Self-Improving Agent

PassAudited by VirusTotal on May 13, 2026.

Overview

Type: OpenClaw Skill Name: self-improving-agent Version: 3.0.21 The skill bundle implements a structured 'self-improvement' framework for OpenClaw agents, allowing them to log errors, corrections, and feature requests to local markdown files. It includes utility scripts (e.g., `extract-skill.sh`, `error-detector.sh`) and OpenClaw hooks (`handler.js`) designed to automate the capture of learnings and provide contextual reminders to the agent. While the skill facilitates the modification of agent instruction files like `SOUL.md` and `AGENTS.md`, it includes explicit safety guidelines advising the agent not to log secrets, tokens, or sensitive environment variables. The scripts utilize standard shell commands and include basic security checks, such as path traversal prevention, aligning entirely with the stated purpose of continuous workflow optimization.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Incorrect, overly broad, or sensitive entries could persist and influence future agent behavior.

Why it was flagged

The skill deliberately stores learnings and can promote them into files that future agent sessions may read as guidance.

Skill content
important learnings get promoted to project memory ... Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md`
Recommendation

Review .learnings and promoted memory files periodically, redact sensitive details, and require user approval before promoting entries into long-term agent instructions.

What this means

Once enabled, the agent will receive recurring reminders to capture learnings, which can affect future session behavior and context size.

Why it was flagged

The optional OpenClaw hook automatically adds a self-improvement reminder during agent bootstrap when enabled.

Skill content
Only handle agent:bootstrap events ... Inject the reminder as a virtual bootstrap file
Recommendation

Enable the hook only if you want automatic reminders, and disable it if the persistent prompt behavior becomes intrusive.

What this means

If used carelessly, cross-session tools could expose transcript contents or start background work beyond the current task.

Why it was flagged

The skill documents cross-session transcript access, messaging, and sub-agent spawning, while also instructing that these be used only in trusted environments with explicit user intent.

Skill content
**sessions_history** — Read another session's transcript ... **sessions_send** — Send a learning to another session ... **sessions_spawn** — Spawn a sub-agent
Recommendation

Use cross-session features only with explicit user approval, send sanitized summaries instead of raw transcripts, and avoid sharing secrets or full command output.

What this means

Manual installs from an unpinned repository may differ from the reviewed artifact version.

Why it was flagged

The manual installation example pulls the latest repository contents without pinning a commit or release.

Skill content
git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent
Recommendation

Prefer the registry install for the reviewed version, or pin and inspect a specific commit when installing manually.