ClawHub
Back to skill

Security audit

Openclaw Self Improving Agent 3.0.1

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate learning logger, but it gives agents broad persistent memory and prompt-context influence without enough consent, scoping, or redaction guidance.

Review this before installing. Use project-local logs, avoid global hooks, add narrow hook matchers, redact secrets and personal data from learning entries, and require explicit human approval before anything is promoted into agent instruction or workspace memory files.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:346
Finding

Conversation-derived learnings can poison persistent agent instruction files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:346-360
Related Locations: SKILL.md:23-26, SKILL.md:120-128, SKILL.md:262-289
Vulnerability Type: Persistent agent memory and instruction poisoning
Risk Level: High

Vulnerable Code Snippet

markdown
### Promotion Rule (System Prompt Feedback)

Promote recurring patterns into agent context/system prompt files when all are true:

- `Recurrence-Count >= 3`
- Seen across at least 2 distinct tasks
- Occurred within a 30-day window

Promotion targets:
- `CLAUDE.md`
- `AGENTS.md`
- `.github/copilot-instructions.md`
- `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable

Write promoted rules as short prevention rules (what to do before/while coding),
not long incident write-ups.

The Skill also explicitly accepts user feedback as a learning source and promotes broadly applicable material:

markdown
| User corrects you | Log to `.learnings/LEARNINGS.md` with category `correction` |
| Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` |
| Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) |
| Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) |
| Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) |

Technical Analysis

The Skill creates a pipeline from user-controlled conversation content to persistent agent-context files. User corrections and feedback can be recorded in .learnings/LEARNINGS.md, after which recurring entries can be promoted into CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, SOUL.md, or TOOLS.md.

These destinations are described as files that are injected into subsequent agent sessions. The promotion criteria check recurrence, task count, and time window, but do not establish trusted provenance, require human approval, detect embedded instructions, or prevent promoted rules from altering authorization and safety behavior. ...[truncated 2006 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit human approval before writing any learning into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or .github/copilot-instructions.md.
  2. Treat conversations, command output, external documentation, issue text, and existing learning entries as untrusted data.
  3. Do not promote content verbatim. Convert it into a structured record containing provenance, evidence, scope, confidence, reviewer identity, and review date.
  4. Reject promoted rules that attempt to:
    • Override system or safety instructions.
    • Disable validation or authorization checks.
    • Expand tool permissions.
    • Request secrets or sensitive output.
    • Require unreviewed command execution.
    • Suppress warnings, logging, or user confirmation.
  5. Separate factual project memory from behavioral instructions. Conversation-derived facts should not automatically become agent policy.
  6. Use an allowlisted schema for promotion rather than arbitrary Markdown.
  7. Add ownership and mandatory review controls, such as repository branch protection or CODEOWNERS, for agent-context files.
  8. Preserve an auditable link from every promoted rule to its source evidence.
  9. Provide an automated rollback mechanism for promoted instructions.
  10. Clarify that recurrence only prioritizes review and never establishes trust.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Installation instructions retrieve mutable and unverified Skill content

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:30-44
Vulnerability Type: Unpinned third-party Skill installation
Risk Level: Medium

Vulnerable Code Snippet

markdown
## OpenClaw Setup (Recommended)

OpenClaw is the primary platform for this skill. It uses workspace-based prompt injection with automatic skill loading.

