Self Improving Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:27 AM UTC
• Version: 1.1.0

Overview

The skill is not destructive or covert, but it is designed to turn conversation feedback into persistent agent instructions without enough approval and scoping controls.

Install only in workspaces where persistent agent-memory updates are desired. Prefer project-local hooks over global hooks, avoid empty matchers in sensitive work, and manually review any proposed changes to .learnings, SOUL.md, AGENTS.md, TOOLS.md, or CLAUDE.md. Do not store secrets, credentials, raw transcripts, or sensitive user data in learning files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: hooks/openclaw/handler.js:8

Finding

Untrusted User Feedback Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: hooks/openclaw/handler.js, lines 8-26
Vulnerability Type: Persistent agent memory poisoning through unvalidated learning promotion
Risk Level: High

Vulnerable Code

javascript

const REMINDER_CONTENT = `
## Self-Improvement Reminder

After completing tasks, evaluate if any learnings should be captured:

**Log when:**
- User corrects you → \`.learnings/LEARNINGS.md\`
- Command/operation fails → \`.learnings/ERRORS.md\`
- User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\`
- You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\`
- You find a better approach → \`.learnings/LEARNINGS.md\`

**Promote when pattern is proven:**
- Behavioral patterns → \`SOUL.md\`
- Workflow improvements → \`AGENTS.md\`
- Tool gotchas → \`TOOLS.md\`

Keep entries simple: date, title, what happened, what to do differently.
`.trim();

The same promotion model is defined in SKILL.md, lines 12-14 and 34-42:

markdown

1. Detect signal: error, correction, capability gap, or repeated workaround.
2. Log to `.learnings/` with the right entry type.
3. Resolve or promote high-value patterns into durable workspace files.
4. Reuse scripts/hooks to keep capture consistent.

## Promotion rules

Promote broadly reusable learnings out of `.learnings/`:

- behavior/style -> `SOUL.md`
- workflow/orchestration -> `AGENTS.md`
- tool constraints/gotchas -> `TOOLS.md`

Update original entries with status transitions (`resolved`, `promoted`, `wont_fix`) and references.

Technical Analysis

User corrections are treated as learning sources, and the agent is instructed to promote selected learnings into SOUL.md, AGENTS.md, and TOOLS.md. According to references/openclaw-integration.md, these workspace files are injected into agent context at session startup and therefore affect later sessions.

The workflow does not require an en ...[truncated 2891 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit human approval before promotion

   • Treat .learnings/ as untrusted, non-executable notes.
   • Generate a proposed diff for SOUL.md, AGENTS.md, or TOOLS.md.
   • Require an affirmative user confirmation before applying it.

2. Track provenance and trust

   • Record the source session, author, timestamp, evidence, and affected files.
   • Mark user feedback as untrusted until independently verified.
   • Do not allow source text to change its own trust status or approval requirements.

3. Use a strict promotion schema

   • Promote concise, declarative facts rather than raw user text.
   • Reject shell commands, URLs, credential instructions, encoded content, prompt-control language, and directives to ignore existing policies unless separately reviewed.
   • Escape or delimit quoted source material so it cannot be interpreted as an instruction.

4. Add mandatory verification gates

   • Require corroboration from repository configuration, official documentation, tests, or repeated independently observed behavior.
   • Define “proven” using objective criteria.
   • Require security review for rules affecting command execution, authentication, networking, data handling, or agent safety.

5. Separate memory from policy

   • Do not directly inject untrusted learning logs as authoritative bootstrap instructions.
   • Store observations in a data-only format and have trusted code selectively render approved entries.
   • Keep immutable safety policy at higher precedence than promoted workspace guidance.

6. Provide rollback and audit controls

   • Version all promoted changes.
   • Include the originating learning ID in each promoted rule.
   • Support review, expiry, revocation, and automatic rollback of newly promoted instructions.

