existing path component is a symbolic link. A relative directory accepted by the validation can therefore be a symlink to a directory outside the workspace. Both `mkdir -p` and shell redirection follow symlinked parent directories, allowing the generated `SKILL.md` to be written outside the boundary claimed by the script. The skill-name validation prevents direct path traversal through `SKILL_NAME`, and the existing-directory check reduces overwrite opportunities. However, it does not prevent creation of a new skill directory and file beneath a symlinked external parent. ### Attack Path 1. An attacker or untrusted workspace creates a relative symlink: ```bash ln -s /tmp/external-target out ``` 2. The attacker causes the user or automation to invoke: ...[truncated 1293 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about maintaining and using learnings: capturing failures/corrections, recording continuous-improvement notes, and reviewing learnings before tasks. The actual code does not capture learnings, log errors/corrections, review prior learnings, or interact with a learning store except mentioning .learnings/LEARNINGS.md in a template. Instead, it is a filesystem scaffolding utility that creates a new skill directory and templated SKILL.md file from a skill name. That is a materially different primary purpose and includes undeclared file-creation capabilities. While the script is thematically related to learnings because it says it creates a skill from a learning entry, it does not implement the described learning-capture behavior.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly encourages sharing learnings across sessions and storing them in workspace memory files, creating a natural-language persistence and cross-session disclosure channel. Sensitive user data, secrets, proprietary code context, or internal incident details could be retained and later resurfaced to unrelated tasks or agents without consent.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow instructs the agent to record broad context, commands, inputs, parameters, and environment details into persistent markdown logs. In practice, these fields often contain credentials, tokens, file paths, internal URLs, customer data, or confidential prompts, making ordinary note-taking a data leakage mechanism.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The templates request 'full context,' 'user context,' and raw input/parameter details, which strongly biases agents toward persisting sensitive user-provided material verbatim. Because these logs are durable and may be reviewed or promoted later, the risk is not just immediate storage but repeated downstream exposure.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Directing users to place persistent hook configuration in ~/.claude/settings.json affects the agent's global config directory, which is a high-value persistence location. If a skill promotes command hooks there, any compromise, unsafe script update, or path substitution can silently affect all future sessions, increasing the risk of durable agent-behavior manipulation.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The user-level configuration installs an always-on hook in ~/.claude/settings.json with an empty matcher, causing the command to execute across all sessions and repositories. This widens the blast radius of any future script change, path hijack, or unintended behavior, making persistence and cross-project influence more dangerous than a project-scoped setup.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill when a command fails, when the user corrects the agent, when a capability is missing, when knowledge is outdated, and even to review learnings before major tasks. This covers very common situations without clear boundaries or exclusions, increasing the chance of unintended or over-frequent invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill directs creation of persistent storage under a user workspace/home path, enabling session persistence of collected information outside the immediate task context. Persistence alone is not always unsafe, but in this skill it materially compounds the logging and cross-session leakage risks because the stored data may survive indefinitely and be accessed later.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Phrases like 'Actually, it should be...', 'Can you also...', and 'Is there a way to...' are common conversational patterns that can appear in many contexts unrelated to durable learning capture. Because the section says to automatically log when these are noticed, the trigger set is too broad and may cause accidental activation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guidance to 'promote aggressively' into long-term memory and instruction files increases retention scope and lifetime for whatever was logged, including accidentally captured sensitive material. This magnifies both accidental disclosure and prompt contamination risk because future sessions may inherit or resurface inappropriate context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown template instructs authors to 'Include trigger conditions' but does not require those triggers to be specific, bounded, or accompanied by negative examples. Because this is a reusable template, it may propagate ambiguous activation descriptions into many downstream skill manifests or SKILL.md files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Quick Reference table uses generic placeholders '[Trigger 1]' and '[Trigger 2]' without guidance on the level of specificity required. In a template, this omission can cause authors to supply broad or unclear triggers, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The minimal template says 'What this skill does and when to use it,' but does not instruct authors to define precise activation conditions or exclusions. For markdown templates, this can result in broad invocation descriptions that collide with common user language.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The document instructs creation of persistent project configuration that automatically runs hook commands on future agent interactions. Even though persistence is presented as a legitimate feature, it creates an enduring execution pathway that can outlast user intent and increases exposure if the referenced scripts are later modified or abused.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file documents a UserPromptSubmit hook with "matcher": "", which is an effectively unbounded activation condition. Because the guide does not provide exclusion conditions or narrower trigger scope, it could cause the skill to run on routine everyday prompts rather than only relevant self-improvement situations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Although described as lower overhead, the minimal setup still activates on every UserPromptSubmit event because the matcher is empty. The documentation does not clarify boundaries or provide negative examples, so the trigger remains overly broad despite the reduced hook count.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Codex configuration mirrors the same unrestricted UserPromptSubmit matcher, resulting in universal activation. As written, the guide lacks specificity about the trigger scope and does not distinguish relevant prompts from ordinary conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The setup steps direct the user to copy a skill and hook into persistent OpenClaw directories and enable the hook, which changes local agent behavior and configuration. The document does not include an explicit warning that these actions modify the user's environment or may affect future sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file defines 'Standard Triggers' using very general conditions such as 'User corrections', 'API errors', and 'Knowledge gaps' without narrowing scope or giving exclusion examples. Those phrases are ambiguous enough to overlap with many normal interactions, making it unclear when the skill should trigger versus remain inactive.

Content

No source excerpt is available for this finding.