自我改进智能体

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:42 PM UTC
• Version: 0.1.0

Overview

This skill is openly about persistent self-improvement logging, but it also encourages broad cross-session memory, transcript access, and promotion into future agent instructions without enough consent, redaction, or review controls.

Review this carefully before installing. Use it only where persistent learning logs are acceptable, avoid storing secrets or full transcripts, require human review before writing to agent instruction files, and do not enable hooks or inter-session transcript sharing unless you have verified the referenced scripts and want that behavior.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:245
• Finding: Persistent instruction poisoning through promotion of conversation-derived learnings## Vulnerability Details **File Location**: `SKILL.md:245-270`; related guidance at `SKILL.md:8`, `SKILL.md:21-24`, `SKILL.md:44-51`, and `SKILL.md:392` **Vulnerability Type**: Persistent agent memory and instruction poisoning **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` The associated best-practice guidance further states: ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The skill captures information originating from conversations, including user corrections, errors, and suggested behavioral patterns. It then instructs the agent to promote selected entries into persistent files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS. ...[truncated 2260 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit approval from a trusted human maintainer before promoting any learning into an automatically loaded instruction file. 2. Treat user messages, external API output, tool output, and other session-derived text as untrusted data. 3. Store provenance for every entry, including source session, author, timestamp, related task, and approving reviewer. 4. Replace free-form promotion with a restrictive structured schema that permits project facts but rejects executable commands and behavioral overrides. 5. Prohibit promotion of content that requests secret access, network transmission, tool invocation, permission changes, safety-policy changes, or suppression of future warnings. 6. Remove the “promote aggressively” instruction and require demonstrated recurrence, verification, and security review. 7. Separate passive knowledge records from authoritative agent instructions. Learning logs should not automatically become prompt-injected policy. 8. Display and review the exact proposed diff before modifying `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instructions. 9. Add integrity monitoring, version control, audit logs, and a documented rollback process for persistent instruction files. 10. Limit cross-session scope so project-specific or user-specific observations cannot silently affect unrelated sessions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Unpinned third-party installation can introduce unreviewed skill code and hooks## Vulnerability Details **File Location**: `SKILL.md:32-39` **Vulnerability Type**: Unsafe and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` ``` ### Technical Analysis Both documented installation methods retrieve third-party content without pinning an immutable version or commit. The instructions also provide no checksum, package signature, expected file manifest, or reproducible verification procedure. The audited artifact contains only `SKILL.md`. Referenced components such as hook scripts are not present and therefore could not be reviewed as part of this audit. Installing the mutable external package may add executable scripts and hook configuration whose behavior differs from the reviewed artifact. The `git clone` command retrieves the current default branch, while the package-manager command does not specify a version. A compromised account, repository, registry entry, distribution service, or future upstream revision could therefore change the effective installed payload after this audit. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, package publication channel, or distribution infrastructure. 2. The attacker publishes a modified package or changes the repository's default branch to include malicious instructions or hook scripts. 3. A user follows the documented unpinned `clawdhub install` or `git clone` command. 4. The mutable, unreviewed revision is placed in the user's OpenClaw skills directory. 5. The user subsequently enables or invokes the installed skill and its referenced hooks. 6. Malicious upstream content executes with the permissions of the agent or user process, subject to ...[truncated 918 chars]
• Remediation: ## Remediation Suggestions 1. Pin installation instructions to a reviewed, immutable release version or full Git commit hash. 2. Publish and verify cryptographic checksums or signed release attestations before installation. 3. Vendor all required scripts into the audited skill package so the reviewed artifact is self-contained. 4. Document the expected installed file manifest and fail verification if unexpected files are present. 5. Review hook scripts and configuration separately before enabling them. 6. Avoid automatically enabling hooks as part of installation; require a distinct, informed activation step. 7. Use a trusted package registry with namespace ownership controls, signed provenance, and dependency-locking support. 8. Periodically review pinned dependencies and update them only through an explicit security-reviewed process. 9. Run third-party hook scripts with least privilege, restricted filesystem access, minimal environment variables, and network isolation where feasible. 10. Clearly distinguish the locally audited documentation from external components that have not been included in the audit scope.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The description advertises continuous improvement but does not disclose that user corrections, failures, and related context may be written to persistent files. This omission undermines informed consent and makes it more likely that sensitive interaction data will be stored without the user's awareness.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 82% confidence
• Finding: The skill establishes persistent storage under a workspace directory for accumulating learnings across sessions. Persistence itself is not always unsafe, but here it materially increases retention and later exposure risk because the stored content includes errors, corrections, and user-derived context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly encourages reading other sessions' transcripts and sending learnings across sessions, which expands its scope from local self-improvement logging into cross-session data access and transmission. Because transcripts can contain secrets, proprietary code, or sensitive user content, this creates a real data-exposure pathway that is not necessary for the stated purpose.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Cross-session sharing and transcript access are direct data-leakage risks because they encourage movement of natural-language session content between contexts. Even if intended for benign collaboration, these mechanisms can expose confidential prompts, outputs, credentials, and user-specific details far beyond the original session.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The learning and feature-request templates direct retention of full context, user context, and conversation-derived details, which can capture private information unrelated to the technical lesson. Because these entries are persistent and may later be promoted or reused, the privacy impact compounds over time.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The error template instructs the agent to store actual error messages, outputs, inputs, parameters, and environment details, all of which commonly contain secrets or sensitive operational metadata. Persisting raw logs in markdown creates a durable and easily searchable repository of sensitive information.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation guidance is overly expansive, telling the agent to apply the skill in many loosely defined situations such as discovering something non-obvious or finding a better approach. In practice this can lead to over-collection, persistent storage, and accidental retention of sensitive user data under vague criteria.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad enough to match ordinary conversation, which can cause the skill to activate and persist information in situations where the user did not intend durable logging. That raises privacy and consent risks because routine chat content may be captured as a 'learning' without a clear boundary.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill adds an agent-development workflow for extracting new reusable skills from accumulated learnings, which materially broadens behavior beyond simple logging. While not directly a data-exfiltration primitive, it increases agent autonomy and persistence, making it easier for unsafe patterns or sensitive content to be codified and reused without sufficient review.

Static analysis

No suspicious patterns detected.