Self Improvement Tianjin

AdvisoryAudited by Static analysis on Mar 16, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Future sessions may act on stored learnings or promoted instructions, even if an entry was wrong or contained sensitive details.

Why it was flagged

The skill intentionally stores learnings in files that may become future agent context. This is central to the purpose, but persistent context can carry mistaken, sensitive, or over-broad instructions forward.

Skill content
OpenClaw injects these files into every session: ... AGENTS.md ... SOUL.md ... TOOLS.md ... MEMORY.md ... .learnings/
Recommendation

Review `.learnings/` and promoted files before relying on them; avoid storing secrets, credentials, or unverified instructions.

What this means

If the hook is enabled, sessions will automatically receive self-improvement reminders.

Why it was flagged

The optional hook injects a reminder into agent bootstrap context when enabled. It is disclosed and limited to a reminder, but it is persistent session-start behavior.

Skill content
event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true })
Recommendation

Enable the hook only if you want this recurring behavior, and disable or remove it if it becomes intrusive.

What this means

If used, learnings or transcript content could move between sessions or into sub-agent tasks.

Why it was flagged

The documentation describes cross-session transcript access, messaging, and sub-agent spawning. These are presented as platform capabilities rather than automatic behavior.

Skill content
sessions_history ... Read transcript from another session ... sessions_send ... Send message to another session ... sessions_spawn ... Spawn a background sub-agent
Recommendation

Use inter-session tools only with intended sessions and avoid sending sensitive conversation content unless you explicitly want it shared.

What this means

Following the manual install path could install code from outside the reviewed registry artifact.

Why it was flagged

The manual installation instructions point to an external repository. This is user-directed and not automatically executed, but users should verify the repository before installing from it.

Skill content
git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent
Recommendation

Prefer the trusted registry source you intended to install from, or inspect the external repository before cloning and enabling hooks.