Heleni Self Learning

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 1.0.0

Overview

This self-improvement skill is disclosed, but it gives broad persistent authority over memory, identity, skills, configuration, and scheduled tasks without enough scoping or secret protections.

Review before installing. This skill may be useful if you intentionally want an agent to keep long-term self-improvement notes, but install it only if you are comfortable with persistent behavior changes and broad reads of personal memory and configuration. Do not let it store passwords, tokens, API keys, private keys, recovery codes, or sensitive personal data in Markdown files, and require exact per-file approval before any change to SOUL.md, HOT.md, MEMORY.md, skills, config, cron jobs, or commits.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:322

Finding

Persistent Behavioral Rule Injection Through HOT.md and SOUL.md

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 322–348
Vulnerability Type: Persistent memory and behavioral-rule poisoning
Risk Level: Critical

Vulnerable Code Snippet:

markdown

`HOT.md` is a short file (≤20 lines) read **before every reply**. It contains only rules you've broken 2+ times. Not documentation — active behavioral correction.

### When to Create / Update

- A rule appears in Part 1 logs **twice or more** → promote to HOT.md
- HOT.md grows beyond 20 lines → you have a discipline problem, not a documentation problem. Fix the behavior, don't add more lines.
- A rule stays unbroken for 30+ days → move it to SOUL.md permanently, remove from HOT.md

### Format

```markdown
# HOT.md — Rules I Keep Breaking
_Read before every reply. Max 20 lines. If it's not here, it doesn't count._

- [Rule 1 — short, imperative] (broken N times)
- [Rule 2] (broken N times)

Promotion Flow

text

Log (Part 1) → Pattern 2x (Part 3 weekly) → HOT.md → 30 days clean → SOUL.md permanent

Key Rule

If it should apply to EVERY interaction → SOUL.md.

text

Related automatic modification logic appears at lines 167–199:

```bash
**Rule:** If the same mistake appears 2+ times → promote it. Once is a log; twice is a rule.

SOUL_FILE="$HOME/.openclaw/workspace/SOUL.md"
LEARNINGS_FILE="$HOME/.openclaw/workspace/.learnings/LEARNINGS.md"
DATE=$(date +%Y-%m-%d)

RULE="[Replace this with the actual rule text]"

printf "\n## Learned Rule — %s\n- %s\n" "$DATE" "$RULE" >> "$SOUL_FILE"

Technical Analysis

The Skill treats interaction-derived learning entries as behavioral instructions and promotes them into files that govern future Agent behavior. A rule recorded twice can be moved into HOT.md, which is expressly read before every reply. It can subsequently be transferred into the permanent identity file SOUL.md.

The workflow does not establish a trust boundary ...[truncated 1368 chars]

Remediation

View remediation

Remediation Suggestions

• Do not convert conversation-derived text directly into executable behavioral instructions.
• Store learning records in a dedicated data file that is never loaded as an instruction source.
• Require explicit owner approval of the exact proposed rule and exact file diff before modifying HOT.md or SOUL.md.
• Validate proposed rules against system-level security policies and reject rules that broaden permissions, suppress safeguards, expose secrets, or override approval requirements.
• Record the source, timestamp, approver, and cryptographic integrity metadata for every promoted rule.
• Add rollback support and preserve versioned backups for all identity-file changes.
• Remove automatic promotion based solely on occurrence count; repetition is not evidence that content is safe or trustworthy.
• Prevent lower-trust users and external content from initiating persistent behavioral updates.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:322

Finding

Unconditional Loading of Mutable Instructions Before Every Reply

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 322
Vulnerability Type: Session instruction hijacking
Risk Level: High

Vulnerable Code Snippet:

markdown

`HOT.md` is a short file (≤20 lines) read **before every reply**. It contains only rules you've broken 2+ times. Not documentation — active behavioral correction.

A related response-order directive appears at line 37:

markdown

**Rule:** Log the event before replying to the owner. Don't delay.

Technical Analysis

The Skill requires a mutable workspace file to be loaded as active instructions before every response. This changes the Agent's execution flow globally rather than limiting the learning process to an explicit reflection task. Because HOT.md is populated from interaction-derived content, it cannot safely be assumed to have the same trust level as system or owner instructions.

