T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:23- Finding
Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent 3.0.5
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it asks agents to persist and promote conversation-derived learnings into future instruction files with broad automatic triggers and limited safeguards.
Install only if you want persistent agent memory. Prefer project-local setup over global hooks, avoid empty matchers where possible, keep .learnings ignored by default, redact secrets and user data before logging, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or copilot instruction files.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:170- Finding
Raw Command and Environment Details May Be Persisted Without Secret Redaction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about maintaining a learning/correction log for continuous improvement, triggered by failures, user corrections, missing capabilities, or outdated knowledge. The supplied code does not capture, store, review, or analyze learnings. Instead, it is a filesystem-writing helper script that creates a new skill scaffold under a skills directory and fills a template SKILL.md file. While the comments mention creating a skill from a learning entry, that is downstream of the declared purpose and materially different from a learning-capture mechanism. Therefore the code's primary function is mismatched with the declared description.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Directing users to modify ~/.claude/settings.json introduces agent configuration directory persistence at the user level. In this context, that is dangerous because it establishes durable behavior affecting future sessions and projects, and any malicious or unsafe hook configuration placed there executes automatically with the agent's privileges.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages invocation on broad conditions like failures, corrections, and major tasks, which can cause the agent to activate this workflow in many normal interactions and write persistent artifacts without clear user intent each time. In a prompt-injected or tool-enabled environment, ambiguous activation criteria increase the chance of over-collection, unnecessary file writes, and accidental propagation of sensitive conversational content into durable memory files.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The skill explicitly instructs creation of persistent files under ~/.openclaw/workspace/.learnings, enabling cross-session retention of errors, corrections, and potentially sensitive context. Persistent agent memory is security-relevant because it can accumulate secrets, internal paths, operational details, or attacker-seeded instructions that later influence future sessions or other agents.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are extremely common in ordinary conversation and are treated as automatic signals to persist data, which makes unintended activation likely. Because these phrases can occur in adversarial prompts, quoted text, or benign discussion, the skill may misclassify context and store sensitive, misleading, or attacker-planted content into .learnings or promoted instruction files.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
Project-level hook configuration creates session-persistent automated behavior that survives across agent runs within the repository. While not inherently malicious, persistence is security-relevant here because it can silently continue executing scripts on future prompts and tool events after the original setup context is forgotten.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
An empty matcher causes the hook to run on every prompt, creating a broad interception point for all user interactions. In this skill's context, that increases exposure of prompt content to hook scripts and makes any bug, malicious modification, or excessive output affect all sessions rather than only relevant workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-level configuration installs the hook globally in ~/.claude/settings.json, causing broad automatic execution across projects and sessions. That persistence expands blast radius: a compromised or incorrect script path affects unrelated workspaces, may expose sensitive prompts across contexts, and is harder for users to notice and audit.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Although labeled 'minimal,' this setup still uses an empty matcher and therefore triggers on every prompt. That means reduced hook count does not meaningfully reduce the core security issue of indiscriminate activation and universal prompt exposure to the script.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Codex example repeats the empty matcher pattern, extending the same broad-trigger risk to another agent environment. This can interfere with normal prompt flow and ensures the hook executes for all prompts, amplifying the impact of any script misuse or unexpected behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The security section materially misrepresents the behavior and trust boundary of the referenced scripts. Even if the hooks are intended to emit text, they are configured as executable command hooks and therefore execute with the agent's privileges; understating that capability can cause operators to deploy them with less scrutiny and miss downstream risks if the scripts are modified or replaced.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The integration explicitly instructs creation of persistent
.learnings/storage in the workspace or skill directory, enabling information gathered in one interaction to survive into later sessions. In a self-improvement skill, this increases the risk that sensitive prompts, errors, credentials, or attacker-injected content are retained and later reintroduced into model context.- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'Standard Triggers' list includes broad conditions like 'Knowledge gaps', 'API errors', and 'Command failures' without defining scope, thresholds, or exclusions. In a markdown skill guide, these vague triggers could cause unintended or overly frequent invocation or logging behavior because it is unclear when the skill should act versus ignore routine events.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a skill focused on recording and reviewing learnings for continuous improvement. This script goes beyond capturing learnings by scaffolding entirely new skills on disk, including creating directories and writing templated SKILL.md files, which is a materially different operation from merely storing or reviewing corrections.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Creating a new reusable skill directory and template is a development/scaffolding capability, not an obvious requirement for a skill whose stated role is to capture learnings, errors, and corrections. The ability to generate new skill artifacts introduces a broader repository-modification function than the manifest suggests.
- Content
Static analysis
No suspicious patterns detected.