Claw Self-Improvement

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:18 AM UTC
• Version: 0.2.1

Overview

This skill is a disclosed self-improvement logger with a bootstrap reminder hook, but users should manage the persistent learning files carefully.

Install only if you want persistent local learning notes and a recurring bootstrap reminder. Redact tokens, passwords, private keys, customer data, request bodies, and sensitive environment details before anything is written to `.learnings/`; review `PROMOTED.md` before relying on entries as rules; disable the hook and keep or delete the learning files according to your retention needs.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:124

Finding

Untrusted Conversation Content Can Be Promoted into Persistent Agent Rules

Content

View full analysis

{ // Safety checks for event structure if (!event || typeof event !== 'object') { return; } // Only handle agent:bootstrap events if (event.type !== 'agent' || event.action !== 'bootstrap') { return; } // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Skip sub-agent sessions to avoid bootstrap issues const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } const reminderContent = buildReminderContent(event.context.cfg); // Inject the reminder as a virtual bootstrap file ...[truncated 2828 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/FORMAT.md:106

Finding

Error Logging Format Can Persist Credentials and Sensitive Diagnostic Data in Plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

2. Remove the Hook Files

bash

rm -rf ~/.openclaw/hooks/claw-self-improvement

3. Remove the Skill Files

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

2. Remove the Hook Files

bash

rm -rf ~/.openclaw/hooks/claw-self-improvement

3. Remove the Skill Files

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

2. Remove the Hook Files

bash

rm -rf ~/.openclaw/hooks/claw-self-improvement

3. Remove the Skill Files

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

3. Remove the Skill Files

bash

rm -rf ~/.openclaw/workspace/skills/claw-self-improvement

4. Remove the ClawHub Lockfile Entry

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

Remove only the files created for this workflow:

bash

rm -f ~/.openclaw/workspace/.learnings/LEARNINGS.md \
      ~/.openclaw/workspace/.learnings/ERRORS.md \
      ~/.openclaw/workspace/.learnings/FEATURE_REQUESTS.md \
      ~/.openclaw/workspace/.learnings/PROMOTED.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill explicitly creates persistent files in ~/.openclaw/workspace/.learnings and instructs future sessions to use them as durable context. This introduces cross-session persistence of model-generated content, which can accumulate sensitive data, prompt-influencing instructions, or poisoned 'lessons' that alter future agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

2. Initialize .learnings/

Create missing starter files without overwriting existing .learnings/ history:

bash

SKILL_DIR=~/.openclaw/workspace/skills/claw-self-improvement

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

Enabling a bootstrap hook creates persistent behavioral modification across future runs, not just durable data storage. Because the hook injects reminders into agent startup, any flawed, stale, or poisoned workflow guidance can repeatedly influence later sessions without renewed user consent.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

bash

SKILL_DIR=~/.openclaw/workspace/skills/claw-self-improvement
mkdir -p ~/.openclaw/hooks/claw-self-improvement
cp -R "$SKILL_DIR"/hooks/. ~/.openclaw/hooks/claw-self-improvement/
openclaw hooks enable claw-self-improvement

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file instructs the user to create and copy files into ~/.openclaw/workspace/.learnings/, later enable hooks, and provides removal commands including rm -rf and deletion of history files. While the steps are explicit, there is no concise user-facing warning near setup/removal that the skill will write persistent data and that optional cleanup can permanently remove recorded history.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:178