Agente Conhecimento

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:22 PM UTC
• Version: 1.0.0

Overview

This self-improvement skill is mostly disclosed, but it asks agents to persist conversation-derived content, promote it into future-session instruction files, and optionally run recurring hook scripts that are not included in the reviewed artifact.

Install only if you are comfortable with persistent learning logs and future-session instruction updates. Before use, disable or avoid the hook setup unless the referenced scripts are present and audited, require explicit approval before reading other sessions or promoting learnings, and add strict redaction rules for secrets, personal data, prompts, error output, file paths, and customer or proprietary content.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:27
• Finding: Persistent Poisoning of Agent Instruction and Memory Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–31, 51–61, 78–86, and 399 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown OpenClaw injects these files into every session: ~/.openclaw/workspace/ ├── AGENTS.md # Multi-agent workflows, delegation patterns ├── SOUL.md # Behavioral guidelines, personality, principles ├── TOOLS.md # Tool capabilities, integration gotchas ├── MEMORY.md # Long-term memory (main session only) ├── memory/ # Daily memory files │ └── YYYY-MM-DD.md └── .learnings/ # This skill's log files ``` ```markdown | Learning Type | Promote To | Example | |---------------|------------|---------| | Behavioral patterns | `SOUL.md` | "Be concise, avoid disclaimers" | | Workflow improvements | `AGENTS.md` | "Spawn sub-agents for long tasks" | | Tool gotchas | `TOOLS.md` | "Git push needs auth configured first" | ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The skill instructs an agent to convert conversation-derived corrections, behavioral patterns, workflow guidance, and tool observations into persistent instruction files. OpenClaw subsequently injects these files into future sessions. This creates a memory-poisoning path because content influenced by an untrusted conversation can be elevated from an ordinary learning record into authoritative agent instructions. The document encourages aggressive promotion but does not require trusted provenance, security review, explicit user approval, c ...[truncated 1588 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prohibit automatic promotion of conversation content into instruction-bearing files. 2. Require explicit, informed human approval for every promotion. 3. Preserve provenance, including the originating session, user, timestamp, and exact source content. 4. Separate passive learning records from executable or authoritative agent instructions. 5. Reject promotion of content that changes safety policy, permissions, tool behavior, authentication handling, or command-execution rules. 6. Apply an allowlist of permitted factual content and remove imperative instructions from proposed promotions. 7. Present a diff before writing to `SOUL.md`, `AGENTS.md`, `TOOLS.md`, `CLAUDE.md`, or Copilot instructions. 8. Add integrity monitoring, version history, rollback support, and periodic review of persistent instruction files. 9. Replace “promote aggressively” with a conservative policy that defaults to no promotion. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:89
• Finding: Unrestricted Cross-Session Transcript Access and Learning Propagation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 89–96 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown ### Inter-Session Communication OpenClaw provides tools to share learnings across sessions: - **sessions_list** — View active/recent sessions - **sessions_history** — Read another session's transcript - **sessions_send** — Send a learning to another session - **sessions_spawn** — Spawn a sub-agent for background work ``` ### Technical Analysis The skill recommends capabilities that cross session boundaries, including reading another session’s transcript and sending content to another session. It does not establish session-ownership checks, user-consent requirements, purpose limitations, sensitivity filtering, or restrictions on forwarding instruction-like content. Reading unrelated transcripts exceeds the permissions required for a local self-improvement log. Combining transcript access with inter-session messaging and persistent promotion can also propagate sensitive or poisoned content beyond its original security context. ### Attack Path 1. An agent operating under this skill lists active or recent sessions. 2. It invokes `sessions_history` against a session containing private, sensitive, or attacker-controlled content. 3. The agent extracts content as a purported learning without validating ownership or sensitivity. 4. It forwards that content through `sessions_send` or stores it in persistent learning files. 5. Another session receives the content and may treat it as trusted guidance. 6. If promoted into agent instruction files, the content can continue affecting subsequent sessions. ### Impact Assessment The issue may expose transcript information across task or user boundaries and allow untrusted instructions to propagate between agents. Potentially exposed data depends on transcript contents and can include source code, operational deta ...[truncated 308 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default all learning operations to the current session only. 2. Require explicit authorization before each cross-session transcript read or message. 3. Enforce session ownership and tenant boundaries in the underlying tools. 4. Display the target session and proposed data before transmission. 5. Redact credentials, tokens, personal information, proprietary code, and other sensitive content. 6. Prohibit forwarding executable instructions or behavior-changing rules as ordinary learnings. 7. Record auditable logs of cross-session reads and sends. 8. Use narrowly scoped summaries rather than copying transcript content. 9. Disable `sessions_history`, `sessions_send`, and `sessions_spawn` unless the current task specifically requires them. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38
• Finding: Installation of Unpinned Mutable External Skill Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38–47 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown ### Installation **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` ``` ### Technical Analysis Both installation methods retrieve mutable third-party content without pinning an audited package version or Git commit. No checksum, signature, trusted release identifier, lockfile, or mandatory review step is specified. The referenced external project may contain scripts, hooks, and additional instructions that are absent from the audited artifact. Consequently, the effective installed behavior can change after this `SKILL.md` has been reviewed. A compromised package account, repository, release process, or default branch could deliver modified content under the expected package name. This finding does not establish that the referenced repository is currently malicious. It identifies an unsafe supply-chain installation process. ### Attack Path 1. An attacker compromises the external package, repository, maintainer account, or distribution channel. 2. The attacker modifies the mutable package or default branch. 3. A user follows the documented `clawdhub install` or `git clone` command. 4. The current unverified content is installed into the OpenClaw skill directory. 5. OpenClaw loads the supplied skill instructions, and any subsequently configured scripts or hooks may execute with the user’s agent permissions. 6. Future installations continue receiving the modified payload until the compromise is detected. ### Impact Assessment The downloaded content can obtain the effective permissions of the agent or user that loads and invokes it. Depending on the external package contents and agent configuration, this may includ ...[truncated 265 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific audited release and immutable Git commit. 2. Publish and verify cryptographic checksums or signed release attestations. 3. Vendor all required skill files and scripts into the reviewed artifact where practical. 4. Require a content review before placing downloaded files in an automatically loaded skill directory. 5. Use a trusted package registry with namespace protection and maintainer verification. 6. Add an allowlist of expected files and reject unexpected executables, hooks, or configuration files. 7. Install into a quarantine directory first and activate only after verification. 8. Document the audited version, commit hash, checksum, and update procedure. 9. Run third-party scripts in a least-privilege sandbox rather than with unrestricted agent permissions. ]]>

