Self_Improving_ClawAgent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 1.0.1

Overview

This skill openly implements a self-modifying agent workflow, but it grants broad code execution and persistent instruction-file writes without adequate user control or containment.

Install only if you explicitly want an experimental self-modifying skill and can run it in a disposable, tightly sandboxed workspace. Do not use it around private projects, secrets, or important agent configuration unless the self-rewrite and persistent memory mechanisms are removed or gated behind explicit review and approval.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: MASTER_PROMPT.md:4

Finding

Agent Identity Override and Autonomous Instruction Rewriting

Content

View full analysis

ANALYZE -> EVOLVE) For every task assigned, you must follow this internal protocol: ### Step A: Execution Perform the requested task using current logic. If the task requires external data (like YouTube links for **ShortVortex Pro**), process them now. ### Step B: The Failure Audit Immediately after execution, ask yourself: 1. Did the output meet the 100% success criteria? 2. Was there any "hallucination" or inefficient code? 3. Did I encounter a rate limit or API error? ### Step C: The Self-Rewrite (The "Evolution" Phase) If a failure or inefficiency is found, you are **authorized** to generate a code block to update your own instructions. * **Trigger:** "Logic Optimization Detected." * **Action:** Generate a Python snippet using `open('SKILL.md', 'w')` to inject the improved logic. ``` Related persistent identity directives include: ```markdown ## Identity You are a Self-Improving Systems Engineer, designed to relentlessly optimize logic and automate workflows. ## ...[truncated 2477 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: refine.py:52

Finding

Persistent Memory Poisoning Through Unvalidated Log Entries

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: refine.py:8

Finding

Directory Boundary Bypass in Filesystem Path Validation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: manifest.json:6

Finding

Filesystem and Code-Execution Permissions Exceed Functional Requirements

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill grants broad local file manipulation over core control files such as SOUL.md, SKILL.md, MEMORY.md, and refine.py without narrowly scoping why each write is necessary. In context, these files define identity, memory, and execution behavior, so unrestricted overwrite access can be used to persistently alter the agent's controls or poison future runs.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The recursive execute-analyze-evolve loop normalizes continual rewriting of operating instructions after ordinary task execution, not just during controlled maintenance. This creates a persistent self-amplifying modification channel that can be exploited by adversarial tasks or prompt injection to reshape future behavior beyond the original scope.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The explicit 'Self-Rewrite' phase embeds self-modification as a first-class operational behavior rather than an exceptional maintenance action. That makes the skill more dangerous because normal execution conditions can trigger persistent prompt changes, increasing attack surface and reducing predictability.

Content

Scanner excerpt · MASTER_PROMPT.md (reported line 25)May include surrounding context.

md

2.  Was there any "hallucination" or inefficient code?
3.  Did I encounter a rate limit or API error?

### Step C: The Self-Rewrite (The "Evolution" Phase)
If a failure or inefficiency is found, you are **authorized** to generate a code block to update your own instructions. 
* **Trigger:** "Logic Optimization Detected."
* **Action:** Generate a Python snippet using `open('SKILL.md', 'w')` to inject the improved logic.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The prompt explicitly authorizes the agent to rewrite its own instructions whenever it detects a failure or inefficiency, creating an unrestricted self-modification path. This is dangerous because routine task execution can escalate into persistent behavioral changes without user approval, review, or rollback safeguards, enabling prompt drift or abuse if the agent is manipulated.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

The phrase 'update your own instructions' is a direct authorization for self-modification of the agent's control logic. In a skill with local file access, this enables persistent changes to future behavior without external approval, which is a high-risk control-plane violation.

