Security audit

Agente Conhecimento

Security checks for vulnerabilities and agentic risk

Overview

This self-improvement skill is mostly disclosed, but it asks agents to persist conversation-derived content, promote it into future-session instruction files, and optionally run recurring hook scripts that are not included in the reviewed artifact.

Install only if you are comfortable with persistent learning logs and future-session instruction updates. Before use, disable or avoid the hook setup unless the referenced scripts are present and audited, require explicit approval before reading other sessions or promoting learnings, and add strict redaction rules for secrets, personal data, prompts, error output, file paths, and customer or proprietary content.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:27
Finding: Persistent Poisoning of Agent Instruction and Memory Files
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:89
Finding: Unrestricted Cross-Session Transcript Access and Learning Propagation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:38
Finding: Installation of Unpinned Mutable External Skill Content
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:421
Finding: Persistent Lifecycle Hooks Execute Scripts Absent from the Audited Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill encourages reading other sessions' transcripts and sending learnings across sessions, which enables lateral movement of sensitive conversational data between contexts. This is especially dangerous because session boundaries often exist to limit exposure; cross-session sharing defeats that isolation if content is not strictly sanitized.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The logging templates request full context, error output, user context, and implementation details, all of which frequently include confidential content. Persisting this information in markdown records creates a durable exfiltration and accidental-disclosure surface, especially if the repository is shared or synced.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description 'use ela para essas tarefas' is vague and unconstrained, which can cause the skill to activate in many unrelated contexts. Overbroad activation increases the chance the agent applies logging and persistence behavior to ordinary conversations, including ones containing sensitive information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation criteria include many common events such as user corrections, outdated knowledge, better approaches, and major tasks, which are broad enough to trigger during normal operation. In this skill's context, broad triggering is risky because activation leads directly to persistent recording of conversational content and operational details.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs the agent to log learnings, errors, and corrections to files for continuous improvement, but it provides no safeguards for secrets, personal data, or sensitive business information. Because the logging target is persistent storage and may later be promoted to memory files, sensitive user content can be retained beyond the original session.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This instruction explicitly encourages recording user corrections, requests, and operational context into persistent files and memory. That creates a direct path for user-provided content to be stored outside the original interaction boundary, increasing privacy, retention, and data-governance risk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 73% confidence
Finding: Creating persistent storage under ~/.openclaw/workspace/.learnings establishes session persistence that can outlive the original interaction. Persistence alone is not always unsafe, but in this skill it materially increases risk because the stored content is encouraged to include conversational and operational data.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The error template asks for input parameters and environment details, which commonly contain secrets, hostnames, file paths, API keys, and personal data. Without a privacy warning or sanitization requirement, the skill normalizes writing highly sensitive debugging context into durable logs.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advocates broad logging and aggressive promotion into durable instruction files such as CLAUDE.md, AGENTS.md, and workspace memory. That amplifies any initial over-collection mistake by propagating sensitive or user-derived content into long-lived, widely reused prompt artifacts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.