ClawHub
Back to skill

Security audit

Self Improving Agent

Security checks for vulnerabilities and agentic risk

Overview

This self-improvement skill is coherent overall, but it should be reviewed because it can persist learned content into future agent instructions and enable broad always-on hooks.

Install only if you want an agent to maintain persistent learning files and possibly promote selected learnings into future agent instructions. Prefer project-local setup, avoid the global hook unless you need it, use constrained matchers where possible, review hook scripts before enabling them, and require an explicit diff review before anything is added to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or copilot instructions.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:38
Finding

Untrusted Learning Content Can Be Promoted into Persistent Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:38-43, SKILL.md:302-309, SKILL.md:462; related workflow in references/openclaw-integration.md:112-143
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Code Snippet

markdown
| Simplify/Harden recurring patterns | Log/update `.learnings/LEARNINGS.md` with `Source: simplify-and-harden` and a stable `Pattern-Key` |
| Similar to existing entry | Link with `**See Also**`, consider priority bump |
| Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` |
| Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) |
| Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) |
| Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) |
markdown
### How to Promote

1. **Distill** the learning into a concise rule or fact
2. **Add** to appropriate section in target file (create file if needed)
3. **Update** original entry:
   - Change `**Status**: pending` → `**Status**: promoted`
   - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`
markdown
7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md

Technical Analysis

The Skill captures information originating from conversations, user corrections, command errors, and external tool behavior. Some of this content can therefore be controlled or influenced by an untrusted user, repository, command output, or external service.

The promotion workflow permits these learnings to be distilled into persistent instruction files such as CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, SOUL.md, and TOOLS.md. These files may be injected into future agent sessions as trusted context. Although the Skill defines recurrence and promotion criteria, it does not require an explicit approval step, provenance v ...[truncated 1779 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user approval before every write to persistent agent-context files.
  2. Display the destination path and exact proposed diff before promotion.
  3. Treat all learning text, command output, repository content, and external-service responses as untrusted data.
  4. Permit promotion only through a structured schema containing narrowly defined factual fields.
  5. Reject promoted content that attempts to:
    • Override system or user instructions.
    • Weaken security controls or approval requirements.
    • Direct access to secrets, credentials, or unrelated files.
    • Initiate external communication or cross-session sharing.
    • Modify tools, hooks, permissions, or execution policy.
  6. Record provenance for every promoted rule, including source session, author, original entry, timestamp, and approving user.
  7. Separate factual project memory from behavioral and security-policy instructions.
  8. Replace “promote aggressively” with a conservative policy requiring verification, necessity, and least scope.
  9. Add automated checks that reject instruction-like or security-sensitive content before persistent writes.
  10. Provide a rollback mechanism and periodically review persistent prompt files for unauthorized changes.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:55
Finding

Manual Installation Uses an Unpinned Mutable Git Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:55-59
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet

