Back to skill

Security audit

self-improving agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local self-improvement logger with optional transcript-sweeping hooks, so it is usable but should be treated as storing potentially sensitive work history.

Install only in workspaces where you are comfortable keeping local notes about errors and corrections. If you enable the optional hook, treat `.learnings/` as sensitive because redaction is best effort, keep it out of version control unless you intentionally want to share it, and periodically review or delete entries you no longer need.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill declares no permissions, yet its documented behavior includes shell commands, filesystem writes, environment-specific paths, hook installation, git/network-based installation flows, and cross-session features. This creates an authorization/transparency gap: users or platforms may trust the manifest as low-risk while the skill can influence persistent workspace state and interact with externally sourced content.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The public description frames the skill as simple learning/error logging, but the body adds broader behaviors: bootstrap prompt injection, transcript scanning, automatic log writing, pending-triage surfacing, and skill extraction scaffolding. That mismatch can mislead operators about the true trust boundary and cause the skill to be enabled in contexts where transcript processing and session modification were not intended.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill advertises access to session listing, session history, session messaging, and spawning, which expands its reach from local self-improvement logging to inter-session data movement. Even though the text advises trusted environments and sanitized summaries, these capabilities increase the risk of unintended disclosure of sensitive transcript content across sessions or agents.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases are broad conversational patterns that can easily match ordinary user dialogue, causing the skill to activate and persist logs when the user did not intend that behavior. In a skill that writes to durable memory-like files, over-triggering can capture unnecessary sensitive context, create noisy records, and bias future agent behavior through unintended retention.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The manifest description defines activation conditions so broadly that the skill may run in many routine situations, including generic corrections, outdated knowledge, or discovering a better approach. Because the skill performs persistent logging and optional hook-based automation, vague activation boundaries increase the chance of unnecessary data retention and unintended workspace modification.

Session Persistence

Medium
Category
Rogue Agent
Content
## Opt-In and Safety

- The sweep only runs when `<workspace>/.learnings/` exists — create that
  directory to enable it, delete it to disable it
- `ERRORS.md` is created only if missing and is otherwise appended to, never
  overwritten
Confidence
79% confidence
Finding
create that directory to enable it, delete it to disable it - `ERRORS.md` is created only if missing and is otherwise appended to, never overwritten - Excerpts are truncated to 200 characters and

Session Persistence

Medium
Category
Rogue Agent
Content
`<workspace>/.learnings/ERRORS.md` (only if `.learnings/` exists — see
  [Error Detection](#error-detection))

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:
Confidence
79% confidence
Finding
Create Learning Files Create the `.learnings/` directory in your workspace: ```bash mkdir -p ~/.openclaw/workspace/.learnings ``` Or in the skill directory: ```bash mkdir -p ~/.openclaw

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.