ClawHub
Back to skill

Security audit

Self Improving Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill’s self-improvement purpose is coherent, but it encourages persistent agent-memory changes and cross-session context use without enough approval, redaction, or scoping safeguards.

Install only if you want an always-available self-improvement memory workflow and are prepared to supervise it. Keep .learnings local by default, redact secrets and personal or business-sensitive details before logging, avoid raw transcripts or command outputs, require explicit review before promoting anything into agent instruction files, and be cautious with global hooks or cross-session transcript tools.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:19
Finding

Untrusted Conversation Content Can Poison Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:19-25, SKILL.md:67-74, SKILL.md:284-314, hooks/openclaw/handler.js:13-25, hooks/openclaw/handler.ts:14-26, references/openclaw-integration.md:126-142
Vulnerability Type: Persistent memory poisoning through insufficiently validated promotion of conversational content
Risk Level: High

Vulnerable Code

markdown
| User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` |
| User wants missing feature | Log to `.learnings/FEATURE_REQUESTS.md` |
| Knowledge was outdated | Log to `.learnings/LEARNINGS.md` with category `knowledge_gap` |
| Found better approach | Log to `.learnings/LEARNINGS.md` with category `best_practice` |
| Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` |
| Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) |
| Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) |

The OpenClaw hook reinforces the same promotion workflow:

javascript
**Log when:**
- User corrects you → `.learnings/LEARNINGS.md`
- Command/operation fails → `.learnings/ERRORS.md`
- User wants missing capability → `.learnings/FEATURE_REQUESTS.md`
- You discover your knowledge was wrong → `.learnings/LEARNINGS.md`
- You find a better approach → `.learnings/LEARNINGS.md`

**Promote when pattern is proven:**
- Behavioral patterns → `SOUL.md`
- Workflow improvements → `AGENTS.md`
- Tool gotchas → `TOOLS.md`

Technical Analysis

The Skill treats user corrections, model-generated conclusions, and observed behavioral patterns as candidates for persistent storage. It subsequently directs the agent to promote selected entries into files such as SOUL.md, AGENTS.md, TOOLS.md, CLAUDE.md, and .github/copilot-instructions.md.

These files may be injected into later agent sessions and can function as durable behavioral or operational ...[truncated 1845 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit human approval before promoting any learning into an automatically loaded agent-context file.
  2. Present the exact target-file diff and the source conversation before requesting approval.
  3. Preserve provenance, including the originating user, session, timestamp, source message, and whether the claim was independently verified.
  4. Never promote raw user or model text. Convert verified facts into constrained, declarative project documentation.
  5. Reject proposed entries that modify safety controls, access boundaries, approval requirements, credential handling, or tool permissions.
  6. Separate factual project memory from executable agent instructions and apply stricter controls to the latter.
  7. Require independent evidence before incrementing recurrence counters; repeated claims from one user or session must not establish trust.
  8. Remove or revise guidance encouraging aggressive promotion.
  9. Provide rollback and audit-history mechanisms for all modifications to persistent context files.
  10. Treat shared memory files as security-sensitive configuration and protect them with repository review or ownership rules.

T01 · Skill Instruction Hijacking

Warning
Location
scripts/activator.sh:8
Finding

Opt-In Hooks Continuously Inject Instructions That Encourage Persistent Writes

Content
View full analysis

Vulnerability Details

File Location: scripts/activator.sh:8-20, hooks/openclaw/handler.js:8-25, hooks/openclaw/handler.js:28-52, hooks/openclaw/handler.ts:10-26, hooks/openclaw/handler.ts:28-60, SKILL.md:457-494
Vulnerability Type: Repeated agent-context steering through prompt and bootstrap hooks
Risk Level: Medium

Vulnerable Code

bash
# Output reminder as system context
cat << 'EOF'
<self-improvement-reminder>
After completing this task, evaluate if extractable knowledge emerged:
- Non-obvious solution discovered through investigation?
- Workaround for unexpected behavior?
- Project-specific pattern learned?
- Error required debugging to resolve?

