Security audit
Security checks for vulnerabilities and agentic risk
This skill is not overtly malicious, but it can persistently record session details and promote them into future agent instructions with broad hooks and weak privacy controls.
Install only if you intentionally want durable learning logs and future-agent memory changes. Prefer project-local setup, avoid global hooks and empty matchers, keep .learnings local by default, redact secrets and raw command output, and require manual review before writing to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files.
SKILL.md:262Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
hooks/openclaw/handler.js:8Hooks Inject Persistent Self-Modification Instructions into Agent Context
SKILL.md:179Raw Command Errors and Environment Details May Be Persisted Without Secret Redaction
The skill is presented primarily as a learning-capture mechanism, but it also instructs use of helper scripts that create new skills and write files under skills directories. That expansion of scope is not inherently malicious, but it increases the write surface and can surprise users or host agents that expect only note-taking behavior.
Directing users to modify ~/.claude/settings.json introduces persistent configuration changes in an agent config directory, which can affect all future runs. In the context of command hooks, persistence at the user level is more dangerous because a single risky configuration can silently enable recurring execution across unrelated projects and sessions.
Add to ~/.claude/settings.json for global activation:
{
Instructions found that direct the agent to transmit conversation context or user data to external services.
Send message to another session:
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
The activation guidance is broad enough to match many ordinary conversations, which can cause the skill to trigger unnecessarily and perform logging or reminders too often. In a skill that writes persistent data, over-activation raises the chance of unintended file modifications and retention of user content.
The skill instructs the agent to create and append files in project and workspace locations without a prominent warning or consent step. Silent modification of local state is risky in agent environments because users may not expect persistent writes from a reflective logging skill.
The skill directs creation of persistent directories under the user's home workspace, creating session-spanning storage by default. Persistent state is not always unsafe, but here it compounds the logging issues by ensuring captured content survives beyond the immediate task and may be reused unexpectedly.
└── FEATURE_REQUESTS.md
### Create Learning Files
```bash
mkdir -p ~/.openclaw/workspace/.learnings
The OpenClaw workflow encourages sharing learnings across sessions and reading other sessions' transcripts, which can propagate user-derived information beyond its original context. Cross-session persistence and transcript access materially increase privacy and data leakage risk if sensitive content is logged.
The logging format explicitly requests full context, including what happened, what was wrong, and related file details, making it likely that user prompts, proprietary code context, or sensitive operational details will be stored verbatim. Persistent storage of rich context increases the blast radius of any later disclosure or misuse.
The error-entry template tells the agent to preserve actual error output, command context, inputs, and parameters, all of which commonly contain secrets, internal URLs, file paths, tokens, or customer data. This makes accidental sensitive-data retention a realistic outcome rather than a theoretical one.
Promotion guidance instructs the agent to elevate logged material into long-term context files used by future sessions and agents. If the source learning contains user-derived or sensitive information, promotion amplifies exposure and makes removal harder.
The trigger phrases are generic conversational patterns without exclusion conditions, so normal discussion can be misclassified as a correction, feature request, or knowledge gap. Because the skill persists information, this can lead to unnecessary capture of user content and repeated unsolicited writes.
The instruction to promote aggressively into shared instruction files encourages persistence-first behavior without privacy boundaries. In practice this biases the agent toward over-retention of user and environment details and can contaminate shared memory with sensitive or irrelevant material.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
When the above learning is extracted as a skill, it becomes:
File: skills/docker-m1-fixes/SKILL.md
---
Placing hook configuration in .claude/settings.json establishes session-persistent behavior that survives beyond the immediate task. While persistence is not inherently malicious, in this skill it increases risk because it causes recurring automatic script execution and may continue influencing future sessions after the original need has passed.
Create .claude/settings.json in your project root:
{
Using an empty matcher causes the hook to fire on every prompt, creating a broad and persistent execution surface. In this skill context, that means a shell script runs continuously during normal agent use, increasing the chance of prompt-triggered abuse, unexpected side effects, or leakage of sensitive prompt content to hook logic.
The user-level configuration enables the hook globally in ~/.claude/settings.json without meaningful trigger constraints, so all future sessions may inherit automatic command execution. This expands blast radius from one project to the entire user environment and makes accidental or unsafe activation more likely.
The Codex example repeats the empty matcher pattern, leaving the activation scope effectively unlimited. Because this is a hook executed by an agent toolchain, unconstrained triggering increases unnecessary command execution and broadens exposure across routine interactions.
The document’s security section materially understates what these hooks do. The examples configure shell command hooks, and the same file documents an extraction script that can create scaffolding, so claiming the scripts 'only output text' and 'don’t modify files or run commands' can mislead users into granting trust and enabling code execution with insufficient scrutiny.
Creating a persistent .learnings directory is a form of retained agent memory, which can accumulate sensitive prompts, errors, tool outputs, or corrections over time. In the context of a self-improvement skill, persistence is expected, but without retention limits, review controls, or disclosure it still introduces privacy and prompt-persistence risk.
openclaw hooks enable self-improvement
### 3. Create Learning Files
Create the `.learnings/` directory in your workspace:
The instructions describe writing persistent learning data and promoting it into workspace prompt files without warning that this changes future model behavior and modifies the user's workspace. Silent or under-disclosed persistence is risky because users may not realize they are creating durable prompt state that can outlive the current session and influence subsequent sessions.
The guide instructs promoting learned content from a narrow self-improvement skill into higher-privilege workspace prompt files such as AGENTS.md, SOUL.md, and TOOLS.md. That expands the blast radius from local note-taking to persistent modification of future agent behavior, creating a prompt-injection persistence channel if bad or unreviewed 'learnings' are written there.
The documentation introduces session listing, transcript access, inter-session messaging, and agent spawning even though the skill's purpose is learning capture. Those capabilities can expose unrelated session context and enable lateral movement of untrusted content across sessions, increasing the chance of data leakage or propagation of injected instructions.
The trigger conditions are broad and ambiguous, such as generic tool errors, knowledge gaps, and model behavior surprises. This can cause the skill to activate in many normal situations, increasing unsolicited persistence, accidental logging of sensitive context, and repeated modification of memory files without deliberate operator intent.
No suspicious patterns detected.