Loading the file unconditionally creates an instruction-injection boundary: any malicious or improperly validated rule written into HOT.md receives influence over all subsequent sessions in which the file is read. The requirement to perform logging before responding also allows the Skill to alter response ordering even during unrelated or urgent tasks.

Attack Path

1. Malicious or misleading content enters the learning workflow as a purported correction.
2. The content is placed into HOT.md after being observed repeatedly.
3. A later, unrelated interaction begins.
4. Before answering, the Agent reads HOT.md and treats its mutable contents as active behavioral rules.
5. The injected rule changes the Agent's immediate goal, response, tool selection, or application of safety constraints.

Impact Assessment

Exploitation can influence every response produced while the poisoned file remains active. The scope includes unrelated conversations and tasks, potentially changing response priorities, suppressing expected checks, redirecti ...[truncated 104 chars]

Remediation

View remediation

Remediation Suggestions

• Do not read mutable learning files as instructions before every reply.
• Process learning records only during an explicit, owner-initiated reflection operation.
• Parse learning records as inert data and never concatenate them into an instruction context.
• Enforce instruction precedence so learning content cannot override system, developer, security, or current-task requirements.
• Require trusted approval before a learning is transformed into an active rule.
• Scope approved rules to the relevant task or capability instead of applying them globally.
• Remove the unconditional requirement to log before replying; logging should not delay urgent, safety-sensitive, or owner-requested responses.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:164

Finding

Plaintext Credential Storage in Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 164
Vulnerability Type: Insecure storage of sensitive information
Risk Level: High

Vulnerable Code Snippet:

markdown

| Contact / credentials | MEMORY.md |

The reflection workflow subsequently directs the Agent to read that file at lines 283–287:

markdown

**2. Deep System Scan**
Read ALL relevant parts before changing anything:
- Core identity: SOUL.md, AGENTS.md, USER.md, MEMORY.md, TOOLS.md
- All active skills (custom + bundled + workspace)
- Configuration (model, tools, channels, heartbeat, cron jobs)

Technical Analysis

The Skill explicitly designates a Markdown memory file as the destination for credentials. No encryption, file-permission enforcement, redaction, secret-manager integration, access segregation, or retention policy is specified. MEMORY.md is also included in broad reflection scans, which can place stored credentials into model context even when they are irrelevant to the current task.

Plaintext workspace files may additionally be captured in backups, logs, repository commits, context snapshots, or tool output. The later instruction to commit workspace changes further increases the possibility of accidental secret retention if proper exclusions are absent.

Attack Path

1. A credential is encountered during a task or learning event.
2. Following the promotion table, the Agent writes the credential into MEMORY.md.
3. A later reflection performs the prescribed deep scan and reads MEMORY.md.
4. The plaintext secret enters the Agent context and may appear in generated output, logs, diagnostics, or tool calls.
5. If workspace changes are committed or backed up, the secret may persist in repository history or external storage.

Impact Assessment

Exposed credentials may grant the privileges associated with the affected account, API, service, or infrastructure resource. The exact scope depend ...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

• Prohibit storing passwords, API keys, tokens, private keys, recovery codes, or other secrets in MEMORY.md and all Markdown files.
• Use an approved operating-system keychain or dedicated secret manager.
• Store only opaque secret identifiers or references in workspace memory.
• Redact sensitive values before writing learning logs or presenting reflection reports.
• Restrict file permissions and context access according to least privilege.
• Exclude secret-bearing files from version control, backups, diagnostic bundles, and model context.
• Add automated secret scanning before commits and after workspace modifications.
• Define secret rotation and incident-response procedures for credentials found in existing memory or repository history.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:283

Finding

Overbroad Access to Identity, Memory, Tools, Configuration, and Scheduled Tasks

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 283–307
Vulnerability Type: Violation of least-privilege boundaries
Risk Level: Medium

Vulnerable Code Snippet:

markdown

**2. Deep System Scan**
Read ALL relevant parts before changing anything:
- Core identity: SOUL.md, AGENTS.md, USER.md, MEMORY.md, TOOLS.md
- All active skills (custom + bundled + workspace)
- Configuration (model, tools, channels, heartbeat, cron jobs)

Read broadly, change surgically.