If yes: Log to .learnings/ using the self-improvement skill format.
If high-value (recurring, broadly applicable): Consider skill extraction.
</self-improvement-reminder>
EOF

The OpenClaw hook inserts equivalent content into the bootstrap context:

javascript
const handler = async (event) => {
  // Safety checks for event structure
  if (!event || typeof event !== 'object') {
    return;
  }

  // Only handle agent:bootstrap events
  if (event.type !== 'agent' || event.action !== 'bootstrap') {
    return;
  }

  // Safety check for context
  if (!event.context || typeof event.context !== 'object') {
    return;
  }

  // Inject the reminder as a virtual bootstrap file
  // Check that bootstrapFiles is an array before pushing
  if (Array.isArray(event.context.bootstrapFiles)) {
    event.context.bootstrapFiles.push({
      path: 'SELF_IMPROVEMENT_REMINDER.md',
      content: REMINDER_CONTENT,
      virtual: true,
    });
  }
};

Technical Analysis

Once a user explicitly installs and enables these hooks, the activator injects Skill-authored instructions on every matching prompt, while the OpenClaw hook inserts a virtual instruction file during agent bootstra ...[truncated 1909 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make all injected reminders explicitly advisory and state that they cannot override user instructions, safety requirements, or workspace policy.
  2. Do not activate the reminder on every prompt. Limit it to explicit learning-capture requests or narrowly scoped events.
  3. Require interactive confirmation before writing to .learnings/ and separate confirmation before promoting an entry.
  4. Add content validation that rejects instruction-like entries affecting security, permissions, credentials, or tool behavior.
  5. Ensure only one canonical hook implementation is distributed or generated from the same source.
  6. Add the sub-agent exclusion to handler.js if sub-agent injection is not intended.
  7. Clearly document whether the runtime loads handler.js or handler.ts.
  8. Prefer project-scoped activation over user-global activation.
  9. Provide a visible indicator and simple disable mechanism whenever the hook is active.
  10. Add tests proving that hooks only inject static content and cannot persist user material without a separate approval step.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:91
Finding

Cross-Session Transcript Access Is Recommended Without Explicit Least-Privilege Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:91-97, references/openclaw-integration.md:157-186
Vulnerability Type: Excessive cross-session data access and propagation
Risk Level: Medium

Vulnerable Code

markdown
### Inter-Session Communication

OpenClaw provides tools to share learnings across sessions:

- **sessions_list** — View active/recent sessions
- **sessions_history** — Read another session's transcript
- **sessions_send** — Send a learning to another session
- **sessions_spawn** — Spawn a sub-agent for background work

The integration guide supplies direct usage examples:

markdown
### sessions_history

Read transcript from another session:

sessions_history(sessionKey="session-id", limit=50)

text

### sessions_send

Send message to another session:

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

text

Technical Analysis

The Skill recommends listing sessions, reading another session’s transcript, and sending information between sessions as part of its learning workflow. Local error and learning capture does not inherently require access to unrelated session transcripts.

The documentation does not require explicit user authorization for each transcript read, restrict access to an allowlisted session, impose purpose limitations, or require redaction before forwarding content. If the underlying OpenClaw authorization model permits these operations, an agent following the Skill may access more conversational context than is necessary for the immediate task.

No code in the reviewed package automatically invokes these tools, and no external data exfiltration mechanism was found. Exploitation therefore depends on an agent having the relevant OpenClaw tools and permissions and choosing to follow the documented workflow.

