OpenClaw Learning Loop

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:31 AM UTC
• Version: 1.0.2

Overview

The skill has a legitimate self-improvement purpose, but it encourages broad automatic logging and promotion into persistent agent instructions without clear per-change approval.

Install only if you want durable agent memory. Keep hooks project-scoped, avoid global hooks unless you fully trust the skill, and require explicit approval with an exact diff before anything is written to AGENTS.md, CLAUDE.md, SOUL.md, TOOLS.md, or Copilot instructions. Log sanitized summaries only, and be cautious with the error detector because command output may contain sensitive data.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:367

Finding

Untrusted Learnings Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` The skill also identifies conversation and user feedback as learning sources and encourages promotion into persistent context files: ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ### Technical Analysis The learning workflow accepts information originating from conversations, user feedback, command errors, and task summaries. It then permits recurring entries to be distilled into rules written to files such as `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `CLAUDE.md`. These files may be automatically injected into future agent sessions. Consequently, promoting a learning changes the agent's persistent instruction environment rather than merely storing inert notes. The documented promotion criteria are based on recurrence, task count, and time window. They do not require: - Verification that the source is trusted. - Security review of imperative instructions. - Detection of prompt-injection content. - Explicit user authorization for each promotion. - Separation of factual observations from behavioral ...[truncated 1769 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:107

Finding

Symlink Bypass Allows Skill Extraction Outside the Intended Workspace

Content

View full analysis

"$SKILL_PATH/SKILL.md" << TEMPLATE --- name: $SKILL_NAME description: "[TODO: Add a concise description of what this skill does and when to use it]" --- ``` ### Technical Analysis The validation rejects absolute paths and explicit `..` path components, but it does not inspect or resolve symbolic links in the output path. A path can therefore be lexically relative to the current directory while resolving to a location outside it. For example, if `./skills` is a symbolic link to `/tmp/external-skills`, then `./skills/example/SKILL.md` passes both validation checks but resolves outside the current workspace. The comment claims that the validation prevents writes outside the workspace, but that guarantee is not enforced against symlinked path components. The final redirection follows symbolic links u ...[truncated 2044 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about collecting learnings such as failures, user corrections, missing capabilities, and tool issues so the agent improves over time. The supplied code does not implement learning capture or logging behavior. Instead, it is a helper script for extracting/promoting a learning into a new skill by creating a directory and templated SKILL.md file. This is a materially different primary purpose and includes undeclared write capabilities to the filesystem. While the comments mention creating a skill from a learning entry, the script itself only scaffolds the skill structure and suggests manual follow-up steps; it does not capture the underlying learnings described in the declaration.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Instructing users to modify ~/.claude/settings.json establishes persistence in a sensitive agent configuration directory, affecting future sessions globally. Even though this document presents it as a convenience feature, persistent execution hooks in a global config are security-relevant because they can silently shape agent behavior across unrelated repos and contexts.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 181)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 72% confidence

Finding

The skill directs creation of persistent files under the user's home workspace (~/.openclaw/workspace/.learnings), enabling cross-session retention of operational history and user interactions. Even though the text warns against logging secrets and recommends sanitization, persistent storage of session-derived content increases privacy and data-retention risk, especially when later promoted to AGENTS.md, SOUL.md, TOOLS.md, or shared across sessions.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The auto-logging trigger phrases are broad enough to match ordinary user conversation, which can cause the agent to persist content the user did not intend to store. In this skill, that risk is amplified because the destination is durable workspace memory files, so benign chat content, corrections, or sensitive context may be written to disk and later propagated into broader agent guidance.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The project-level .claude/settings.json example creates persistent session behavior by automatically re-injecting hooks at session start. In context this is intentional and not overtly malicious, but persistence still matters because it can repeatedly influence prompts and tool workflows without per-session re-consent, especially in shared or long-lived repositories.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The matcher is set to an empty string for UserPromptSubmit, which effectively makes the hook run on any prompt. This is an ambiguous and overly broad activation condition that can cause unintended invocation on ordinary conversation rather than a clearly scoped trigger.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide recommends placing a broadly-triggered hook in the user-level agent config, causing automatic activation across all projects and sessions. That expands the trust boundary substantially: any mistake in the referenced script, future script changes, or unintended handling of sensitive prompts can affect every workspace rather than one project.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Codex CLI setup repeats the same empty-string matcher for UserPromptSubmit, which provides no specificity about when the skill should activate. In a markdown setup guide, this is a vague trigger because it overlaps with everyday prompting and lacks constraints or exclusions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file defines detection triggers, and 'Knowledge gaps' is an ambiguous condition without boundaries or examples. It does not specify what counts as a qualifying gap or when the trigger should not fire, which risks overly broad or inconsistent invocation of the learning workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.