### Installation

**Via ClawdHub (recommended):**
```bash
clawdhub install self-improving-agent

Manual:

bash
git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent

Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement

text

### Technical Analysis

Both documented installation methods resolve mutable external content without pinning an immutable version, commit hash, or artifact digest.

The manual command clones the repository's current default branch directly into an OpenClaw Skill directory. The registry command also does not specify a version in the documented invocation. Consequently, the effective Skill content installed by users can differ from the version reviewed during this audit.

This is security-sensitive because Skill Markdown changes agent behavior when loaded, while bundled hooks and scripts can execute with the user's permissions when enabled or invoked. HTTPS protects the transport connection but does not protect against compromise of the upstream account, repository, registry entry, or latest release.

The audited package itself does not contain a remote payload execution mechanism. The risk arises from the installation procedure accepting future, unreviewed supply-chain content.

### Attack Path

1. An attacker compromises the upstream repository, maintainer account, registry package, or publication process.
2. The attacker modifies the default branch or current registry artifact to include hostile Skill instructions, hook code,
...[truncated 1193 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a reviewed release and immutable commit hash.
  2. Publish SHA-256 digests or signed release manifests and require verification before installation.
  3. Use an explicitly versioned registry command rather than implicitly installing the latest package.
  4. For manual installation, document a process such as:
    • Clone without enabling the Skill.
    • Check out an approved commit.
    • Verify the commit signature or published digest.
    • Review SKILL.md, hook handlers, and executable scripts.
    • Copy the verified files into the active Skill directory.
  5. Separate download from activation so externally retrieved content is not automatically loaded.
  6. Require an additional confirmation and integrity check before enabling hooks.
  7. Document the exact version and source commit corresponding to each audited release.
  8. Monitor the distribution account and repository with protected branches, mandatory review, signed releases, and multi-factor authentication.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description describes a reflective/operational learning-capture skill: recording failures, corrections, outdated knowledge, and reviewing learnings before major tasks. The supplied code does something materially different: it is a filesystem-writing helper that creates a new skill scaffold template from a skill name. While the template mentions extraction from a learning entry, the script does not capture learnings, process corrections, inspect failures, or review prior learnings. Its primary purpose is skill scaffolding, not continuous-improvement memory handling. Therefore the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Referencing ~/.claude/settings.json introduces persistent agent configuration at the user level, which is a high-value target because modifications there affect all future sessions. In the context of a self-improving agent skill that injects hooks automatically, encouraging edits to this directory materially increases the risk of durable cross-session behavior and stealthy persistence if the script path or config is later tampered with.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

The documented sessions_send capability provides a direct channel to transmit arbitrary content to another session, which can be used to exfiltrate sensitive information or propagate hostile instructions across sessions. In the context of a self-improvement skill, this communication path is unnecessary for basic local learning capture and materially increases abuse potential.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description says to use the skill whenever a command fails, the user corrects the agent, a capability is missing, an API/tool fails, knowledge is outdated, or a better approach is found. Several of these are common conversational or operational situations, and the description does not provide negative examples or boundaries for when not to invoke the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

The skill instructs creation of persistent workspace storage under ~/.openclaw/workspace/.learnings, establishing long-lived session memory outside the immediate task. Persistent local storage is a real risk when combined with broad logging triggers and rich context capture, because sensitive data can remain on disk indefinitely and become accessible to later sessions, users, or tools.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly encourages use of inter-session tools to read other sessions' transcripts and send learnings across sessions. That creates a real confidentiality boundary issue: transcripts and derived learnings may contain sensitive user data, secrets, or project context that can be disclosed beyond the original session without clear consent or minimization.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The logging templates instruct the agent to persist corrections, full context, inputs, parameters, environment details, error output, and related files into durable markdown logs. This is dangerous because such free-form data often contains secrets, personal data, proprietary code details, or incident artifacts, and the same document later encourages promotion and sharing across broader memory files, amplifying disclosure and retention risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The feature-request trigger phrases are common conversational language and can match benign user requests, causing unnecessary persistent logging of ordinary dialogue. Because the skill stores user context and requested capabilities, these overbroad triggers materially increase data retention and privacy exposure without meaningful user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

An empty hook matcher causes the reminder/activation logic to run on every prompt, which is overbroad for a persistence-oriented skill. In practice this increases the chance of indiscriminate logging, prompt pollution, unnecessary execution of helper commands, and accidental capture of sensitive conversational material unrelated to learnings.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest positions the skill as a self-improvement logger and reviewer for failures, corrections, and discovered better approaches. The Automatic Skill Extraction section introduces a separate capability for generating new skills, including helper script execution and manual skill authoring workflows, which is a broader productization capability not justified by the declared purpose.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

Project-level hook configuration creates session-persistent behavior that automatically reappears whenever the project is opened, which can silently influence future agent actions. In this skill's context, persistence is the stated goal, so the risk is amplified because the mechanism is designed to survive across interactions and continuously inject reminders or logic without fresh approval each time.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The empty matcher causes the hook to run on every prompt, creating broad unsolicited execution of a local script for all interactions in the project. Even if the script currently only emits text, this pattern expands attack surface, increases prompt-context injection opportunities, and makes any future script change or path hijack automatically affect all prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The user-level configuration installs the hook globally in ~/.claude/settings.json, so the activator runs across unrelated repositories and sessions without per-project review. That broad persistence magnifies the impact of a compromised script, unsafe future edits, or prompt-injection-style reminder text because the behavior follows the user everywhere.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Although presented as a minimal setup, it still uses an empty matcher that activates on every prompt, normalizing overly broad hook execution. This makes the hook harder to reason about, increases unnecessary exposure, and can leak reminder text or altered behavior into all prompts rather than only relevant error-handling or learning scenarios.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The Codex CLI example duplicates the same always-on empty matcher behavior, extending the unsafe pattern to another agent environment. This broadens the blast radius across tools and can cause unreviewed script output or future script compromise to influence every prompt in Codex sessions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation instructs promoting 'learnings' into AGENTS.md, SOUL.md, and TOOLS.md, which are injected into future sessions as prompt context. This creates a persistence and behavior-modification path where transient observations can silently become durable agent instructions, enabling prompt-injection style contamination of future runs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide expands a 'self-improvement' skill into cross-session coordination by documenting transcript access, message sending, and agent spawning. Those capabilities can expose unrelated session data and broaden the skill's authority beyond its stated purpose, increasing the chance of lateral data access or misuse if the skill is triggered in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide documents reading another session's transcript without any warning about privacy boundaries, authorization, or data sensitivity. That normalizes access to potentially confidential prior conversations and can lead to inappropriate disclosure between tasks, users, or trust zones.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.