Security audit

Self Improvement Tianjin

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed learning logger, but it gives agents broad ways to persist conversation-derived guidance, enable always-on hooks, and share/read session context without enough safeguards.

Review this skill before installing. Use project-scoped storage, avoid global hooks unless you understand the impact, do not log secrets or raw transcripts, and require explicit human review before anything is promoted into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instruction files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:346
Finding: Conversation-Derived Content Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26`, `SKILL.md:346-365`, and `SKILL.md:443-444` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` ```markdown Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The Skill instructs the agent to capture corrections, user feedback, errors, and conversation-derived knowledge in local learning files. It subsequently recommends promoting selected entries into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, and `.github/copilot-instructions.md`. These destination files may be loaded as persistent instructions in future sessions. The stated promotion conditions measure recurrence and breadth, but do not establish that the source is trusted or verify that the promoted content is free from embedded agent directives. Repetition is not a trust signal: an attacker can deliberately repeat the same false correction or behavioral instruction until it meets the recurrence threshold. The instruction to “promote aggressively” further weakens the review boundary by encouraging promotion ...[truncated 1677 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit approval from a trusted human before writing anything to persistent instruction files. 2. Treat conversation text and learning entries as untrusted data, even when repeated. 3. Never copy raw learning text directly into `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instruction files. 4. Validate promotions against a strict schema containing only factual, narrowly scoped fields. 5. Reject content containing meta-instructions, role changes, safety overrides, secret-access requests, tool-use directives unrelated to the project, or instructions to suppress reporting. 6. Preserve provenance for every promoted rule, including source session, author, approval identity, and review date. 7. Replace “promote aggressively” with a conservative rule requiring clear evidence, necessity, and trusted review. 8. Implement expiration and rollback mechanisms for promoted rules. 9. Separate factual project memory from executable agent instructions so recorded observations do not automatically become behavioral directives. ]]>

T01 · Skill Instruction Hijacking

Note

Location: scripts/activator.sh:8
Finding: Opt-In Hooks Inject Skill-Controlled Instructions into Agent Context<![CDATA[ ## Vulnerability Details **File Location**: `scripts/activator.sh:8-19`, `hooks/openclaw/handler.js:8-25,45-51`, and `hooks/openclaw/handler.ts:9-26,51-57` **Vulnerability Type**: Agent context instruction injection **Risk Level**: Low ### Vulnerable Code Snippet ```bash # Output reminder as system context cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. </self-improvement-reminder> EOF ``` ```javascript const REMINDER_CONTENT = ` ## Self-Improvement Reminder After completing tasks, evaluate if any learnings should be captured: **Log when:** - User corrects you → \`.learnings/LEARNINGS.md\` - Command/operation fails → \`.learnings/ERRORS.md\` - User wants missing capability → \`.learnings/FEATURE_REQUESTS.md\` - You discover your knowledge was wrong → \`.learnings/LEARNINGS.md\` - You find a better approach → \`.learnings/LEARNINGS.md\` **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` Keep entries simple: date, title, what happened, what to do differently. `.trim(); ``` ```javascript if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` ### Technical Analysis When explicitly enabled, the Claude/Codex hook emits instruction-like text after every submitted prompt, while the OpenClaw hook inserts a virtual bootstrap file into the agent context. The injected content is fixed, visible in the source, and does not explicitly request bypassing safety con ...[truncated 1743 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a user-interface notification or audit event instead of inserting instruction text into model context. 2. Scope activation to an explicit user command or narrowly defined task matcher rather than every prompt. 3. Require per-session or per-entry confirmation before creating a learning. 4. Do not recommend promotion to persistent instruction files from automatically injected hook content. 5. Label hook output as untrusted advisory material that cannot override the current task, user intent, or security policy. 6. Keep JavaScript and TypeScript handlers behaviorally equivalent, including the sub-agent exclusion. 7. Pin the installed hook to a reviewed version and verify its integrity before execution. 8. Provide a clear mechanism to inspect, suspend, and remove the hook. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

