学习型Agent

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:03 PM UTC
• Version: 1.0.0

Overview

The skill’s self-improvement purpose is coherent, but it asks agents to persist logs, alter long-term agent context, enable always-on hooks, and read/share session history without enough privacy or approval controls.

Review before installing. Keep it project-scoped, avoid global hooks, do not store raw prompts, secrets, tokens, full command output, or transcripts in .learnings, and require explicit human approval before promoting anything into agent instruction or workspace memory files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:23
• Finding: Conversation-Derived Content Can Poison Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26`, `SKILL.md:262-289`, `SKILL.md:334-360`, `SKILL.md:443-448` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The Skill directs the agent to convert information derived from conversations, user corrections, errors, and tool output into persistent instruction files. Files such as `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md` may be loaded automatically in later sessions and can influence agent behavior. The recurrence rules only measure how often a pattern appears. They do not validate whether its source is trustworthy or whether the content contains embedded instructions. There is no mandatory human approval, provenance enforcement, instruction-content filtering, or restriction preventing security-sensitive behavioral rules from being promoted. An attacker who can repeatedly influence conversations can therefore frame malicious instructions as corrections, best practices, or recurring project conventions. ### Attack Path 1. An attacker submits a plausible but malicious “correction” ...[truncated 1101 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prohibit automatic promotion of raw or lightly transformed conversation content into agent instruction files. 2. Require explicit human review and approval for every promotion. 3. Record immutable provenance for each candidate, including session, author, timestamp, and source message. 4. Reject content containing instructions to weaken security controls, expose data, alter authorization, execute commands, or override higher-priority instructions. 5. Restrict automatic promotion to narrowly scoped, verifiable project facts rather than behavioral or system-level rules. 6. Treat `SOUL.md`, `AGENTS.md`, `TOOLS.md`, `CLAUDE.md`, and Copilot instructions as protected configuration. 7. Generate a reviewable patch instead of directly modifying protected files. 8. Add rollback support and an audit log for all accepted promotions. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: scripts/activator.sh:8
• Finding: Hooks Inject Secondary Instructions into Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `scripts/activator.sh:8-19`, `hooks/openclaw/handler.js:8-45`, `hooks/openclaw/handler.ts:10-60`, `SKILL.md:472-510` **Vulnerability Type**: Agent-context instruction injection and persistent hook installation **Risk Level**: High ### Vulnerable Code ```bash # Output reminder as system context cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. </self-improvement-reminder> EOF ``` ```javascript if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` The documented installation persists the hook: ```bash cp -r hooks/openclaw ~/.openclaw/hooks/self-improvement openclaw hooks enable self-improvement ``` ### Technical Analysis The activator explicitly emits text as “system context,” while the OpenClaw handler adds a virtual bootstrap file before normal workspace context is loaded. The recommended hook configuration runs the activator after every submitted prompt, and the OpenClaw setup installs an enabled hook under the user’s home directory. This mechanism gives the Skill a recurring secondary objective: collect and promote learnings even when that behavior is unrelated to the user’s immediate request. In combination with persistent promotion into agent-control files, injected reminders create a pathway from untrusted conversation content to durable agent instructions. Although installation is documented as opt-in, once enabled the hook survives the individual Skill invocation and affects subsequent pro ...[truncated 935 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace automatic prompt or bootstrap injection with an explicit user-invoked command. 2. Do not label Skill-generated content as system context. 3. Display a clear consent prompt before enabling any persistent hook. 4. Scope hooks to specific projects and narrowly matched events instead of every prompt. 5. Prevent hook output from initiating writes to protected agent instruction files. 6. Provide a documented uninstall command that disables the hook and removes installed files. 7. Show users the exact injected content and allow them to approve or reject changes. 8. Add integrity verification for installed hooks and warn when their contents change. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: hooks/openclaw/handler.js:29
