Reddi Self Improving Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:58 AM UTC
• Version: 1.0.13

Overview

This skill is not visibly malicious, but it can persist conversation-derived notes into future agent instructions and broad always-on hooks with limited safeguards.

Install only if you intentionally want persistent self-improvement memory. Prefer project-local setup, avoid global hooks unless you understand the scope, keep .learnings ignored by default, redact secrets and sensitive command output, and require human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or copilot-instructions.md.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:363

Finding

Persistent Poisoning of Agent Instruction and Memory Files

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` `hooks/openclaw/handler.ts:18-24`: ```typescript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently.`; ``` The JavaScript runtime implementation contains the equivalent instructions at `hooks/openclaw/handler.js:17-23`. ### Technical Analysis The skill captures corrections, discoveries, and other information originating in conversations, then recommends promoting recurring entries into files such as `SOUL.md`, `AGENTS.md`, `TOOLS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md`. These files are persistent agent-context or instruction files that can be loaded into future sessions. The promotion criteria measure recurrence and timing, but do not validate whether the source is trusted or whether the promoted rule changes safety constraints, permissions, tool behavior, or instruction precedence. Consequently, repetition can be mistaken for trustworthiness. The general guidance in `SKILL.md:467` to “Promote aggressively” further increases the likelihood that insufficiently rev ...[truncated 1580 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/error-detector.sh:7

Finding

Sensitive Command Output May Be Persisted in Shared Learning Logs Without Redaction

Content

View full analysis

A command error was detected. Consider logging this to .learnings/ERRORS.md if: - The error was unexpected or non-obvious - It required investigation to resolve - It might recur in similar contexts - The solution could benefit future sessions Use the self-improvement skill format: [ERR-YYYYMMDD-XXX] EOF fi ``` `SKILL.md:188-215` defines an error entry that includes raw diagnostic material: ````markdown ### Error Entry Append to `.learnings/ERRORS.md`: ```markdown ## [ERR-YYYYMMDD-XXX] skill_or_command_name **Logged**: ISO-8601 timestamp **Priority**: high **Status**: pending **Area**: frontend | backend | infra | tests | docs | config ### Summary Brief description of what failed ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ``` ```` `SKILL.md:468-476` permits these records to be shared through source control: ```markdown ## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/ ``` **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` ### Technical Analysis The error hook reads the complete `CLAUDE_TOOL_OUTPUT` value and prompts the agent to record failures. The prescribed log format explicitly requests the actual error output, command or operation parameters, a ...[truncated 2318 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a learning/retrospection skill for capturing mistakes, corrections, and improved approaches to support continuous improvement. The supplied code does not implement any of that workflow. Instead, it is a standalone shell helper that scaffolds a new skill directory and template markdown file from a skill name. While the comments mention creating a skill from a learning entry, the script itself neither reads learning data nor updates a learning store; it only generates boilerplate files and prints suggested manual next steps. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Writing to ~/.claude/settings.json instructs users to modify a persistent agent-wide configuration directory, which can establish durable execution of local scripts across future sessions. That is dangerous because any compromise, path substitution, or later script change can affect all projects run by the user, not just one repository.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill instructs persistent storage of conversation-derived learnings under a user workspace, which can retain sensitive prompts, errors, file paths, and operational details across sessions. In context, the persistence is intentional and central to the skill, but it still creates privacy and security risk if secrets, proprietary data, or other sensitive content are logged and later re-injected into future sessions.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Using an empty hook matcher causes the activator script to run on every user prompt, which broadens the trigger scope unnecessarily and increases the blast radius of any bug or unsafe behavior in the hook chain. In a prompt-injection-prone environment, always-on hooks can also amplify persistence and unintended data collection by repeatedly invoking local scripts regardless of task relevance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The second example repeats the same broad trigger pattern, causing prompt-submission hooks to execute indiscriminately. Even though the documented purpose is benign, indiscriminate hook execution can create unnecessary monitoring, accidental persistence, and a larger attack surface if the invoked scripts are modified, misconfigured, or combined with other unsafe tooling.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

Project-root hook configuration creates persistent behavior that survives across sessions for anyone using the repository, not just the current task. In this skill's context, persistence matters because it automates future prompt and tool-triggered execution, which can surprise users or continue operating after the original review context is gone.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

An empty matcher causes the activator hook to run on every submitted prompt, creating broad, automatic interception of all session content. In a self-improvement skill that captures learnings and reminders, this expands exposure of potentially sensitive prompts and increases the blast radius if the script is modified or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The user-level configuration enables always-on global activation from ~/.claude/settings.json, causing the hook to run across projects and contexts without clear boundaries. Because this skill is persistence-oriented and designed to capture learnings over time, global scope materially increases accidental data exposure and the impact of script tampering.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Codex example also uses an empty matcher, so the hook executes for all prompts rather than only relevant failure-learning scenarios. This broadens prompt interception and operational risk, especially in an agent skill specifically intended to observe errors, corrections, and task flow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation claims the hook scripts only output text and do not run commands, but the configuration explicitly registers shell scripts as command hooks. That mismatch can mislead users into granting trust and broader deployment to code that executes with the agent's permissions, increasing the chance of unsafe installation or review bypass.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The 'Detection Triggers' section lists generic conditions such as user corrections, command failures, API errors, and knowledge gaps without defining thresholds, exclusions, or negative examples. In a markdown integration guide, these broad natural-language triggers are ambiguous enough to overlap with many normal interactions and may lead to unintended skill invocation or excessive logging.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · tests/cases.yaml (reported line 8)May include surrounding context.

yaml

description: "Captures a command failure as an ERRORS.md entry"
    input: |
      The command `launchctl setenv KEY VALUE` failed silently to inject the env var
      into our LaunchAgent plist. Log this as an error entry.
    expect:
      contains: ["LRN-", "launchctl", "Summary", "Status"]
      min_length: 100

Static analysis

No suspicious patterns detected.