Location: references/openclaw-integration.md:159
Finding: Cross-Session Transcript Access Is Recommended Without Consent or Data-Minimization Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:87-92` and `references/openclaw-integration.md:159-187` **Vulnerability Type**: Excessive cross-session data access **Risk Level**: Low ### Vulnerable Code Snippet ```markdown OpenClaw provides tools to share learnings across sessions: - **sessions_list** — View active/recent sessions - **sessions_history** — Read another session's transcript - **sessions_send** — Send a learning to another session - **sessions_spawn** — Spawn a sub-agent for background work ``` ```markdown ## Inter-Agent Communication OpenClaw provides tools for cross-session communication: ### sessions_list View active and recent sessions: ``` sessions_list(activeMinutes=30, messageLimit=3) ``` ### sessions_history Read transcript from another session: ``` sessions_history(sessionKey="session-id", limit=50) ``` ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ``` ### sessions_spawn Spawn a background sub-agent: ``` sessions_spawn(task="Research X and report back", label="research") ``` ``` ### Technical Analysis The Skill’s principal functionality—recording learnings from the current task—does not inherently require reading unrelated session transcripts. However, its integration documentation recommends enumerating sessions, reading up to 50 transcript entries, and sending information between sessions. The guidance does not require explicit authorization from the owner of the source session, define an allowlist, limit collection to a particular learning, require redaction, or prohibit copying sensitive transcript content into persistent or shared learning files. This violates least-privilege and data-minimization principles when sessions have different users, purposes, or confidentiality expectations. No code in the reviewed package automatically invokes these tools, and no external exfiltration mechanism was identifie ...[truncated 1393 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove cross-session transcript reading from the default learning workflow. 2. Require explicit user authorization identifying the exact source session and purpose before calling `sessions_history`. 3. Enforce session allowlists and verify that the requesting user is authorized to access the selected session. 4. Request only the minimum number of messages and fields needed for the approved purpose. 5. Redact credentials, tokens, personal data, internal URLs, and unrelated user content before storing or forwarding information. 6. Prohibit copying raw transcript content into `.learnings/` or persistent instruction files. 7. Record an audit trail for each cross-session read or send operation. 8. Apply retention limits and access controls to learning files that contain cross-session information. 9. Prefer user-provided summaries over direct transcript access. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description says this skill is for capturing and reviewing learnings, errors, corrections, outdated knowledge, and recurring improvements. However, the actual code does not implement learning capture, error analysis, correction logging, or review behavior. Its primary function is to scaffold a new skill from a learning entry by creating directories and a templated SKILL.md file. This is a materially different purpose and includes undeclared file-creation behavior. The path validation and dry-run logic are supporting details, but the core behavior is still skill extraction/scaffolding rather than continuous-improvement knowledge capture.

Agent Config Directory Access

High

Category: Agent Snooping
Content: ### Option 2: User-Level Configuration Add to `~/.claude/settings.json` for global activation: ```json {
Confidence: 90% confidence
Finding: Directing users to install hooks in ~/.claude/settings.json places executable configuration in the agent's user-level config directory, creating broad and durable influence over future sessions. In this context, the risk is elevated because the skill specifically promotes automatic triggering and persistence across tasks, which can magnify any script compromise or misconfiguration.

Exfiltration Commands

High

Category: Prompt Injection
Content: ### sessions_send Send message to another session: ``` sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header") ```
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation guidance is broad enough that the skill may be invoked on many ordinary interactions, causing unnecessary logging, persistent storage, and propagation of context. In a system that writes to persistent memory or agent instruction files, over-invocation increases the chance of retaining sensitive or irrelevant data and can distort future agent behavior.