• Finding: Executable JavaScript Hook Omits the Sub-Agent Exclusion Present in TypeScript<![CDATA[ ## Vulnerability Details **File Location**: `hooks/openclaw/handler.ts:43-48`; corresponding check absent from `hooks/openclaw/handler.js:29-45` **Vulnerability Type**: Runtime/source security-control mismatch **Risk Level**: Medium ### Vulnerable Code The TypeScript source contains a sub-agent exclusion: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.sessionKey || ''; if (sessionKey.includes(':subagent:')) { return; } ``` The distributed JavaScript implementation omits that exclusion and proceeds directly to injection: ```javascript // Safety check for context if (!event.context || typeof event.context !== 'object') { return; } // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` ### Technical Analysis The JavaScript runtime artifact and TypeScript source do not implement equivalent security behavior. The TypeScript file recognizes that sub-agent sessions should be excluded, but the JavaScript handler injects instructions into every matching bootstrap event with a valid context. If OpenClaw loads the JavaScript artifact, sub-agents receive the reminder despite the protection represented in source. Reviewers examining only the TypeScript implementation may incorrectly conclude that the exclusion is enforced. ### Attack Path 1. The JavaScript handler is installed and loaded by OpenClaw. 2. A main agent spawns a sub-agent. 3. The sub-agent emits an `agent:bootstrap` event. 4. The JavaScript handler does not inspect `event.sessionKey`. 5. The reminder is injected into the sub-agent’s bootstrap context. 6. The sub-agent may produce or propagate learning content under the injected second ...[truncated 417 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Regenerate `handler.js` from the corrected TypeScript source. 2. Add the same `sessionKey` sub-agent exclusion to every distributed runtime artifact. 3. Maintain only one authoritative source and generate build artifacts during release. 4. Add tests asserting that sub-agent bootstrap events do not receive injected files. 5. Add CI checks that compare JavaScript behavior against TypeScript behavior. 6. Include build provenance or hashes so users can verify that runtime files came from the reviewed source. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:87
• Finding: Learning Workflow Encourages Cross-Session Transcript Access Without Data-Minimization Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:87-92`, `references/openclaw-integration.md:157-186` **Vulnerability Type**: Excessive cross-session access **Risk Level**: Medium ### Vulnerable Code ```markdown OpenClaw provides tools to share learnings across sessions: - **sessions_list** — View active/recent sessions - **sessions_history** — Read another session's transcript - **sessions_send** — Send a learning to another session - **sessions_spawn** — Spawn a sub-agent for background work ``` ```markdown ### sessions_history Read transcript from another session: ``` sessions_history(sessionKey="session-id", limit=50) ``` ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ``` ``` ### Technical Analysis A local learning-capture workflow does not inherently require access to unrelated session transcripts. The documentation encourages enumerating sessions, reading another session’s transcript, and forwarding derived information without requiring consent, ownership verification, purpose limitation, or redaction. Transcripts may contain credentials, personal information, proprietary source code, customer data, or instructions intended only for the originating session. If those contents are copied into `.learnings/` or shared workspace instruction files, their exposure becomes persistent. The Skill does not itself implement or bypass OpenClaw access control. The weakness is that it directs an agent to use broad cross-session capabilities without defining least-privilege safeguards. ### Attack Path 1. An agent with OpenClaw session-tool access lists active or recent sessions. 2. It selects another session and requests up to 50 transcript entries. 3. Sensitive or private content appears in the retrieved transcript. 4. The agent classifies some content as a reusable learning. 5. It stores the content in `.learnings/`, sends it to another session, ...[truncated 642 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove cross-session transcript access from the default learning workflow. 2. Require explicit user authorization before reading any other session. 3. Enforce same-owner and same-project checks where supported. 4. Request only the minimum specific messages required rather than broad transcript ranges. 5. Redact credentials, tokens, personal information, customer data, and proprietary content before storage or forwarding. 6. Never promote transcript content into shared instruction files automatically. 7. Add retention controls and deletion support for copied session information. 8. Log all cross-session reads and sends for user review. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:106
• Finding: Skill Extraction Output Validation Can Be Bypassed Through Symbolic Links<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract-skill.sh:106-132`, `scripts/extract-skill.sh:177-181` **Vulnerability Type**: Filesystem path escape through symbolic links **Risk Level**: Medium ### Vulnerable Code ```bash # Validate output path to avoid writes outside current workspace. if [[ "$SKILLS_DIR" = /* ]]; then log_error "Output directory must be a relative path under the current directory." exit 1 fi if [[ "$SKILLS_DIR" =~ (^|/)\.\.(/|$) ]]; then log_error "Output directory cannot include '..' path segments." exit 1 fi SKILLS_DIR="${SKILLS_DIR#./}" SKILLS_DIR="./$SKILLS_DIR" SKILL_PATH="$SKILLS_DIR/$SKILL_NAME" ``` ```bash # Create skill directory structure log_info "Creating skill: $SKILL_NAME" mkdir -p "$SKILL_PATH" # Create SKILL.md from template cat > "$SKILL_PATH/SKILL.md" << TEMPLATE ``` ### Technical Analysis The validation rejects absolute paths and literal `..