Attack Path

  1. The agent operates in an environment where cross-session OpenClaw tool ...[truncated 1133 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove cross-session transcript reading from the default learning workflow.
  2. Require explicit, per-operation user authorization before invoking sessions_history.
  3. Restrict reads to an allowlisted session identified by the user.
  4. Request only the minimum message range required for the stated purpose.
  5. Display the target session and intended use before accessing its transcript.
  6. Redact secrets, credentials, personal data, and unrelated project information before persistence or forwarding.
  7. Require confirmation before using sessions_send, including a preview of the destination and message.
  8. Record an audit trail of cross-session reads and writes.
  9. Treat content obtained from another session as untrusted and prohibit direct promotion into persistent agent instructions.
  10. Enforce session isolation in the host platform wherever cross-session access is not essential.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about maintaining and consulting learnings after failures, corrections, missing capabilities, or better approaches. The supplied code does not capture, store, review, or update learnings. Instead, it is a filesystem utility that scaffolds a new skill from the command line by creating a directory and writing a templated SKILL.md file. While the template references a 'learning entry,' the code itself does not process learning content; its primary purpose is skill generation. This is a material purpose mismatch, and it also introduces undeclared write capabilities to the workspace.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says to use the skill when a command fails, when the user corrects the agent, when a better approach is discovered, and to review learnings before major tasks. Several of these conditions are subjective or common across routine sessions, and the file does not provide clear exclusion conditions or boundaries for when the skill should not activate.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill encourages persistent logging of conversation-derived learnings and cross-session sharing without any requirement to minimize, redact, or classify sensitive data first. That creates a realistic path for secrets, personal data, proprietary code details, or internal error contents to be retained and redistributed beyond the original task context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill promotes creating persistent files under a user workspace for accumulating session-derived data, which increases retention and exposure compared with ephemeral task context. While persistence is central to the skill’s purpose, it is still a real security concern because stored learnings may outlive the original need and be accessed by later sessions or committed unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The described inter-session tools enable reading prior transcripts and sending learnings to other sessions, which materially expands the blast radius of any sensitive information logged earlier. Without strict sanitization and access controls, this supports lateral propagation of private data across contexts that may not need it.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guidance to record 'full context' can easily lead an agent to store user-provided confidential details, internal paths, proprietary snippets, or other sensitive material in durable markdown files. Because the instruction is generic and repeated as normal workflow, it normalizes over-collection and increases long-term exposure risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Logging raw error messages and input parameters is particularly dangerous because stack traces, command outputs, and invocation arguments often contain secrets such as API keys, bearer tokens, file paths, emails, or customer identifiers. Persisting them in plaintext creates a durable disclosure surface and may later spread into version control or shared workspaces.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Phrases like "Can you also...", "Is there a way to...", and "Why can't you..." are common user utterances that do not necessarily indicate the self-improvement skill should log a feature request. Without contextual constraints or exclusions, these triggers risk unintended activation during normal conversation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file defines a UserPromptSubmit hook with an empty matcher, which means the hook activates for any user prompt rather than a constrained set of cases. That broad trigger overlaps with normal everyday interaction and can lead to unintended or intrusive skill invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The user-level configuration enables global activation and pairs it with an empty matcher, so the hook runs across all sessions and prompts without clear boundaries. The guide does not provide negative examples or exclusion conditions near this setup, increasing the risk of unintended activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The Codex setup repeats the same broad UserPromptSubmit configuration with an empty matcher, so the activation condition is effectively universal. Because the example lacks nearby constraints or negative examples, users may adopt an always-on trigger unintentionally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The setup directs creation of persistent learning storage inside the workspace, which can silently modify the working environment and create durable state across sessions. That persistence increases the chance that sensitive operational details, user corrections, API errors, or internal notes survive beyond their immediate need and are later exposed through backups, version control, or other tooling.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instructions tell users to create persistent .learnings/ storage in workspace or skill directories without any warning that model-generated content may be retained, reviewed later, or synced/backed up with the workspace. This creates a real privacy and data-governance risk because failures, prompts, corrections, or tool outputs may be stored indefinitely in a location the user treats as normal project state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document describes cross-session history access and messaging features that can read transcripts and share messages between sessions without warning about privacy, least-privilege, or sensitive-data handling. In a self-improvement context, this is particularly risky because learnings often derive from mistakes, prompts, and tool output that may contain secrets or user-sensitive content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The 'Detection Triggers' section includes vague conditions like 'Knowledge gaps' and user corrections such as 'No, that's wrong...' that overlap with ordinary conversation and common model behavior. The file does not define when these triggers should or should not cause the skill to activate, nor does it provide negative examples to constrain scope.

Content

No source excerpt is available for this finding.

Ssd 3

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Persistently storing 'user context' and problem details for feature requests can capture unnecessary personal or organizational information unrelated to the technical capability being requested. Over time, this creates a privacy and data-retention issue, especially if the logs are shared or committed.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

Signals such as "I keep running into this," "This would be useful for other projects," and "Remember this pattern" can arise in normal discussion without meaning the user wants skill extraction. The guidance lacks negative examples or tighter criteria to distinguish casual comments from explicit extraction requests.

Content

No source excerpt is available for this finding.