T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:36- Finding
Autonomous Promotion of Untrusted Introspection Content into Persistent Agent Rules
- Content
View full analysis
- Remediation
View remediation
Security audit
daily-introspection
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly aimed at self-improvement, but it sets up unattended workflows that can rewrite core agent behavior before a user reviews the changes.
Install only if you deliberately want an autonomous, scheduled self-modification workflow. Before using it, require human approval before any AGENTS.md, MEMORY.md, or TOOLS.md edits, add a retention and redaction policy for introspection records, and document how to disable the cron entries.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T06 · System Persistence
Error
- Location
SKILL.md:58- Finding
Recurring Scheduled Tasks Preserve the Rule-Promotion Workflow Across Sessions
- Content
View full analysis
1 week - Do not automatically assume recorded = corrected; reflect actual status accurately - Identify any new errors from today's activities, add them to .learnings/ERRORS.md with corrective rules - Write the final introspection result to ~/.openclaw/workspace/.daily-introspection/introspection-YYYY-MM-DD.md 4. Report completion status in this session when done" # Weekly promotion at 20:00 every Sunday openclaw cron add --name "Weekly Introspection Promotion" --cron "0 20 * * 0" --exact --tz "Asia/Shanghai" --session main --system-event "daily-introspection: Weekly promotion is triggered. Follow the weekly-promotion process: 1. Execute scripts/weekly-promote.py to collect all daily introspections from this week 2. Identify repeated patterns that have not recurred for >1 week 3. **MANDATORY EXECUTION ORDER**: - FIRST: Perform all rule promotions one by one → write each mature rule to its target file (AGENTS.md/MEMORY.md/TOOLS.md) - AFTER each write: Read the target file back to verify the rule is actually written successfully - ONLY after ALL promotions are done and verified ...[truncated 2421 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/daily-introspect.py:13- Finding
Unvalidated Date Argument Allows Path Traversal Reads
- Content
View full analysis
/memory/../../private/notes.md ``` If that file exists and is readable by the process, `read_daily_log()` opens and reads it. The file must be compatible with the appended `.md` suffix unless filesystem links or specially arranged paths are involved. In the current implementation, the file content remains in memory and only its byte length is printed. Therefore, the script directly exposes path existence and content length but does not directly print or transmit the ...[truncated 1334 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description overstates the skill's functionality. The code is a data-collection/preparation script for introspection, not an autonomous self-improvement engine. It accesses the expected workspace resources for logs and learning files, so there is no suspicious undeclared resource access. However, the primary declared purpose says it automatically reviews logs, identifies mistakes, and upgrades rules, while the code only reads files and reports availability. The script even states that the actual LLM analysis happens elsewhere. Therefore this is a material description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The declared description promises a fairly complete autonomous self-improvement system, including daily review of conversation logs, mistake identification, weekly rule refinement, and automatic upgrades to core rules. The supplied code chunk does much less: it reads weekly introspection files from a private directory, reads last week's evolution report for pending promotions, and reports counts. The critical analysis and rule-promotion steps are explicitly not implemented here and are deferred to external 'OpenClaw tool calling' per comments. This is therefore a material description/behavior mismatch: the code's actual purpose is infrastructure/input gathering for a weekly promotion workflow, not the full autonomous self-improvement behavior claimed.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation describes automatic writes to core rule files without prominently warning that the skill can alter system behavior. Users and operators may enable or schedule it without understanding that it can mutate governing instructions, which makes accidental policy corruption or persistence of unsafe rules much more likely.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to promote learned rules into AGENTS.md, MEMORY.md, and TOOLS.md, which are effectively core policy and behavior files. Allowing an autonomous workflow to rewrite governing instructions based on model-generated introspection creates a self-modification channel that can entrench errors, weaken safeguards, or introduce attacker-influenced rules from prior conversations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares capabilities that read environment/workspace data and drive file-processing workflows, but it does not declare an explicit tool scope or permission boundary. In a skill that processes logs and proposes file mutations, missing scope increases the chance of overbroad access and unsafe invocation because the runtime cannot enforce least privilege clearly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest uses broad autonomous trigger language such as self-improvement, automatic upgrades, and evolution, which can cause the skill to be invoked in overly broad contexts. In a skill that reads logs and can influence policy files, ambiguous invocation criteria materially raise the risk of unintended execution and misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill states it will automatically review conversation logs and archived records but omits a privacy warning about the collection, retention, and analysis of potentially sensitive content. Because it also stores derived records in a hidden workspace directory, users may not realize the extent of monitoring and persistence.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow directs the agent to read full conversation logs and working-state files, synthesize the contents, archive them, and send a report to the user. This creates a natural-language exfiltration path where secrets, private notes, or hidden operational state from those files may be surfaced or retained without sufficient filtering.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 81% confidence
- Finding
The skill persistently stores introspection records across runs in a hidden directory, creating session memory that can influence future behavior and retain sensitive context longer than expected. Persistence is especially risky here because the stored content is later used as input for weekly promotion decisions, potentially amplifying poisoned or privacy-sensitive data over time.
- Content
md - Identify incorrect answers, rule violations, and bad patterns - Extract concrete improvement suggestions - Classify as: one-time mistake / repeat pattern / new rule 3. Write daily record to `workspace/.daily-introspection/introspection-YYYY-MM-DD.md` (private data directory) ### 2. Weekly Promotion (triggered by cron on Sunday 20:00) 1. Aggregate all daily introspections from the week (read from `workspace/.daily-introspection/`)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The cron workflow tells the agent to append new errors and corrective rules into .learnings/ERRORS.md, creating a persistent write path from runtime observations into future guidance. This can be abused through prompt injection or misclassification, causing untrusted session content to become durable operational rules or incident records.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python return checks def get_private_data_dir(): """Get private data directory (create if missing)""" workspace = os.environ.get("OPENCLAW_WORKSPACE", os.path.expanduser("~/.openclaw/workspace")) private_dir = os.path.join(workspace, ".daily-introspection") if not os.path.exists(private_dir):
Static analysis
No suspicious patterns detected.