` components but only performs lexical checks. It does not canonicalize the output directory or inspect whether any path component is a symbolic link. A relative directory inside the workspace may therefore resolve to a location outside it. The subsequent `mkdir -p` and shell redirection follow symbolic links, allowing writes outside the intended workspace boundary with the permissions of the invoking user. The generated filename is fixed as `SKILL.md`, which limits arbitrary filename selection, but the attacker can choose the external parent and the validated skill-name directory. ### Attack Path 1. An attacker who can modify the current workspace creates a symbolic link such as `skills-link` pointing to a writable external directory. 2. The user runs: ```bash ./scripts/extract-skill.sh injected-skill --output-dir skills-link ``` 3. The argument passes validation because it is relative and contains no `..` component. 4. `mkdir -p` follows the symbolic link and creates `injected-skill` outside the workspace. 5. Shell redirec ...[truncated 403 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Determine a trusted workspace root before processing user input. 2. Canonicalize the output parent with `realpath` or an equivalent mechanism. 3. Verify that the canonical destination remains beneath the trusted workspace root. 4. Reject every symbolic-link component in the destination path. 5. Create directories one component at a time using no-follow semantics where available. 6. Open the output file with exclusive, no-follow creation rather than ordinary shell redirection. 7. Refuse to overwrite an existing file, including a dangling or final-component symbolic link. 8. Add regression tests covering symlinks to external directories and symlinks introduced between validation and creation. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Installation Instructions Use Mutable, Unverified Remote Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-44`, `references/openclaw-integration.md:31-40` **Vulnerability Type**: Unpinned and unverified software installation **Risk Level**: Medium ### Vulnerable Code ```bash clawdhub install self-improving-agent ``` ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` The integration guide repeats the mutable installation methods: ```bash clawdhub install self-improving-agent ``` ```bash cp -r self-improving-agent ~/.openclaw/skills/ ``` ### Technical Analysis The installation instructions do not pin an immutable package version, repository tag, or commit hash. They also do not require verification of a cryptographic checksum or publisher signature. Consequently, the code installed by a user may differ from the audited version. If the registry entry, repository, publisher account, default branch, or release process is compromised, modified hooks and scripts can be delivered after this artifact has been reviewed. No direct remote download-and-execute pipeline is present in the audited scripts themselves. The risk arises from the documented supply-chain installation process. ### Attack Path 1. An attacker compromises the package registry entry, source repository, publisher account, or mutable default branch. 2. The attacker replaces a hook or script with malicious code. 3. A user follows the documented unpinned installation command. 4. The current compromised version is installed under the user’s OpenClaw Skill or hook directory. 5. The user enables the hook. 6. The modified code runs with the same permissions as the agent environment. ### Impact Assessment A compromised installation can obtain all privileges available to the user or agent process, including access to workspace files and any configured command or network capabilities. Persistent hooks may execute the substituted code during later sessions. The audited artifa ...[truncated 167 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin ClawdHub installation to the exact reviewed version. 2. Pin Git installation to an immutable commit hash or signed release tag. 3. Publish SHA-256 or stronger checksums for release archives and require users to verify them. 4. Sign releases and document publisher-key verification. 5. Avoid installing directly from a mutable default branch. 6. Record the expected owner, repository, version, commit, and artifact digest in the documentation. 7. Verify installed hook and script hashes before enabling them. 8. Use a reproducible release process that demonstrates correspondence between TypeScript source and distributed JavaScript. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is described as a learning/error capture aid, but it also instructs creation of workspace files, hook installation, transcript sharing, and skill extraction workflows that materially expand its behavior beyond passive note-taking. That mismatch matters because operators may enable or trust it without realizing it persists data, modifies agent configuration, and scaffolds new artifacts, increasing the attack surface and the chance of unintended writes or memory propagation.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The error logging instructions explicitly request raw error output, command inputs/parameters, and environment details, all of which commonly contain secrets, tokens, file paths, personal data, or proprietary context. Without redaction guidance or privacy constraints, the skill creates a direct pathway for sensitive data to be copied into durable markdown logs.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: The guide recommends installing the hook into ~/.claude/settings.json for global activation, which creates persistence across all projects and sessions in a privileged agent configuration directory. If the referenced skill or its path is later modified, every future session may automatically execute the hook, expanding the blast radius from one repository to the user's whole environment.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 80% confidence