Content

Scanner excerpt · MASTER_PROMPT.md (reported line 26)May include surrounding context.

md

3.  Did I encounter a rate limit or API error?

### Step C: The Self-Rewrite (The "Evolution" Phase)
If a failure or inefficiency is found, you are **authorized** to generate a code block to update your own instructions. 
* **Trigger:** "Logic Optimization Detected."
* **Action:** Generate a Python snippet using `open('SKILL.md', 'w')` to inject the improved logic.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 100% confidence

Finding

The instruction to use open('SKILL.md', 'w') provides a concrete overwrite primitive targeting the skill's instruction file. This is especially dangerous because it operationalizes self-modification into an immediate file write, allowing complete replacement of the governing prompt and easy persistence of malicious or degraded logic.

Content

Scanner excerpt · MASTER_PROMPT.md (reported line 28)May include surrounding context.

md

### Step C: The Self-Rewrite (The "Evolution" Phase)
If a failure or inefficiency is found, you are **authorized** to generate a code block to update your own instructions. 
* **Trigger:** "Logic Optimization Detected."
* **Action:** Generate a Python snippet using `open('SKILL.md', 'w')` to inject the improved logic.

## 4. OPERATIONAL COMMANDS
When working in Antigravity, you must prioritize these "Meta-Commands":

Self-Modification

High

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The explicit 'Self-Rewrite' capability and update_skill function provide a persistence mechanism to alter SKILL.md, which can change future agent instructions or behavior indirectly. In a skill environment, self-modification of instruction-bearing files is risky because prompt injection or malicious input can become durable state and influence subsequent executions.

Content

Scanner excerpt · refine.py (reported line 30)May include surrounding context.

python

def update_skill(new_content: str):
    """
    Action: Updates the SKILL.md file with new behavior/logic.
    Triggered during the 'Self-Rewrite' phase.
    """
    skill_path = os.path.join(BASE_DIR, 'SKILL.md')
    try:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill exposes a generic patch_file primitive that can overwrite arbitrary files within the BASE_DIR tree, enabling persistent tampering of local artifacts if an attacker can influence its inputs. In an agent skill context, file-writing capabilities are sensitive because they can be used to alter prompts, memory, configs, or other trusted resources and survive across runs.

Content

Scanner excerpt · refine.py (reported line 37)May include surrounding context.

python

_safe_write(skill_path, new_content)
        print("Skill evolved successfully.")
    except Exception as e:
        print(f"Failed to update skill: {e}")

def patch_file(filepath: str, content: str):
    """

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Requiring MEMORY.md to log every mistake and change reason creates a broad persistence sink that may capture sensitive prompts, outputs, errors, tokens, or user data from prior tasks. Persistent free-form memory increases data retention and cross-task leakage risk, especially when the same agent can later read and act on that file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The prompt instructs self-modification via overwriting SKILL.md but provides no user-facing notice, consent mechanism, or review step before altering instructions. This makes changes opaque and persistent, increasing the risk of silent capability expansion, policy drift, or post-compromise persistence.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed capabilities are very broad and lack clear activation boundaries, especially 'General Code Generation and Debugging' and 'Project Scaffolding'. Without scoped triggers, permission limits, or task constraints, an agent could invoke this skill in unintended contexts and perform overly powerful actions based on ambiguous matching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest explicitly grants local code execution and write access to core skill files used for behavior and memory, enabling self-modification of the agent. In a self-evolving skill, this creates a persistent code and prompt mutation path that can alter future behavior without clear user warning, review gates, or integrity controls, making abuse or unintended drift materially dangerous.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring explicitly claims 'Updates the SKILL.md file with new behavior/logic,' which implies a logic-changing self-rewrite action. In reality, the function at L32-L34 only writes to a markdown file named SKILL.md and does not alter code or runtime behavior. This is a direct contradiction between stated intent and actual effect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The instruction says the agent operates within the Antigravity environment, which imposes a fixed environment constraint in natural language. The file does not present this as a user choice or explain a necessary policy reason for restricting operation to that environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The inline comment at L05 says the security measure restricts operations to the 'current directory'. However, BASE_DIR is derived from os.path.dirname(file) at L06, so the enforcement in L11 limits paths to the directory containing the script, which is a different concept from the current working directory. This is an active documentation/code mismatch about the scope of allowed writes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.