**3. Diagnose & Propose**
Present findings:
1. Root cause — what causes the unwanted behavior
2. Proposed changes — specific files and edits
3. Side effects — anything else affected
4. Alternatives — if multiple approaches exist

**4. Implement (after approval)**
- Edit workspace files (persona, memory, etc.)
- Edit/create/modify skills
- Update config and cron jobs
- Every change must be technically concrete. "I'll be more careful" is NOT a valid change.

**5. Verify & Document**
- Test the change if possible
- Document what changed and why
- Commit workspace changes

Technical Analysis

A logging and self-reflection Skill does not inherently require unrestricted access to identity files, user memory, every installed skill, tool configuration, communication channels, heartbeat configuration, cron jobs, and repository history. The instruction to read broadly occurs before the implementation approval step, so approval does not protect sensitive information from initial collection.

The permitted implementation scope includes modifying skills, configuration, and cron jobs. If poisoned learning content or an incorrect diagnosis reaches the implementation stage, the changes can affect capabilities beyond the original self-reflection task. Committing the changes can also make unsafe modifications durable and complicate removal.

Attack Path

1. An attacker or untrusted interaction triggers the reflection process ...[truncated 1068 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the broad scan with a task-specific allowlist of files and settings.
• Require explicit approval before reading sensitive memory, user profiles, channel configuration, credentials, or unrelated skills.
• Separate read and write permissions and grant each only for the minimum required duration.
• Prohibit cron, channel, tool, and global configuration changes by default for a self-reflection workflow.
• Require per-file, per-setting approval using an exact diff rather than accepting general implementation approval.
• Validate modifications in an isolated workspace before applying them to active configuration.
• Do not automatically commit changes; present the diff and require a distinct confirmation for the commit.
• Maintain audit logs and backups, and provide a tested rollback process for every approved modification.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description and body encourage persistent logging of owner interactions and promotion of contact or credential information into memory files, but provide no privacy boundaries, redaction rules, or sensitivity checks. This creates a direct risk of storing secrets, personal data, and sensitive operational details in long-lived plaintext files.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The logging rules direct the agent to record owner corrections, missing capabilities, context failures, and other interaction-derived content to persistent files immediately, before replying. In practice, that can capture sensitive user-provided information or confidential workflow context without consent, filtering, or minimization.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill authorizes editing or creating skills and updating config and cron jobs under the umbrella of self-learning, which grants effective system-maintenance and persistence capabilities beyond the manifest description. If invoked casually, this can turn ordinary feedback into durable behavioral or scheduling changes that alter the wider agent environment.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The skill explicitly permits creating and modifying skills as part of self-improvement, which is a self-modification capability with durable behavioral impact. Self-modification is dangerous because it can compound mistakes, bypass intended review boundaries, and establish persistent changes that affect future tasks beyond the original scope.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md

**4. Implement (after approval)**
- Edit workspace files (persona, memory, etc.)
- Edit/create/modify skills
- Update config and cron jobs
- Every change must be technically concrete. "I'll be more careful" is NOT a valid change.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest activates on very broad conditions like corrections, failures, better approaches, recurring patterns, and weekly reflection, which can match many normal interactions. Over-broad triggering increases the chance the skill runs unnecessarily, causing excess logging, file access, or persistent behavior changes without clear user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reflection phase instructs the agent to broadly scan core identity files, memory, all active skills, configuration, and cron jobs even though the skill is presented as a self-learning/logging mechanism. This unnecessarily expands the skill's authority and data access, increasing the chance of unrelated sensitive data exposure and out-of-scope modifications during routine 'improvement' workflows.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The 'read ALL relevant parts' instruction explicitly includes MEMORY.md and all active skills, encouraging comprehensive access to sensitive context during reflection. Even if intended for diagnosis, this broad collection model violates least privilege and can expose unrelated secrets or personal context to a workflow that should mainly analyze learnings.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.