Self-Improving OpenClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:04 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed self-improvement memory system, but it can automatically turn conversation-derived content into persistent agent behavior without enough approval or trust controls.

Install only if you want an agent to maintain long-term local memory and you are prepared to review what it records. Before use, require explicit approval for every promotion into HOT.md, AGENTS.md, SOUL.md, TOOLS.md, or MEMORY.md, and treat all raw learning entries as untrusted until reviewed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: `. ``` `references/heartbeat-review.md:10-30` specifies the automated review and write process: ```markdown ### 2. Scan raw learnings Read `.learnings/LEARNINGS.md`, `.learnings/ERRORS.md`, and `.learnings/FEATURE_REQUESTS.md`. Count pending entries. ### 3. Evaluate recurrence For each pending entry: - Search all `.learnings/` files for similar entries (by keyword, domain, or pattern). - If a match exists: increment `Recurrence-Count` on the older entry, add `See Also` link. - If `Recurrence-Count >= 3 ...[truncated 4787 chars]:40

Finding

Untrusted Conversation Content Can Be Promoted into Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40-48, 63-73, 91-102, 116-143; references/heartbeat-review.md:10-30; references/promotion-rules.md:13-33; references/workspace-layout.md:37-48
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Code and Instructions

SKILL.md:40-48 accepts conversation-derived preferences as learning entries:

markdown

| Signal | Target file | Category |
|--------|-------------|----------|
| User corrects you | `LEARNINGS.md` | `correction` |
| User says "always/never do X" | `LEARNINGS.md` | `preference` |
| You discover something non-obvious | `LEARNINGS.md` | `insight` |
| Your knowledge was outdated | `LEARNINGS.md` | `knowledge_gap` |
| Found a better approach | `LEARNINGS.md` | `best_practice` |
| Command returns non-zero | `ERRORS.md` | — |
| Tool/API fails unexpectedly | `ERRORS.md` | — |
| User wants missing capability | `FEATURE_REQUESTS.md` | — |

SKILL.md:63-73 permits promotion into always-loaded and permanent behavior files:

markdown

### 3. Promote

Move validated patterns up the memory tiers:

| Condition | Promote to | Example |
|-----------|-----------|---------|
| Pattern used 2x, context-specific | `.self-improving/domains/*.md` or `projects/*.md` | "This repo uses pnpm" |
| Pattern used 3x in 7-30 days, cross-task | `.self-improving/HOT.md` | "User prefers concise answers" |
| Stable, long-term applicable | `SOUL.md` / `AGENTS.md` / `TOOLS.md` / `MEMORY.md` | "Never force push" |

See [references/promotion-rules.md](references/promotion-rules.md) for the full promotion/demotion rules.

SKILL.md:116-143 defines HOT.md as automatically loaded and identifies permanent promotion targets:

markdown

## Memory Tiers

| Tier | Location | Size limit | Behavior |
|------|----------|-----------|----------|
| RAW | `.learnings/` | Unlimited | Intake only, not auto-loaded |
| HOT | `.self-improving/HOT.md` | ≤80 lines | Always loaded at session sta
...[truncated 6070 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit approval for promotion

   • Never automatically promote conversation-derived content into HOT.md, SOUL.md, AGENTS.md, TOOLS.md, or MEMORY.md.
   • Display the exact proposed text, source entries, destination file, and diff to a trusted user.
   • Require an affirmative confirmation for each promotion.

2. Track and enforce provenance

   • Record the actor, conversation, timestamp, trust level, and original text for every learning.
   • Allow permanent promotion only when all supporting observations originate from an authenticated, authorized user.
   • Do not count repetition by the same untrusted source as independent corroboration.

3. Separate data from instructions

   • Store conversation-derived content as quoted, non-executable data.
   • Generate any actionable rule through a constrained transformation rather than copying user text verbatim.
   • Prevent raw text from being inserted into files interpreted as agent instructions.

4. Validate proposed rules

   • Reject or quarantine rules that request bypassing safety constraints, changing permissions, exposing secrets, suppressing confirmation, executing commands, downloading content, or altering security controls.
   • Apply allowlisted schemas for benign preference categories.
   • Send security-sensitive candidates to manual review regardless of recurrence.

5. Limit writable destinations

   • Prohibit automated writes to SOUL.md, AGENTS.md, and TOOLS.md.
   • Use a dedicated, lower-trust memory file whose entries cannot override system, developer, workspace, or security instructions.
   • Enforce precedence so learned memory is always subordinate to trusted policies.

6. Add integrity and rollback controls

   • Keep an append-only audit log of promotions.
   • Version memory files and support immediate rollback.
   • Periodically detect unexpected changes to permanent agent-control files.

7. **Harden heartbeat processi ...[truncated 258 chars]

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description presents an operational learning/memory-management skill that records incidents and promotes lessons into persistent workspace memory. The actual shell script is only a setup utility: it creates directories and copies or touches template files if they do not exist. While these folders/files support the declared workflow, the code chunk itself does not execute the core described behaviors. This is a material mismatch in primary purpose and implemented capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation conditions are broad and self-triggering, including cases like noticing a recurring pattern or reviewing during heartbeat, which can cause the agent to invoke the skill without clear user intent. In a self-modifying memory skill, that increases the risk of over-collection, persistence of untrusted content, and unintended writes to workspace memory files from ordinary conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The feature-request trigger phrases are generic enough to match normal conversation, so the skill may log benign dialogue as durable feature requests without the user's intent to create memory. Because this skill persists content into structured files and may later promote it into higher-tier memory, accidental capture can compound into misleading or privacy-impacting long-term state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.