Security audit

Reddi Self Improving Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is not visibly malicious, but it can persist conversation-derived notes into future agent instructions and broad always-on hooks with limited safeguards.

Install only if you intentionally want persistent self-improvement memory. Prefer project-local setup, avoid global hooks unless you understand the scope, keep .learnings ignored by default, redact secrets and sensitive command output, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or copilot-instructions.md.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:363
Finding: Persistent Poisoning of Agent Instruction and Memory Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:363-377`; `hooks/openclaw/handler.ts:18-24`; `hooks/openclaw/handler.js:17-23` **Vulnerability Type**: Persistent agent memory poisoning through promotion of user-influenced learnings **Risk Level**: High ### Vulnerable Code `SKILL.md:363-377`: ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` `hooks/openclaw/handler.ts:18-24`: ```typescript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently.`; ``` The JavaScript runtime implementation contains the equivalent instructions at `hooks/openclaw/handler.js:17-23`. ### Technical Analysis The skill captures corrections, discoveries, and other information originating in conversations, then recommends promoting recurring entries into files such as `SOUL.md`, `AGENTS.md`, `TOOLS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md`. These files are persistent agent-context or instruction files that can be loaded into future sessions. The promotion criteria measure recurrence and timing, but do not validate whether the source is trusted or whether the promoted rule changes safety constraints, permissions, tool behavior, or instruction precedence. Consequently, repetition can be mistaken for trustworthiness. The general guidance in `SKILL.md:467` to “Promote aggressively” further increases the likelihood that insufficiently rev ...[truncated 1580 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before writing any learning into an agent instruction, memory, or skill file. 2. Preserve provenance for every promoted rule, including the originating user, session, task, timestamp, and exact source text. 3. Treat recurrence only as a prioritization signal, never as evidence that content is trustworthy. 4. Reject promotion of rules that modify: - Safety or authorization boundaries - Instruction precedence - Secret-handling requirements - Tool permissions or confirmation requirements - Network, filesystem, or command-execution policy 5. Restrict automated promotion to verifiable project facts and non-behavioral documentation. 6. Present proposed changes as a diff and require approval from an authorized maintainer. 7. Add integrity monitoring for `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `CLAUDE.md`, and related instruction files. 8. Separate untrusted observations from trusted instructions so learning logs are never automatically interpreted as executable policy. 9. Add tests proving that repeated user requests cannot automatically produce persistent behavioral instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/error-detector.sh:7
Finding: Sensitive Command Output May Be Persisted in Shared Learning Logs Without Redaction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/error-detector.sh:7-10,36-52`; `SKILL.md:188-215,468-476` **Vulnerability Type**: Unsafe persistence of potentially sensitive diagnostic output **Risk Level**: Medium ### Vulnerable Code `scripts/error-detector.sh:7-10`: ```bash # Check if tool output indicates an error # CLAUDE_TOOL_OUTPUT contains the result of the tool execution OUTPUT="${CLAUDE_TOOL_OUTPUT:-}" ``` `scripts/error-detector.sh:36-52`: ```bash # Only output reminder if error detected if [ "$contains_error" = true ]; then cat << 'EOF' <error-detected> A command error was detected. Consider logging this to .learnings/ERRORS.md if: - The error was unexpected or non-obvious - It required investigation to resolve - It might recur in similar contexts - The solution could benefit future sessions Use the self-improvement skill format: [ERR-YYYYMMDD-XXX] </error-detected> EOF fi ``` `SKILL.md:188-215` defines an error entry that includes raw diagnostic material: ````markdown ### Error Entry Append to `.learnings/ERRORS.md`: ```markdown ## [ERR-YYYYMMDD-XXX] skill_or_command_name **Logged**: ISO-8601 timestamp **Priority**: high **Status**: pending **Area**: frontend | backend | infra | tests | docs | config ### Summary Brief description of what failed ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ``` ```` `SKILL.md:468-476` permits these records to be shared through source control: ```markdown ## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/ ``` **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` ### Technical Analysis The error hook reads the complete `CLAUDE_TOOL_OUTPUT` value and prompts the agent to record failures. The prescribed log format explicitly requests the actual error output, command or operation parameters, a ...[truncated 2318 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not recommend copying complete tool output into learning records. 2. Change the template to request a minimal, manually summarized diagnostic excerpt. 3. Apply automatic redaction before any output is persisted. At minimum, detect: - API keys and bearer tokens - Password and secret assignments - Authorization and cookie headers - Private keys - Database connection strings - Common cloud-provider credential formats 4. Exclude environment-variable values and command arguments by default. 