markdown
**Manual:**
```bash
git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent
text

### Technical Analysis

The documented manual installation command clones the current default branch of an external Git repository. It does not pin an immutable commit or signed release and does not verify a checksum, signature, or expected tree hash.

Because the installed repository contains hook implementations and executable shell scripts, the effective code installed by this command can differ from the version reviewed in this audit. The documentation subsequently permits users to copy and enable the installed hook, causing modified upstream code to run with the same permissions as the agent environment.

This is a supply-chain weakness rather than evidence that the currently audited repository contains a malicious payload.

### Attack Path

1. The upstream repository, maintainer account, Git hosting account, or default branch is compromised or modified.
2. The attacker replaces a hook or script with malicious code.
3. A user follows the documented unpinned `git clone` installation command.
4. The mutable, modified repository is installed under the user's OpenClaw Skill directory.
5. The user copies and enables the hook according to the project documentation or invokes one of the scripts.
6. The modified code executes with the permissions of the OpenClaw or coding-agent process.

### Impact Assessment

If the upstream source is compromised, arbitrary code contained in scripts or hooks could execute with the installing user's agent permissions. Potential impact would be limited by that account's privileges but could include:

- Reading or modifying files accessible to the agent.
- Accessing environment 
...[truncated 476 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin manual installation to an immutable, reviewed commit:
    bash
    git clone https://github.com/peterskoett/self-improving-agent.git
cd self-improving-agent
git checkout --detach <reviewed-commit-hash>
  2. Prefer signed, versioned release archives rather than cloning the default branch.
  3. Publish SHA-256 checksums for release artifacts and document verification commands.
  4. Sign releases or Git tags and require signature verification before installation.
  5. Ensure the documented release corresponds exactly to _meta.json and registry provenance.
  6. Require users to review hook and script diffs before enabling executable components.
  7. Avoid automatically enabling hooks as part of installation.
  8. Document an update process that repeats integrity and signature verification.

T09 · Insecure Skill Coding Practices

Note
Location
hooks/openclaw/handler.js:31
Finding

Shipped JavaScript Hook Diverges from Its TypeScript Source

Content
View full analysis

Vulnerability Details

File Location: hooks/openclaw/handler.js:31-52; comparison guard in hooks/openclaw/handler.ts:40-45
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable Code Snippet

The shipped JavaScript implementation proceeds directly from context validation to reminder injection:

javascript
// Safety check for context
if (!event.context || typeof event.context !== 'object') {
  return;
}

// Inject the reminder as a virtual bootstrap file
// Check that bootstrapFiles is an array before pushing
if (Array.isArray(event.context.bootstrapFiles)) {
  event.context.bootstrapFiles.push({
    path: 'SELF_IMPROVEMENT_REMINDER.md',
    content: REMINDER_CONTENT,
    virtual: true,
  });
}

The TypeScript source contains an additional sub-agent exclusion that is absent from JavaScript:

typescript
// Skip sub-agent sessions to avoid bootstrap issues
// Sub-agents have sessionKey patterns like "agent:main:subagent:..."
const sessionKey = event.sessionKey || '';
if (sessionKey.includes(':subagent:')) {
  return;
}

Technical Analysis

The JavaScript and TypeScript hook implementations are not behaviorally equivalent. The TypeScript source explicitly avoids injecting the reminder into sub-agent sessions, while the shipped CommonJS JavaScript handler lacks that guard.

If OpenClaw loads handler.js, reviewing or modifying only handler.ts does not accurately describe or change runtime behavior. This source/build drift can also cause future security fixes added to TypeScript to remain absent from the executable artifact.

The current divergence does not enable arbitrary code execution. Its direct effect is unintended prompt injection into a broader set of agent sessions than the TypeScript source indicates.

Attack Path

  1. The user installs and enables the OpenClaw hook.
  2. OpenClaw loads the shipped CommonJS `handle ...[truncated 1021 chars]
Remediation
View remediation

Remediation Suggestions

  1. Regenerate handler.js from handler.ts so the sub-agent guard is present in the executable artifact.
  2. Prefer shipping a single authoritative implementation where supported.
  3. Add a deterministic build command and document which file OpenClaw executes.
  4. Add automated parity tests covering:
    • Main-agent bootstrap events.
    • Sub-agent bootstrap events.
    • Invalid event and context objects.
    • Missing or malformed bootstrapFiles.
  5. Make continuous integration fail when committed JavaScript differs from compiled TypeScript.
  6. Include generated-artifact verification in the release process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description is about recording and using learnings from failures, corrections, missing capabilities, and outdated knowledge. The supplied code does not implement learning capture, error logging, correction tracking, review of prior learnings, or continuous-improvement retrieval. Instead, it is a helper utility for scaffolding a new skill from an existing learning entry by creating directories and a templated SKILL.md file. This is a materially different primary purpose and includes undeclared write capabilities to the filesystem. The mention of 'extracted from a learning entry' is only tangentially related; the actual behavior is skill generation, not learning management.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Documenting installation into ~/.claude/settings.json establishes persistent configuration in an agent control directory, affecting future sessions beyond a single project. In the context of executable command hooks, this is more dangerous because it expands trust from a local repository to the user's broader agent environment, increasing persistence and blast radius if the scripts are unsafe or later altered.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 181)May include surrounding context.

sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says to use the skill when a command fails unexpectedly, when Claude is corrected, when knowledge is outdated, or when a better approach is discovered, but it does not clearly define when these situations are significant enough to invoke the skill versus when they are routine. Because these situations are common in normal agent interactions, the lack of scope constraints can lead to unintended or excessive invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The skill directs the agent to create persistent files under ~/.openclaw/workspace/.learnings, which can retain potentially sensitive operational context across sessions. Even though the text warns against logging secrets and limits cross-session sharing to trusted environments, persistence in a shared workspace increases exposure if multiple sessions, users, or tools can access that location.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The feature-request detection triggers include very generic phrases such as "Can you also...", "Is there a way to...", and "Why can't you...". In a markdown skill description, these broad examples can cause the skill to activate on ordinary conversation rather than specifically on requests to log learnings or missing capabilities.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Placing hook configuration in .claude/settings.json creates session-persistent behavior that automatically re-runs in future agent sessions for the repository. Persistence is not inherently malicious, but in this skill it matters because it silently maintains automatic command execution and context injection until removed, which can outlast the user's intent or awareness.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

An empty matcher on UserPromptSubmit causes the hook to run for every prompt, creating a broad automatic trigger surface. In this skill context, that means the agent will continuously execute a local command and inject its output into context, which can increase prompt-surface exposure, performance overhead, and the chance of sensitive or irrelevant data influencing sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The user-level configuration enables global activation from ~/.claude/settings.json with no trigger constraints, causing the hook to run across all projects and sessions. That broad persistence increases blast radius: a flawed, modified, or over-collecting script would affect unrelated workspaces and could repeatedly inject unreviewed content into agent interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The 'minimal setup' still uses an unconstrained empty matcher, so although it reduces the number of hooks, it still executes on every submitted prompt. That design keeps the trigger overly broad and preserves the same risks of unnecessary command execution and pervasive context injection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The Codex CLI example repeats the empty matcher pattern, making the hook activate on all prompts in that environment as well. Reproducing broad triggers across multiple agent platforms amplifies the likelihood of unintended execution and normalizes insecure default configuration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document's security section states the scripts 'only output text' and 'don't modify files or run commands,' but the hook configuration explicitly invokes shell commands via the command hook mechanism. This misleading assurance can cause users to under-trust-review executable hook scripts that run automatically in the agent context, increasing the chance of unsafe deployment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The SOUL.md guidance says to avoid unnecessary caveats and disclaimers without narrowing that instruction to non-safety-critical contexts. In practice, this can suppress warnings, risk communication, or uncertainty disclosure during sensitive operations, making prompt-injection, destructive actions, or unsafe guidance more likely to be presented without appropriate caution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

A self-improvement skill, as described, would reasonably log failures, corrections, or lessons learned and review them before tasks. Creating filesystem scaffolds for arbitrary new skills is a broader project/code-generation capability that is not clearly required by that purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill focused on recording learnings, corrections, and failures for later review. This script instead scaffolds entirely new skill directories and writes a new SKILL.md file, which is a skill-generation capability rather than simply capturing or reviewing learnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file contains setup commands that copy a skill and hook into ~/.openclaw/ and create .learnings/ directories, which are file-system modifications affecting the user's local environment. The guide presents these actions as routine setup but does not explicitly warn that they will write into persistent user configuration and workspace locations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.