Claw Self Improving Plus

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:19 PM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent, but it can write durable agent behavior and memory files using an approval flag stored in the same editable patch file.

Review every generated patch before applying it, only run `apply_approved_patches.py` on patch files you control, prefer `--dry-run` first, and avoid promoting untrusted user or web content into `SOUL.md`, `AGENTS.md`, `TOOLS.md`, or `MEMORY.md` without manual verification.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: scripts/apply_approved_patches.py:30

Finding

Untrusted Patch Approval Allows Persistent Agent Memory and Instruction Poisoning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about capturing lessons from mistakes, deduplicating learnings, drafting promotion candidates for files like SOUL.md/AGENTS.md/TOOLS.md/MEMORY.md, and enforcing human approval before persistent edits. The supplied code does none of that. Instead, it processes backlog data by joining timestamps from another file, computing age in days, assigning stale-status labels, decrementing priority scores for stale items, and emitting a reordered JSON backlog. This is a materially different primary purpose, with capabilities unrelated to self-improvement learning capture or candidate patch generation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a higher-level learning-management and approval system for capturing lessons and proposing controlled memory updates. The supplied code does none of that. It only takes an input file path and archives the file by copying or moving it into an archive directory with a timestamped name. This is a materially different primary purpose, not merely a supporting utility as presented, because the code chunk itself implements only file archival and none of the declared learning, deduplication, scoring, patch drafting, or approval behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code partially matches the description: it does process raw learning-like records and score reuse value, confidence, scope, promotion worthiness, and target candidates. However, the declared description presents a broader end-to-end conservative self-improvement workflow with deduplication, patch drafting for specific long-term memory files, and an approval step before edits. This script does none of those workflow-critical actions; it only parses JSONL and annotates entries with heuristic metadata. Because several central declared capabilities are absent, the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill references shell execution plus file read/write workflows and scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates unnecessary ambiguity about what capabilities the skill may exercise, increasing the chance an agent executes filesystem or shell actions more broadly than intended.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 86% confidence

Finding

The skill is explicitly designed to promote observations into persistent files such as SOUL.md, AGENTS.md, TOOLS.md, and MEMORY.md, which can inject durable behavioral context into future sessions. Even with an approval step, a flawed or poisoned learning candidate could cause long-term persistence of incorrect instructions, unsafe preferences, or attacker-influenced memory that affects later agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

1. `reuse_value`: will this help again?
2. `confidence`: how well supported is it?
3. `impact_scope`: how broadly does it matter?
4. `promotion_worthiness`: should it become a lasting rule or memory?
5. `promotion_target_candidates`: where should it go if promoted?

Use this practical rubric:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 8)May include surrounding context.

python

def run(cmd):
    subprocess.run(cmd, check=True)


def main():

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a workflow that drafts candidate patches, reviews them through an approval step, and keeps human control before any long-term file edits. This script goes beyond merely preparing review artifacts by invoking apply_approved_patches.py when --apply is provided, which performs the actual edits to the target base directory. That write/apply behavior is more powerful than a purely conservative capture-and-review pipeline as described at the manifest level.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs an archival operation on the user-supplied input file when --archive-input is set, which affects user data by moving it into an archive directory. Although the flag name hints at the behavior, there is no confirmation prompt, warning print, or descriptive comment/docstring disclosing that the original inbox will be archived after processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The stated purpose centers on turning mistakes and corrections into structured learnings, deduplicating them, and preparing promotion candidates under human control. The optional --archive-input step adds input archival and retention management, which is operational housekeeping rather than an obvious core requirement of conservative self-improvement analysis and promotion review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.