• Finding: The skill directs creation of persistent directories under the user's workspace/home area, which establishes session-to-session state and durable storage. Persistence is not inherently malicious, but in this context it amplifies the impact of the logging/privacy issues by ensuring retained data survives beyond the immediate task.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The promotion guidance repeatedly instructs moving learnings into persistent agent context files such as CLAUDE.md, AGENTS.md, and other workspace memory artifacts. If those learnings originate from conversations, errors, or transcripts, sensitive or project-confidential details can become entrenched in long-term prompt context and resurface unexpectedly in future sessions.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The inter-session features encourage reading other sessions' transcripts and sending learnings across sessions, which increases the chance that sensitive material from one context is disclosed into another without proper need-to-know boundaries. Even if intended for productivity, transcript sharing is a clear cross-context data leakage risk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The learning-entry format asks for full context, what was wrong, and detailed corrective information, which naturally encourages copying user-provided content and conversation details into persistent files. Since the same document also recommends promotion into longer-lived memory artifacts, ordinary chat content can become durable and more widely exposed over time.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Storing raw error messages together with input parameters and environment details is a common mechanism for leaking API keys, credentials, internal URLs, customer data, and filesystem structure. In this skill, those details are intended for durable storage, so accidental exposure can persist long after the original failure.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases for corrections and feature requests are broad, conversational, and likely to appear in ordinary chat, which can cause the skill to activate and persist content unexpectedly. In a skill that writes durable logs, over-broad activation increases the risk of capturing sensitive user text or internal agent mistakes without clear user intent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The agent-agnostic guidance uses vague conditions like 'discover something non-obvious' or 'find better approaches,' which leaves activation to subjective interpretation. Because this skill stores information persistently and may promote it into broader memory files, ambiguous activation makes inadvertent data retention more likely.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 84% confidence
• Finding: Instructing users to place command hooks in .claude/settings.json establishes automatic session-persistent behavior that triggers on every prompt or tool use. In the context of a self-improvement skill, that persistence increases risk because it continuously injects script-controlled output into agent context and normalizes always-on execution without strong safety caveats.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document's security section asserts that the scripts 'only output text' and 'don't modify files or run commands,' but the same guide configures them as shell command hooks and separately instructs users to execute another shell script directly. This misleading assurance can cause operators to under-assess the trust boundary and grant execution to hook scripts that run with agent privileges.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 91% confidence
• Finding: The integration instructs operators to create persistent '.learnings/' storage in the workspace or skill directory, enabling retention of model mistakes, tool outputs, and user corrections across sessions. In a self-improvement skill, this creates a real risk of persisting sensitive prompts, credentials, internal paths, or personal data if logging is triggered broadly. The surrounding workflow makes this more dangerous because multiple triggers and promotion paths encourage durable storage of conversational and operational artifacts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: This markdown file defines trigger conditions such as "Knowledge gaps," "API errors," and "Model behavior surprise" without clear boundaries or exclusion conditions. These phrases are broad enough to match many normal interactions, making it unclear when the skill should activate or log learnings versus when it should not.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The trigger list includes "User corrections (\"No, that's wrong...\")" alongside other generic conditions, but does not define whether any correction, repeated corrections, or only substantive corrections should activate the behavior. Without constraints, ordinary conversational feedback could unintentionally trigger the skill.

Static analysis

No suspicious patterns detected.