5. Add strict length limits and retain only the lines necessary to identify the error class. 6. Mark `.learnings/` as ignored by default; require deliberate review before any learning file is committed. 7. Add a pre-commit secret scanner covering `.learnings/*.md`. 8. Warn users that deleting a secret from the latest file does not remove it from repository history. 9. If a secret is accidentally recorded, revoke or rotate it and purge it from relevant repository history and artifacts. 10. Add tests using synthetic credentials to verify that the logging workflow redacts sensitive values. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a learning/retrospection skill for capturing mistakes, corrections, and improved approaches to support continuous improvement. The supplied code does not implement any of that workflow. Instead, it is a standalone shell helper that scaffolds a new skill directory and template markdown file from a skill name. While the comments mention creating a skill from a learning entry, the script itself neither reads learning data nor updates a learning store; it only generates boilerplate files and prints suggested manual next steps. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Writing to ~/.claude/settings.json instructs users to modify a persistent agent-wide configuration directory, which can establish durable execution of local scripts across future sessions. That is dangerous because any compromise, path substitution, or later script change can affect all projects run by the user, not just one repository.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 78% confidence
Finding: The skill instructs persistent storage of conversation-derived learnings under a user workspace, which can retain sensitive prompts, errors, file paths, and operational details across sessions. In context, the persistence is intentional and central to the skill, but it still creates privacy and security risk if secrets, proprietary data, or other sensitive content are logged and later re-injected into future sessions.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Using an empty hook matcher causes the activator script to run on every user prompt, which broadens the trigger scope unnecessarily and increases the blast radius of any bug or unsafe behavior in the hook chain. In a prompt-injection-prone environment, always-on hooks can also amplify persistence and unintended data collection by repeatedly invoking local scripts regardless of task relevance.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The second example repeats the same broad trigger pattern, causing prompt-submission hooks to execute indiscriminately. Even though the documented purpose is benign, indiscriminate hook execution can create unnecessary monitoring, accidental persistence, and a larger attack surface if the invoked scripts are modified, misconfigured, or combined with other unsafe tooling.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 76% confidence
Finding: Project-root hook configuration creates persistent behavior that survives across sessions for anyone using the repository, not just the current task. In this skill's context, persistence matters because it automates future prompt and tool-triggered execution, which can surprise users or continue operating after the original review context is gone.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: An empty matcher causes the activator hook to run on every submitted prompt, creating broad, automatic interception of all session content. In a self-improvement skill that captures learnings and reminders, this expands exposure of potentially sensitive prompts and increases the blast radius if the script is modified or behaves unexpectedly.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The user-level configuration enables always-on global activation from ~/.claude/settings.json, causing the hook to run across projects and contexts without clear boundaries. Because this skill is persistence-oriented and designed to capture learnings over time, global scope materially increases accidental data exposure and the impact of script tampering.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The Codex example also uses an empty matcher, so the hook executes for all prompts rather than only relevant failure-learning scenarios. This broadens prompt interception and operational risk, especially in an agent skill specifically intended to observe errors, corrections, and task flow.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documentation claims the hook scripts only output text and do not run commands, but the configuration explicitly registers shell scripts as command hooks. That mismatch can mislead users into granting trust and broader deployment to code that executes with the agent's permissions, increasing the chance of unsafe installation or review bypass.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The 'Detection Triggers' section lists generic conditions such as user corrections, command failures, API errors, and knowledge gaps without defining thresholds, exclusions, or negative examples. In a markdown integration guide, these broad natural-language triggers are ambiguous enough to overlap with many normal interactions and may lead to unintended skill invocation or excessive logging.

Session Persistence

Medium

Category: Rogue Agent
Content: description: "Captures a command failure as an ERRORS.md entry" input: | The command `launchctl setenv KEY VALUE` failed silently to inject the env var into our LaunchAgent plist. Log this as an error entry. expect: contains: ["LRN-", "launchctl", "Summary", "Status"] min_length: 100
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.