ClawHub
Back to skill

Security audit

Feedback Learning

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed local feedback-learning pipeline, but it automatically turns repeated feedback into persistent active agent rules without approval, retention controls, or clear isolation.

Install only if you explicitly want a persistent shared feedback memory that can influence future agent behavior. Before enabling cron or boot-time loading, review genes.json manually, disable automatic activation or require approval, limit access to the learning directory, avoid logging sensitive user text, and define retention and deletion rules.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Error
Location
scripts/analyze-patterns.py:117
Finding

Untrusted Feedback Is Automatically Promoted into Persistent Active Agent Rules

Content
View full analysis
= PROMOTION_THRESHOLD and p["key"] not in existing_keys: rule = { "id": f"gene_{datetime.now(timezone.utc).strftime('%Y%m%d_%H%M%S')}_{len(promoted)}", "origin": p["key"], "type": p["type"], "agents": p["agents"], "occurrences": p["count"], "promoted_at": datetime.now(timezone.utc).isoformat(), "rule": f"AVOID: {p['key']}", # Will be refined by LLM in cron "expires": None, "active": True, } genes_data["rules"].append(rule) promoted.append(rule) if promoted: genes_data["updated"] = datetime.now(timezone.utc).isoformat() save_json(GENES_FILE, genes_data) return promoted ``` The intended persistence and consumption behavior is documented in `SKILL.md`: ```markdown 1. Events accumulate in `events.jsonl` 2. `analyze-patterns.py` groups similar events by signal text (≥60% similarity) 3. Patterns with ≥3 occurrences in 30 days are promoted to `genes.json` 4. Agents read `genes.json` at boot to apply learned rules 5. `weekly-report.py` synthesizes progress for human review ``` ### Technical Analysis The pipeline treats feedb ...[truncated 2835 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents a broader end-to-end feedback learning system, including logging, pattern mining, rule promotion, and report generation. The supplied code implements only one narrow component: local detection/classification of feedback signals via regex and emoji matching. The detection portion does align with the description, including Russian/English support and zero-LLM operation, but the majority of the declared system capabilities are not present in this code chunk. Therefore the description overstates what this specific code actually does.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/detect-feedback.py (reported line 13)May include surrounding context.

python
#!/usr/bin/env python3
"""
detect-feedback.py — Detect user feedback signals from text.
Returns JSON with type and details. No LLM needed — pure regex/pattern matching.

Usage: echo "переделай это" | python3 detect-feedback.py
       python3 detect-feedback.py "не так, сделай по-другому"
"""
import re
import sys
import json

# === NLP TRIGGERS ===

NEGATIVE_RU = [
    r'\bфигня\b', r'\bпеределай\b', r'\bне\s+так\b', r'\bстоп\b',
    r'\bнеправильно\b', r'\bзаново\b', r'\bне\s+то\b', r'\bотмени\b',
    r'\bверни\b', r'\bоткати\b', r'\bне\s+надо\b', r'\bубери\b',
    r'\bхрень\b', r'\bфиг\w*\b', r'\bбред\b', r'\bчушь\b',
    r'\bне\s+работает\b', r'\bсломал\b', r'\bопять\b',
]

POSITIVE_RU = [
    r'\bкруто\b', r'\bтоп\b', r'\bзашло\b', r'\bкрасава\b',
    r'\bспасибо\b', r'\bогонь\b', r

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill clearly instructs the agent to create directories, copy files, chmod scripts, and append persistent logs, but it declares no explicit tool scope or permissions boundary. That mismatch is dangerous because an agent or reviewer cannot easily tell that the skill requires filesystem write access, increasing the chance of unintended persistence or broader file modification in a shared agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill persistently logs user feedback and then auto-promotes repeated signals into active agent rules without any visible privacy warning, consent model, or human approval gate. This is dangerous because sensitive user text may be retained indefinitely and adversarial or low-quality feedback can be transformed into behavioral rules that alter future agent actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The skill establishes persistent shared storage under ~/.openclaw/shared/learning and instructs agents to append behavioral events over time. In context, this is more dangerous than ordinary persistence because the stored history directly feeds pattern discovery and automatic rule promotion, creating a durable cross-session influence channel that can be poisoned, leak user content, or silently shape agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

bash
DEST="$HOME/.openclaw/shared/learning"
mkdir -p "$DEST/reports"
cp scripts/* "$DEST/"
chmod +x "$DEST/log-event.sh"
touch "$DEST/events.jsonl"

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes the skill as a 'Zero-LLM feedback learning system' that runs entirely on shell scripts and Python. However, the inline comment on the generated rule says it 'Will be refined by LLM in cron', which directly contradicts both the stated zero-LLM intent and the actual behavior of this file, which performs no LLM refinement.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The provided LEARNINGS.md template uses Russian section headings, which imposes a specific language in the generated agent workspace content. Although the skill states support for Russian and English, this template does not offer a language choice or explain why Russian is required here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The docstring presents the skill through Russian-only example inputs, while the implementation also supports English feedback patterns. This creates a natural-language locale bias in the user-facing description without any opt-in or explanation that the skill is intentionally Russian-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script persistently logs user-provided context, signals, and hints into a shared file under the user's home directory without any notice, consent mechanism, retention policy, or minimization. In this skill's feedback-learning context, those fields may contain sensitive user content or operational context, so silent long-term storage creates a privacy and data-handling risk even though there is no direct code execution issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.