学习型Agent

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:03 PM UTC
• Version: 1.0.0

Overview

The skill’s self-improvement purpose is coherent, but it asks agents to persist logs, alter long-term agent context, enable always-on hooks, and read/share session history without enough privacy or approval controls.

Review before installing. Keep it project-scoped, avoid global hooks, do not store raw prompts, secrets, tokens, full command output, or transcripts in .learnings, and require explicit human approval before promoting anything into agent instruction or workspace memory files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:23

Finding

Conversation-Derived Content Can Poison Persistent Agent Instructions

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The Skill directs the agent to convert information derived from conversations, user corrections, errors, and tool output into persistent instruction files. Files such as `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md` may be loaded automatically in later sessions and can influence agent behavior. The recurrence rules only measure how often a pattern appears. They do not validate whether its source is trustworthy or whether the content contains embedded instructions. There is no mandatory human approval, provenance enforcement, instruction-content filtering, or restriction preventing security-sensitive behavioral rules from being promoted. An attacker who can repeatedly influence conversations can therefore frame malicious instructions as corrections, best practices, or recurring project conventions. ### Attack Path 1. An attacker submits a plausible but malicious “correction” ...[truncated 1101 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: scripts/activator.sh:8

Finding

Hooks Inject Secondary Instructions into Agent Context

Content

View full analysis

After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. EOF ``` ```javascript if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` The documented installation persists the hook: ```bash cp -r hooks/openclaw ~/.openclaw/hooks/self-improvement openclaw hooks enable self-improvement ``` ### Technical Analysis The activator explicitly emits text as “system context,” while the OpenClaw handler adds a virtual bootstrap file before normal workspace context is loaded. The recommended hook configuration runs the activator after every submitted prompt, and the OpenClaw setup installs an enabled hook under the user’s home directory. This mechanism gives the Skill a recurring secondary objective: collect and promote learnings even when that behavior is unrelated to the user’s immediate request. In combination with persistent promotion into agent-control files, injected reminders create a pathway from untrusted conversation content to durable agent instructions. Although installation is documented as opt-in, once enabled the hook survives the individual Skill invocation and affects subsequent pro ...[truncated 935 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: hooks/openclaw/handler.js:29

Finding

Executable JavaScript Hook Omits the Sub-Agent Exclusion Present in TypeScript

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:87

Finding

Learning Workflow Encourages Cross-Session Transcript Access Without Data-Minimization Controls

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:106

Finding

Skill Extraction Output Validation Can Be Bypassed Through Symbolic Links

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The validation rejects absolute paths and literal `..` components but only performs lexical checks. It does not canonicalize the output directory or inspect whether any path component is a symbolic link. A relative directory inside the workspace may therefore resolve to a location outside it. The subsequent `mkdir -p` and shell redirection follow symbolic links, allowing writes outside the intended workspace boundary with the permissions of the invoking user. The generated filename is fixed as `SKILL.md`, which limits arbitrary filename selection, but the attacker can choose the external parent and the validated skill-name directory. ### Attack Path 1. An attacker who can modify the current workspace creates a symbolic link such as `skills-link` pointing to a writable external directory. 2. The user runs: ```bash ./scripts/extract-skill.sh injected-skill --output-dir skills-link ``` 3. The argument passes validation because it is relative and contains no `..` component. 4. `mkdir -p` follows the symbolic link and creates `injected-skill` outside the workspace. 5. Shell redirec ...[truncated 403 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Installation Instructions Use Mutable, Unverified Remote Sources

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is described as a learning/error capture aid, but it also instructs creation of workspace files, hook installation, transcript sharing, and skill extraction workflows that materially expand its behavior beyond passive note-taking. That mismatch matters because operators may enable or trust it without realizing it persists data, modifies agent configuration, and scaffolds new artifacts, increasing the attack surface and the chance of unintended writes or memory propagation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The error logging instructions explicitly request raw error output, command inputs/parameters, and environment details, all of which commonly contain secrets, tokens, file paths, personal data, or proprietary context. Without redaction guidance or privacy constraints, the skill creates a direct pathway for sensitive data to be copied into durable markdown logs.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The guide recommends installing the hook into ~/.claude/settings.json for global activation, which creates persistence across all projects and sessions in a privileged agent configuration directory. If the referenced skill or its path is later modified, every future session may automatically execute the hook, expanding the blast radius from one repository to the user's whole environment.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill directs creation of persistent directories under the user's workspace/home area, which establishes session-to-session state and durable storage. Persistence is not inherently malicious, but in this context it amplifies the impact of the logging/privacy issues by ensuring retained data survives beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The promotion guidance repeatedly instructs moving learnings into persistent agent context files such as CLAUDE.md, AGENTS.md, and other workspace memory artifacts. If those learnings originate from conversations, errors, or transcripts, sensitive or project-confidential details can become entrenched in long-term prompt context and resurface unexpectedly in future sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The inter-session features encourage reading other sessions' transcripts and sending learnings across sessions, which increases the chance that sensitive material from one context is disclosed into another without proper need-to-know boundaries. Even if intended for productivity, transcript sharing is a clear cross-context data leakage risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The learning-entry format asks for full context, what was wrong, and detailed corrective information, which naturally encourages copying user-provided content and conversation details into persistent files. Since the same document also recommends promotion into longer-lived memory artifacts, ordinary chat content can become durable and more widely exposed over time.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Storing raw error messages together with input parameters and environment details is a common mechanism for leaking API keys, credentials, internal URLs, customer data, and filesystem structure. In this skill, those details are intended for durable storage, so accidental exposure can persist long after the original failure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases for corrections and feature requests are broad, conversational, and likely to appear in ordinary chat, which can cause the skill to activate and persist content unexpectedly. In a skill that writes durable logs, over-broad activation increases the risk of capturing sensitive user text or internal agent mistakes without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The agent-agnostic guidance uses vague conditions like 'discover something non-obvious' or 'find better approaches,' which leaves activation to subjective interpretation. Because this skill stores information persistently and may promote it into broader memory files, ambiguous activation makes inadvertent data retention more likely.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Instructing users to place command hooks in .claude/settings.json establishes automatic session-persistent behavior that triggers on every prompt or tool use. In the context of a self-improvement skill, that persistence increases risk because it continuously injects script-controlled output into agent context and normalizes always-on execution without strong safety caveats.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document's security section asserts that the scripts 'only output text' and 'don't modify files or run commands,' but the same guide configures them as shell command hooks and separately instructs users to execute another shell script directly. This misleading assurance can cause operators to under-assess the trust boundary and grant execution to hook scripts that run with agent privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The integration instructs operators to create persistent '.learnings/' storage in the workspace or skill directory, enabling retention of model mistakes, tool outputs, and user corrections across sessions. In a self-improvement skill, this creates a real risk of persisting sensitive prompts, credentials, internal paths, or personal data if logging is triggered broadly. The surrounding workflow makes this more dangerous because multiple triggers and promotion paths encourage durable storage of conversational and operational artifacts.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file defines trigger conditions such as "Knowledge gaps," "API errors," and "Model behavior surprise" without clear boundaries or exclusion conditions. These phrases are broad enough to match many normal interactions, making it unclear when the skill should activate or log learnings versus when it should not.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The trigger list includes "User corrections ("No, that's wrong...")" alongside other generic conditions, but does not define whether any correction, repeated corrections, or only substantive corrections should activate the behavior. Without constraints, ordinary conversational feedback could unintentionally trigger the skill.

Content

No source excerpt is available for this finding.