7. Harden the reminder text

   • Explicitly state that user corrections may be adversarial.
   • Instruct ...[truncated 180 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents this skill as an active learning/capture mechanism that records events into .learnings/ and promotes proven patterns into memory files. The supplied code does not implement those behaviors. Instead, it passively injects a reminder during agent:bootstrap, and only for non-subagent sessions, by adding a virtual markdown file to bootstrapFiles. This is a materially different primary purpose: prompting the agent to consider self-improvement later rather than performing the logging/promotion itself. The trigger is also different: the code runs only on bootstrap, not when commands fail, users correct output, missing capabilities are requested, or new best practices are discovered.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is a material description-behavior mismatch. The declared description presents the skill as performing structured learning capture and promotion into memory files, triggered by specific events such as command failures or user corrections. The code shown merely emits a static reminder block during activation and does not implement any persistence, event detection, or file access. Its primary purpose is advisory nudging, not actual learning capture or memory management.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about recording learnings into .learnings/ logs and promoting durable guidance into workspace memory files when failures, corrections, or best practices occur. The supplied code does something materially different: it parses command-line arguments, validates a skill name/path, optionally performs a dry run, creates a skill directory, and writes a SKILL.md template scaffold. Although the template references a learning entry and .learnings/LEARNINGS.md, the script neither reads nor writes learning logs nor updates memory files. Its primary purpose is skill scaffolding, not learning capture or memory promotion, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Directing users to modify ~/.claude/settings.json introduces persistent agent configuration at the user level, which is a sensitive control point. Changes there can affect all future sessions and repositories, so misuse, compromise, or mistaken configuration has a broad and durable impact.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is activated by broad, common conditions like errors, user corrections, capability gaps, or repeated workarounds, which can cause frequent invocation and normalization of persistent state changes. In context, that raises the risk of over-collection and unintended propagation of sensitive or low-quality information into .learnings/ and durable memory files across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown instructs writing to .learnings/ and updating files like SOUL.md, AGENTS.md, and TOOLS.md without an explicit warning or confirmation step before modifying repository content. In this skill's context, persistent memory updates can silently alter project state, preserve sensitive user data, or introduce misleading instructions that affect future agent behavior.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The guide explicitly sets up hooks in project configuration so that the behavior persists across sessions, which is a form of session persistence. In the context of a self-improving agent, persistence is part of the intended design, but it still carries security risk because automatic reminders and command hooks continue operating beyond the original user decision point and may influence later tasks unexpectedly.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Using an empty matcher causes the hook to run on every prompt with no scope limitation, which broadens the attack surface and makes accidental or unwanted invocation more likely. In a self-improving agent, universal triggering can amplify prompt-context pollution, persistence, and trust in automatically injected guidance across unrelated tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Recommending installation into ~/.claude/settings.json enables the behavior across all sessions and repositories, including contexts where the skill is inappropriate or unsafe. Combined with a command hook, this creates persistent cross-project execution and increases the blast radius if the script is modified, replaced, or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The minimal setup still uses an empty matcher, so the 'lower overhead' example remains a catch-all trigger rather than a constrained one. This normalizes always-on activation and can lead to unnecessary execution in sensitive or unrelated workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Codex example repeats the empty matcher pattern, creating unconditional hook execution for all prompts. Because this is presented as a ready-to-copy configuration, it encourages broad deployment without guardrails and increases exposure to prompt-triggered behavior in every session.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document asserts that hook scripts only output text and do not modify files or run commands, yet elsewhere it documents an extract script that creates a skill scaffold. This kind of inaccurate security claim can cause operators to trust and enable the skill under false assumptions, increasing the chance of unintended code execution or file modification through hooked commands.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill explicitly instructs users to create persistent learning storage under the workspace or skill directory, enabling information to survive across sessions. In the context of a self-improving agent, this increases the risk that sensitive prompts, errors, corrections, or operational details are retained longer than intended and later reinjected into future sessions.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'Detection Triggers' section defines activation cues such as 'User corrections' and 'Knowledge gaps', which are broad and common in normal interaction. The document does not provide exclusion conditions or narrow context boundaries, so the skill could be invoked in many ordinary situations unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file provides commands that create directories and copy files under ~/.openclaw/, which affects the user's local environment. The guide does not include any explicit warning or disclosure that these steps modify persistent files and directories on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.