Self Improvement Tianjin

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:26 AM UTC
• Version: 1.0.1

Overview

This is a disclosed learning logger, but it gives agents broad ways to persist conversation-derived guidance, enable always-on hooks, and share/read session context without enough safeguards.

Review this skill before installing. Use project-scoped storage, avoid global hooks unless you understand the impact, do not log secrets or raw transcripts, and require explicit human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:346

Finding

Conversation-Derived Content Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The Skill instructs the agent to capture corrections, user feedback, errors, and conversation-derived knowledge in local learning files. It subsequently recommends promoting selected entries into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, and `.github/copilot-instructions.md`. These destination files may be loaded as persistent instructions in future sessions. The stated promotion conditions measure recurrence and breadth, but do not establish that the source is trusted or verify that the promoted content is free from embedded agent directives. Repetition is not a trust signal: an attacker can deliberately repeat the same false correction or behavioral instruction until it meets the recurrence threshold. The instruction to “promote aggressively” further weakens the review boundary by encouraging promotion ...[truncated 1677 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Note

• Location: scripts/activator.sh:8

Finding

Opt-In Hooks Inject Skill-Controlled Instructions into Agent Context

Content

View full analysis

After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. EOF ``` ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); ``` ```javascript if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` ### Technical Analysis When explicitly enabled, the Claude/Codex hook emits instruction-like text after every submitted prompt, while the OpenClaw hook inserts a virtual bootstrap file into the agent context. The injected content is fixed, visible in the source, and does not explicitly request bypassing safety con ...[truncated 1743 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: references/openclaw-integration.md:159

Finding

Cross-Session Transcript Access Is Recommended Without Consent or Data-Minimization Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description says this skill is for capturing and reviewing learnings, errors, corrections, outdated knowledge, and recurring improvements. However, the actual code does not implement learning capture, error analysis, correction logging, or review behavior. Its primary function is to scaffold a new skill from a learning entry by creating directories and a templated SKILL.md file. This is a materially different purpose and includes undeclared file-creation behavior. The path validation and dry-run logic are supporting details, but the core behavior is still skill extraction/scaffolding rather than continuous-improvement knowledge capture.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Directing users to install hooks in ~/.claude/settings.json places executable configuration in the agent's user-level config directory, creating broad and durable influence over future sessions. In this context, the risk is elevated because the skill specifically promotes automatic triggering and persistence across tasks, which can magnify any script compromise or misconfiguration.

Content

Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.

Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json

{

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.

sessions_send

Send message to another session:

text

sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance is broad enough that the skill may be invoked on many ordinary interactions, causing unnecessary logging, persistent storage, and propagation of context. In a system that writes to persistent memory or agent instruction files, over-invocation increases the chance of retaining sensitive or irrelevant data and can distort future agent behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill is designed to create and use persistent storage in a user workspace for future sessions, which introduces retention risk even if the behavior is intentional. Persistent logs can accumulate sensitive operational history and become accessible to later tools, agents, or users without clear lifecycle controls.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

└── FEATURE_REQUESTS.md

text

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly encourages sharing learnings across sessions and reading other session transcripts without defining data minimization, redaction, or permission boundaries. That creates a realistic risk of cross-session disclosure of secrets, personal data, or sensitive project context beyond the original need-to-know scope.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The logging format directs retention of full error messages, inputs, parameters, and environment details, which commonly contain API keys, tokens, internal paths, personal data, or proprietary prompts. Persisting this by default materially increases the blast radius of any accidental disclosure or later reuse by another agent/session.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are common conversational language and lack context checks, so routine dialogue may be misclassified as a correction, feature request, or knowledge gap. This can cause inadvertent capture of user statements into durable logs and memory files, especially when combined with auto-logging workflows.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to 'promote aggressively' into persistent context files increases the likelihood that sensitive, user-derived, or one-off incident data becomes long-lived agent guidance. Once promoted, such data may resurface in unrelated future sessions, expanding retention and disclosure risk.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.

When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Creating .claude/settings.json in the project root introduces persistent hook behavior that survives across sessions and can affect anyone using that workspace. In a self-improvement skill, persistence is part of the design, which makes the issue more contextually significant because automated reminders and command hooks may remain enabled longer than intended.

Content

Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.

Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json

{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup instructions tell users to configure command hooks but do not prominently warn that every matching event will execute local shell commands under the agent's permissions. That omission increases the likelihood of unsafe deployment because users may interpret the feature as a passive reminder mechanism rather than active command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

An empty matcher causes the UserPromptSubmit hook to fire on every prompt, increasing exposure, noise, and the chance that unreviewed local scripts run continuously throughout a session. In this skill context, that broad triggering is more dangerous because the feature is designed for persistent self-improvement capture and can normalize always-on command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide recommends user-level global activation in ~/.claude/settings.json without meaningful trigger constraints, which expands execution from a single project to all sessions. If the referenced scripts are modified, replaced, or behave unexpectedly, the effect becomes persistent and cross-project rather than isolated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document states that the scripts 'only output text' and 'don't modify files or run commands', but the same file configures them as command hooks and also documents executing an extract script directly. This mismatch can mislead users into granting trust or enabling hooks without understanding that local shell commands will run in response to events.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The guide instructs users to create persistent .learnings/ storage in the workspace or skill directory, which can retain model-derived content across sessions without any retention, sensitivity, or review controls. Because this skill is specifically designed to capture errors, corrections, and environment details, the persisted data may accumulate secrets, sensitive prompts, project internals, or misleading injected content that later sessions re-consume.

Content

Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.

openclaw hooks enable self-improvement

text

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'Detection Triggers' section uses vague conditions like 'Knowledge gaps', 'API errors', and user corrections such as 'No, that's wrong...' without clearly defining scope, thresholds, or exclusion cases. In a markdown integration guide, these broad natural-language and operational cues could overlap with many normal interactions and make it unclear when the skill should activate versus remain idle.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown template instructs authors to 'Include trigger conditions' but does not require specific trigger phrases, scope limits, or negative examples. Because this file is a reusable template, the vague guidance can propagate ambiguous activation language into generated skill manifests.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example description 'What this skill does and when to use it.' provides no specificity about activation boundaries or concrete trigger phrases. In a template, this can encourage authors to write overly broad descriptions that overlap with common requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.