Session Persistence

Medium

Category: Rogue Agent
Content: └── FEATURE_REQUESTS.md ``` ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Confidence: 80% confidence
Finding: The skill is designed to create and use persistent storage in a user workspace for future sessions, which introduces retention risk even if the behavior is intentional. Persistent logs can accumulate sensitive operational history and become accessible to later tools, agents, or users without clear lifecycle controls.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill explicitly encourages sharing learnings across sessions and reading other session transcripts without defining data minimization, redaction, or permission boundaries. That creates a realistic risk of cross-session disclosure of secrets, personal data, or sensitive project context beyond the original need-to-know scope.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The logging format directs retention of full error messages, inputs, parameters, and environment details, which commonly contain API keys, tokens, internal paths, personal data, or proprietary prompts. Persisting this by default materially increases the blast radius of any accidental disclosure or later reuse by another agent/session.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are common conversational language and lack context checks, so routine dialogue may be misclassified as a correction, feature request, or knowledge gap. This can cause inadvertent capture of user statements into durable logs and memory files, especially when combined with auto-logging workflows.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The instruction to 'promote aggressively' into persistent context files increases the likelihood that sensitive, user-derived, or one-off incident data becomes long-lived agent guidance. Once promoted, such data may resurface in unrelated future sessions, expanding retention and disclosure risk.

Skill Enumeration

Medium

Category: Agent Snooping
Content: When the above learning is extracted as a skill, it becomes: **File**: `skills/docker-m1-fixes/SKILL.md` ```markdown ---
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Option 1: Project-Level Configuration Create `.claude/settings.json` in your project root: ```json {
Confidence: 84% confidence
Finding: Creating .claude/settings.json in the project root introduces persistent hook behavior that survives across sessions and can affect anyone using that workspace. In a self-improvement skill, persistence is part of the design, which makes the issue more contextually significant because automated reminders and command hooks may remain enabled longer than intended.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The setup instructions tell users to configure command hooks but do not prominently warn that every matching event will execute local shell commands under the agent's permissions. That omission increases the likelihood of unsafe deployment because users may interpret the feature as a passive reminder mechanism rather than active command execution.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: An empty matcher causes the UserPromptSubmit hook to fire on every prompt, increasing exposure, noise, and the chance that unreviewed local scripts run continuously throughout a session. In this skill context, that broad triggering is more dangerous because the feature is designed for persistent self-improvement capture and can normalize always-on command execution.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The guide recommends user-level global activation in ~/.claude/settings.json without meaningful trigger constraints, which expands execution from a single project to all sessions. If the referenced scripts are modified, replaced, or behave unexpectedly, the effect becomes persistent and cross-project rather than isolated.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document states that the scripts 'only output text' and 'don't modify files or run commands', but the same file configures them as command hooks and also documents executing an extract script directly. This mismatch can mislead users into granting trust or enabling hooks without understanding that local shell commands will run in response to events.

Session Persistence

Medium

Category: Rogue Agent
Content: openclaw hooks enable self-improvement ``` ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 86% confidence
Finding: The guide instructs users to create persistent `.learnings/` storage in the workspace or skill directory, which can retain model-derived content across sessions without any retention, sensitivity, or review controls. Because this skill is specifically designed to capture errors, corrections, and environment details, the persisted data may accumulate secrets, sensitive prompts, project internals, or misleading injected content that later sessions re-consume.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The 'Detection Triggers' section uses vague conditions like 'Knowledge gaps', 'API errors', and user corrections such as 'No, that's wrong...' without clearly defining scope, thresholds, or exclusion cases. In a markdown integration guide, these broad natural-language and operational cues could overlap with many normal interactions and make it unclear when the skill should activate versus remain idle.

Vague Triggers

Low

Confidence: 88% confidence
Finding: This markdown template instructs authors to 'Include trigger conditions' but does not require specific trigger phrases, scope limits, or negative examples. Because this file is a reusable template, the vague guidance can propagate ambiguous activation language into generated skill manifests.

Vague Triggers

Low

Confidence: 91% confidence
Finding: The example description 'What this skill does and when to use it.' provides no specificity about activation boundaries or concrete trigger phrases. In a template, this can encourage authors to write overly broad descriptions that overlap with common requests.

Static analysis

No suspicious patterns detected.