my-first-test-01

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 1.0.2

Overview

This is mostly a self-improvement note-taking skill, but it needs Review because it can persistently affect future agent behavior through broad hooks, memory files, and unclear package identity.

Install only if you intentionally want durable learning notes and reminders that may influence future agent sessions. Verify the package identity before installing, prefer project-local .learnings storage, avoid global hooks with empty matchers unless you want every prompt to trigger them, and review/redact entries before promoting anything into agent memory or prompt files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill description focuses on logging learnings, but the body also instructs agents to install hooks, inspect tool output, and scaffold new skills. This expands the operational scope beyond passive note-taking into persistent automation and code-generation, which can surprise users and increase attack surface if enabled without clear consent.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document tells users to configure hooks with `type: "command"` that execute shell scripts, then later claims the scripts 'only output text' and 'don't modify files or run commands.' That is misleading because invoking a shell script is itself command execution, and such assurances can cause users to underestimate the trust boundary and grant these hooks broader deployment than they otherwise would.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: An empty matcher on `UserPromptSubmit` causes the hook to run on every prompt, creating always-on behavior for the project. In this skill context, that broad trigger scope increases exposure to prompt-derived sensitive data and expands the blast radius of any mistake or later script change.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The user-level configuration installs the hook globally with an empty matcher, so it will trigger across all sessions and repositories. In a self-improvement skill, this is more dangerous because it turns a project-specific learning aid into persistent cross-context behavior, increasing the chance of capturing or acting on unrelated sensitive prompts everywhere the tool is used.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The Codex CLI example repeats the same empty-matcher pattern, making the hook fire on every prompt in that environment. Broad unfiltered triggering is risky because it normalizes always-on command execution hooks and can unintentionally expose prompt contents or amplify errors across routine usage.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 86% confidence
• Finding: Create Learning Files ```bash mkdir -p ~/.openclaw

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.