Security audit

new-self-improving

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local memory system, but it can automatically turn conversation-derived patterns into persistent agent behavior without clear owner approval.

Install only if you intentionally want a persistent local learning system and are prepared to audit .learnings, .self-improving/HOT.md, AGENTS.md, SOUL.md, TOOLS.md, and MEMORY.md. Do not use it in shared or untrusted conversations unless you add an approval step before promotion and sanitize logged context beyond credentials and secrets.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

Location: `. ``` The automatic review implementation is specified in `references/heartbeat-review.md:17-30`: ```markdown ### 3. Evaluate recurrence For each pending entry: - Search all `.learnings/` files for similar entries (by keyword, domain, or pattern). - If a match exists: increment `Recurrence-Count` on the older entry, add `See Also` link. - If `Recurrence-Count >= 3` and within a 30-day window: add to `REVIEW_QUEUE.md`. ### 4. Process review queue For each item in `.learnings/REVIEW_QUEUE.md`: - Determi ...[truncated 3606 chars]:54
Finding: Untrusted Conversation Content Can Be Promoted into Persistent Agent Memory
Content: View full analysis
= 3` within 30 days: add to `.learnings/REVIEW_QUEUE.md`. 4. Update `.self-improving/heartbeat-state.md` with review timestamp. See [references/heartbeat-review.md](references/heartbeat-review.md) for the full review procedure. ### 3. Promote Move validated patterns up the memory tiers: | Condition | Promote to | Example | |-----------|-----------|---------| | Pattern used 2x, context-specific | `.self-improving/domains/*.md` or `projects/*.md` | "This repo uses pnpm" | | Pattern used 3x in 7-30 days, cross-task | `.self-improving/HOT.md` | "User prefers concise answers" | | Stable, long-term applicable | `SOUL.md` / `AGENTS.md` / `TOOLS.md` / `MEMORY.md` | "Never force push" | ``` From `SKILL.md:95-99`: ```markdown **Preferences** (→ LEARNINGS.md, category: preference): - "I like when you..." - "Always do X for me" - "Never do Y" - "My style is..." ``` From `SKILL.md:134-143`: ```markdown When a learning is stable enough for permanent workspace memory: | Learning type | Promote to | Example | |--------------|-----------|---------| | Behavioral patterns | `SOUL.md` | "Be concise, avoid disclaimers" | | Workflow improvements | `AGENTS.md` | "Spawn sub-agents for long tasks" | | Tool gotchas | `TOOLS.md` | "Git push needs auth first" | | User preferences/decisions | `MEMORY.md` | "Basim prefers Indonesian for casual chat" | Mark promoted entries as `Status: promoted` with `Promoted-To: `. ``` The auto ...[truncated 4003 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: There is a material mismatch between the declared purpose and the supplied code chunk. The description claims an active learning/memory-management skill that captures incidents and promotes them into tiered memory and OpenClaw workspace files. The actual script only bootstraps filesystem structure by creating .learnings/ and .self-improving/ directories and seeding a handful of template files if missing. This setup step may support the broader skill, but by itself it does not perform the core declared behaviors of intake, review, promotion, heartbeat integration, or permanent memory updates. Therefore the code chunk’s primary purpose is workspace initialization, not the described learning-log and memory-promotion workflow.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation conditions are broad and include subjective internal observations like noticing a recurring pattern or reviewing during maintenance. In an agent system, that can cause the skill to trigger without clear user intent and persist conversational data into workspace memory files, increasing the risk of oversharing, unnecessary retention, or storing sensitive content the user did not explicitly ask to save.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The feature-request trigger phrases are generic and common in normal conversation, so the skill may over-trigger and treat casual discussion as authorization to log persistent workspace entries. That creates a data-governance issue: benign chat can be transformed into durable memory, potentially including sensitive requests, intentions, or project details without explicit consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example promotes storing a user language preference in permanent memory, which can encode profile-like personal preferences without demonstrating explicit consent. While low severity, persistent preference storage can still create privacy and compliance issues if preferences are inferred or retained longer than necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file instructs the agent to append detailed operational context, error messages, and user feedback into persistent local learning files, but it does not require consent, minimization, or filtering beyond redacting secrets in one narrow case. In practice, conversation content, environment details, commands, project names, and recurring patterns can contain sensitive personal, proprietary, or security-relevant data that may be silently retained and later promoted into broader workspace memory files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.