T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:21- Finding
Conversation-Derived Content Can Poison Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent (Alex)
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a disclosed self-improvement logger, but it can persist conversation-derived content into future agent memory and instruction files without strong consent, redaction, or review controls.
Install only if you want an agent to keep persistent self-improvement notes. Keep .learnings local and out of git, review every entry before saving, redact secrets and personal data, and do not promote entries into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions without human review. Avoid global hooks or empty matchers unless you are comfortable with reminders on every prompt.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:34- Finding
Installation Instructions Retrieve Mutable Unpinned Code from an External Repository
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/error-detector.sh:8- Finding
Error-Learning Workflow Can Persist Secrets from Command Output
- Content
View full analysis
A command error was detected. Consider logging this to .learnings/ERRORS.md if: - The error was unexpected or non-obvious - It required investigation to resolve - It might recur in similar contexts - The solution could benefit future sessions Use the self-improvement skill format: [ERR-YYYYMMDD-XXX] EOF fi ``` ### Technical Analysis The detector examines complete Bash tool output and encourages logging detected failures. The prescribed error-entry format asks for the actual error output, command parameters, and relevant environment details. No secret-redaction requirements, denylist, data minimization policy, file-permission requirement, or retention limit is provided. Command failures frequently expose authorization headers, access tokens, signed URLs, connection strings, private filesystem paths, customer records, or fragments of environment variables. Copying complete output into a persistent Markdown file converts transient exposure into durable ...[truncated 1297 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about recording and reviewing learnings from failures, corrections, outdated knowledge, and improved approaches. The supplied code does not implement that behavior. Instead, it is a command-line helper that generates a new skill scaffold on disk from a learning entry template. While it references learnings conceptually and mentions updating the original learning entry, its primary function is skill extraction/scaffolding, not capturing continuous-improvement learnings. This is a material purpose mismatch, with undeclared file-creation behavior and unrelated triggers compared to the declared description.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill encourages activation from broad, ordinary situations like failures, corrections, and major tasks, which can cause the agent to invoke logging behavior far more often than intended. In this skill's context, over-activation matters because invocation may lead to persistent recording of user content and operational details, increasing privacy and data-retention risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The skill directs creation of persistent files under a home-directory workspace, establishing session-to-session retention of operational and conversational artifacts. Persistence alone is not always unsafe, but in this context it materially increases the blast radius of the other logging behaviors by making retained data durable and potentially accessible to future sessions, tools, or users on the system.
- Content
└── FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions explicitly support sharing learnings across sessions using transcript-reading and cross-session messaging tools. In a self-improvement skill, that creates a real risk that user-provided content, mistakes, requests, or sensitive context will propagate beyond the originating session, violating least-privilege and data-minimization expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The logging templates call for storing full context, user feedback, parameters, environment details, and related files without any sensitivity filter. That design can persist secrets, personal data, internal paths, credentials, or proprietary prompts into markdown files that may later be indexed, committed, or shared, turning transient input into long-lived exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The automatic detection triggers rely on generic phrases like corrections, feature wishes, and requests for alternatives that commonly appear in normal conversation. Because those triggers instruct the agent to create persistent entries, everyday user speech can be transformed into durable memory without clear consent, making accidental retention likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The automatic triggers instruct the agent to log user corrections, new information, and error situations directly into persistent memory. In practice, this means the skill can capture user-provided content opportunistically and store it long-term without consent gating, which is especially risky because the trigger phrases are broad and common.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description is overly broad and does not define firm activation boundaries, which can cause the skill to trigger in many routine failure, correction, or planning contexts. In a self-improvement skill, that ambiguity is more dangerous because it can encourage persistent collection or reuse of error-related context beyond what is necessary, increasing the chance of unintended behavior or unsafe autonomy.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file defines the hook trigger with an empty matcher, which effectively applies the hook to all UserPromptSubmit events. That is broader than common users may expect and lacks clear constraints or exclusion conditions, increasing the chance of unintended invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide instructs users to add a global hook configuration and again uses an empty matcher for UserPromptSubmit. This combination makes the skill activate across all prompts in all contexts, but the documentation does not clearly bound where it should or should not apply.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This setup mirrors the broad Claude Code configuration and applies the hook to every prompt submitted in Codex. The guide does not provide explicit constraints, exclusions, or a recommended narrow default, so activation remains ambiguous and overly broad.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The setup explicitly creates persistent storage for learnings, which can accumulate sensitive operational data over time. Because this is a self-improvement skill designed to capture failures, corrections, and tool behavior, the persistence mechanism materially increases the risk of retaining confidential content beyond the immediate session.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide instructs users to create persistent learning directories in the workspace or skill directory without warning that conversation-derived data may be stored long-term. In a self-improvement skill, this increases the chance that sensitive prompts, errors, credentials, or user corrections are retained on disk unexpectedly and later exposed to other tools, sessions, or users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document advertises cross-session history access and messaging features without any privacy or authorization warning. In this skill context, learnings may include sensitive operational context, so normalizing transcript access and inter-session sharing can enable unintended disclosure across agent sessions or operators.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The "Detection Triggers" section lists generic conditions like user corrections, API errors, and knowledge gaps without defining thresholds or exclusions. In a markdown skill/integration guide, this can cause unintended or inconsistent invocation because ordinary conversation and routine failures may match these triggers.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Although presented as a lighter-weight setup, the example still triggers on every UserPromptSubmit because the matcher is empty. The documentation does not clarify limits, exclusions, or safer default patterns, so users may unintentionally enable broader activation than intended.
- Content
Static analysis
No suspicious patterns detected.