self-improving agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:39 AM UTC
• Version: 4.0.2

Overview

This skill is mostly purpose-aligned, but its optional hook can automatically read session transcripts and persist excerpts with insufficient path scoping and only best-effort redaction.

Install only if you want persistent learning logs. Keep .learnings out of version control, review entries before promoting them into AGENTS.md, TOOLS.md, or SOUL.md, and enable the optional hook only in workspaces where session transcripts may be scanned and retained. Treat uninstall deletion commands carefully because .learnings is user data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: hooks/openclaw/handler.js:213

Finding

Unrestricted Transcript Path Can Read Files Outside the Workspace

Content

View full analysis

/sessions`. The fallback path is also unsafe because `sessionId` is not restricted to a safe identifier format. Values containing `..` or path separators can cause `path.join()` to resolve outside the intended sessions directory. The vulnerability requires an attacker or compromised component to influence OpenClaw hook event metadata. Under ...[truncated 1591 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: hooks/openclaw/handler.js:81

Finding

Best-Effort Redaction Can Persist Sensitive Transcript Data

Content

View full analysis

MAX_EXCERPT_LENGTH) { excerpt = `${excerpt.slice(0, MAX_EXCERPT_LENGTH)}…`; } return excerpt; } ``` The resulting excerpts are persisted: ```js const excerpt = sanitizeExcerptLine(line); if (!excerpt || seen.has(excerpt)) { continue; } seen.add(excerpt); excerpts.push({ excerpt, patternKey }); ``` ```js await fs.appendFile(errorsFilePath, `\n${entry}\n`); ``` Equivalent logic appears in `hooks/openclaw/handler.ts:81-91, 115-129, 164-217, 356`. ### Technical Analysis The hook automatically copies error-matching transcript lines into `.learnings/ERRORS.md`. The redaction strategy is a blocklist of known labels and token formats. Such blocklists cannot reliably recognize every sensitive-data representation. Potentially missed data includes: ...[truncated 1780 chars]

Remediation

View remediation

.jsonl ``` 4. If excerpts remain necessary: - Remove URLs, query strings, headers, cookies, connection strings, and filesystem home paths. - Detect PEM/private-key headers and suppress the entire surrounding block. - Replace high-entropy strings regardless of provider-specific prefixes. - Normalize multiline records before applying redaction. - Permit users to configure additional organization-specific patterns. 5. Create log files with restrictive permissions, such as mode `0600`, and verify the existing file is not a symlink before appending. 6. Keep `.learnings/` excluded from version control by default and display a clear warning that redaction is not a confidentiality guarantee. 7. Expand tests to cover connection URLs, cookies, multiline private keys, short credentials, database DSNs, authorization headers with unusual schemes, personal data, and provider-specific token formats. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs use of shell commands, GitHub/network installation flows, hooks, and cross-session features without declaring corresponding permissions or clearly constraining when they may be used. In a prompt-injected skill system, undeclared capabilities reduce transparency and can lead to unexpected access to workspace data, transcripts, or external resources.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest describes a logging/improvement helper, but the body also defines automatic transcript sweeping, bootstrap prompt injection, synthesized error entry creation, and skill extraction workflows. This mismatch is dangerous because users and policy layers may authorize the skill under a narrower mental model while it performs broader persistence and context-shaping actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill encourages promoting collected learnings into persistent workspace guidance files and later into new reusable skills, which can alter future agent behavior beyond the immediate task. This creates a persistence channel where low-quality, overbroad, or adversarially induced entries can become durable prompt influence across sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Cross-session transcript access and messaging materially expand the data-access surface of a skill whose stated purpose is simple learning capture. Even with advisory language, these capabilities can expose unrelated session content, propagate tainted summaries, and weaken isolation between tasks if invoked too broadly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The optional hook automatically sweeps ended-session transcripts for error patterns and writes derived entries into persistent files, which is more invasive than manual note logging. Automated transcript processing can capture sensitive context unintentionally and can create persistent records without a specific user request at the time of collection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Broad correction trigger phrases such as common conversational disagreements can cause over-collection into persistent learning logs from ordinary dialogue, including misleading or adversarial user statements. In this skill's context, that matters because logged items may later be promoted into workspace memory and affect future agent behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The feature-request triggers are generic enough to match normal exploratory conversation, causing the skill to persist user remarks as product requirements without sufficient scope checks. This can pollute logs, create false institutional memory, and indirectly steer future agent actions or generated skills based on casual comments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This hook persists excerpts from prior session transcripts into a workspace file, which can expose user or agent output beyond the original session boundary without an explicit disclosure or consent check at the moment of write. Although the code attempts redaction and truncation, the redaction is best-effort and may miss sensitive data, so transcript-derived content can still be retained in repository state and later committed, shared, or indexed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The hook persists excerpts derived from session transcripts into .learnings/ERRORS.md automatically, but the write happens without explicit user notification or consent at the time of collection. Although the code attempts redaction and truncation, transcript data can still contain sensitive operational details, internal paths, user inputs, or secrets that do not match the regexes, creating a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The hook explicitly persists excerpts from prior session transcripts into <workspace>/.learnings/ERRORS.md and appends indefinitely. Even with truncation and some redaction, session transcripts can contain sensitive user inputs, internal paths, stack traces, secrets that do not match the redaction patterns, or proprietary data, so this creates a durable secondary store of potentially sensitive information beyond the original session logs.

Content

Scanner excerpt · hooks/openclaw/HOOK.md (reported line 40)May include surrounding context.

md

## Opt-In and Safety

- The sweep only runs when `<workspace>/.learnings/` exists — create that
  directory to enable it, delete it to disable it
- `ERRORS.md` is created only if missing and is otherwise appended to, never
  overwritten

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 82% confidence

Finding

The uninstall guide includes recursive deletion commands against fixed paths in the user's home directory. While this appears to be legitimate uninstall documentation, rm -r is destructive and, if copied blindly, could cause unintended data loss, especially for .learnings/ which is explicitly user data and for any path that differs due to symlinks or environment assumptions.

Content

Scanner excerpt · references/uninstall.md (reported line 37)May include surrounding context.

md

rm -r ~/.openclaw/hooks/self-improvement

# 2. Remove the skill
rm -r ~/.openclaw/skills/self-improving-agent

# 3. Optional — remove captured learnings (REVIEW FIRST, this is your data)
rm -r ~/.openclaw/workspace/.learnings

Static analysis

No suspicious patterns detected.