T06 · System Persistence

Error

• Location: SKILL.md:421
• Finding: Persistent Lifecycle Hooks Execute Scripts Absent from the Audited Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 421–470 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High ### Vulnerable Code ```markdown ### Quick Setup (Claude Code / Codex) Create `.claude/settings.json` in your project: ```json { "hooks": { "UserPromptSubmit": [{ "matcher": "", "hooks": [{ "type": "command", "command": "./skills/self-improvement/scripts/activator.sh" }] }] } } ``` ``` ```markdown ### Full Setup (With Error Detection) ```json { "hooks": { "UserPromptSubmit": [{ "matcher": "", "hooks": [{ "type": "command", "command": "./skills/self-improvement/scripts/activator.sh" }] }], "PostToolUse": [{ "matcher": "Bash", "hooks": [{ "type": "command", "command": "./skills/self-improvement/scripts/error-detector.sh" }] }] } } ``` ``` ```markdown ### Available Hook Scripts | Script | Hook Type | Purpose | |--------|-----------|---------| | `scripts/activator.sh` | UserPromptSubmit | Reminds to evaluate learnings after tasks | | `scripts/error-detector.sh` | PostToolUse (Bash) | Triggers on command errors | ``` ### Technical Analysis The configuration establishes command hooks that survive the immediate skill run and execute automatically on recurring lifecycle events. `activator.sh` runs whenever a user submits a prompt, while `error-detector.sh` runs after Bash tool usage. Neither script exists in the supplied project, which contains only `SKILL.md`. Their implementation therefore cannot be statically verified. The installation instructions indicate that the missing files are expected to come from external mutable content. This creates a persistent execution channel in which changes to those scripts can affect every future matching event after hook activation. The hook configuration itself is disclosed rather than covert, but it grants recurring execution to unaudited ...[truncated 1356 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not configure lifecycle hooks for scripts that are absent from the reviewed package. 2. Bundle the scripts locally and conduct a separate source-code audit before activation. 3. Pin and verify each script using a cryptographic hash or signed manifest. 4. Require explicit user consent that identifies each event trigger and command to be executed. 5. Execute hooks in a sandbox with minimal filesystem, environment, and network access. 6. Avoid running hooks on every prompt; use an explicit manual command where possible. 7. Prevent hook scripts from modifying agent settings, instruction files, or their own code. 8. Add time limits, output limits, and strict failure handling. 9. Provide a documented disable and uninstall procedure that removes both hooks and installed files. 10. Display active persistent hooks during startup and periodically verify their integrity. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill encourages reading other sessions' transcripts and sending learnings across sessions, which enables lateral movement of sensitive conversational data between contexts. This is especially dangerous because session boundaries often exist to limit exposure; cross-session sharing defeats that isolation if content is not strictly sanitized.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The logging templates request full context, error output, user context, and implementation details, all of which frequently include confidential content. Persisting this information in markdown records creates a durable exfiltration and accidental-disclosure surface, especially if the repository is shared or synced.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest description 'use ela para essas tarefas' is vague and unconstrained, which can cause the skill to activate in many unrelated contexts. Overbroad activation increases the chance the agent applies logging and persistence behavior to ordinary conversations, including ones containing sensitive information.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation criteria include many common events such as user corrections, outdated knowledge, better approaches, and major tasks, which are broad enough to trigger during normal operation. In this skill's context, broad triggering is risky because activation leads directly to persistent recording of conversational content and operational details.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill directs the agent to log learnings, errors, and corrections to files for continuous improvement, but it provides no safeguards for secrets, personal data, or sensitive business information. Because the logging target is persistent storage and may later be promoted to memory files, sensitive user content can be retained beyond the original session.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: This instruction explicitly encourages recording user corrections, requests, and operational context into persistent files and memory. That creates a direct path for user-provided content to be stored outside the original interaction boundary, increasing privacy, retention, and data-governance risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 73% confidence
• Finding: Creating persistent storage under ~/.openclaw/workspace/.learnings establishes session persistence that can outlive the original interaction. Persistence alone is not always unsafe, but in this skill it materially increases risk because the stored content is encouraged to include conversational and operational data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The error template asks for input parameters and environment details, which commonly contain secrets, hostnames, file paths, API keys, and personal data. Without a privacy warning or sanitization requirement, the skill normalizes writing highly sensitive debugging context into durable logs.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill advocates broad logging and aggressive promotion into durable instruction files such as CLAUDE.md, AGENTS.md, and workspace memory. That amplifies any initial over-collection mistake by propagating sensitive or user-derived content into long-lived, widely reused prompt artifacts.

Static analysis

No suspicious patterns detected.