Self Improving Agent 1.0.2

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:53 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed self-improvement logger, but it asks agents to persist conversation-derived content into future instruction files and share session information without enough privacy or approval controls.

Install only if you want an agent to keep durable learning notes and you are comfortable reviewing what gets saved. Keep .learnings/ local by default, do not store secrets or raw command output, require explicit approval before modifying CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, avoid global every-prompt hooks unless you have reviewed the scripts and paths, and do not use cross-session history or message sending without consent and redaction.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:165
• Finding: Untrusted Learnings Can Poison Persistent Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:165-190`, `SKILL.md:306-312`; related injection behavior in `references/clawdbot-integration.md:38-44` and promotion workflow in `references/clawdbot-integration.md:124-138` **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (clawdbot) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (clawdbot) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` ```markdown 1. **Log immediately** - context is freshest right after the issue 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .gi ...[truncated 2649 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit human approval before writing to any persistent instruction file. 2. Treat user corrections, error output, logs, retrieved documentation, and session messages as untrusted data. 3. Keep learnings as quoted informational records rather than imperative instructions. 4. Reject promotions that alter safety rules, authorization boundaries, tool permissions, identity, credential handling, or instruction precedence. 5. Replace “promote aggressively” with a conservative, review-based promotion policy. 6. Record provenance for every promoted rule, including source session, author, timestamp, and approving reviewer. 7. Add an allowlist of permitted promotion categories and destination sections. 8. Present a diff for approval before modifying `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, or Copilot instructions. 9. Add rollback support and periodically review persistent instructions for stale or suspicious entries. 10. Never automatically extract or publish a Skill from content that has not undergone independent security review.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/clawdbot-integration.md:156
• Finding: Cross-Session Transcript Access and Information Propagation Lack Authorization Safeguards## Vulnerability Details **File Location**: `references/clawdbot-integration.md:156-195`; summarized in `SKILL.md:540-543` **Vulnerability Type**: Excessive cross-session data access **Risk Level**: Medium ### Vulnerable Code ```markdown ## Inter-Agent Communication Clawdbot provides tools for cross-session communication: ### sessions_list View active and recent sessions: ``` sessions_list --active sessions_list --recent 10 ``` ### sessions_history Read transcript from another session: ``` sessions_history --session <session-id> --last 50 ``` ### sessions_send Send message to another session: ``` sessions_send --to <session-id> --message "Learning: API requires X-Custom-Header" ``` ### Learning Sharing Pattern When discovering something valuable in session A: 1. Check if other sessions are working on related code: ``` sessions_list --active ``` 2. Share the learning: ``` sessions_send --to session-b --message "FYI: Discovered that the auth API requires refresh tokens every 30min" ``` 3. Log to workspace file if broadly applicable: - Edit `~/clawd/TOOLS.md` or appropriate file ``` ### Technical Analysis The integration instructs agents to enumerate sessions, read another session's transcript, send information to other sessions, and persist selected content in shared workspace files. No procedure is provided for validating that the requesting user owns or is authorized to inspect the target session. The workflow also lacks data classification, consent checks, redaction requirements, project-boundary validation, and recipient authorization. Session transcripts can contain user prompts, source code, internal file paths, proprietary data, access tokens, command output, or credentials accidentally printed by tools. The available platform tools may still enforce their own authorization. Therefore, this finding does not establish an authenti ...[truncated 1580 chars]
• Remediation: ## Remediation Suggestions 1. Remove `sessions_history` from the default learning workflow. 2. Require explicit user consent before accessing any other session. 3. Allowlist specific source and destination session IDs rather than enumerating all sessions. 4. Verify that source and destination sessions belong to the same authorized user, project, and security context. 5. Share only manually selected summaries; never forward raw transcript entries by default. 6. Apply secret and personal-data redaction before calling `sessions_send` or writing workspace files. 7. Prevent cross-project and cross-tenant sharing unless separately authorized. 8. Log cross-session reads and sends in an auditable record that identifies the requester, source, recipient, and reason. 9. Add a policy that forbids copying credentials, tokens, private prompts, source code, or customer information into persistent memory. 10. Prefer project-local `.learnings/` storage when cross-session access is not strictly necessary.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:84
• Finding: Raw Error and Environment Logging Can Commit Sensitive Data to Source Control## Vulnerability Details **File Location**: `SKILL.md:84-100`, `SKILL.md:318-323` **Vulnerability Type**: Plaintext sensitive-data exposure through diagnostic logging **Risk Level**: High ### Vulnerable Code ```markdown ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ### Suggested Fix If identifiable, what might resolve this ### Metadata - Reproducible: yes | no | unknown - Related Files: path/to/file.ext - See Also: ERR-20250110-001 (if recurring) ``` ```markdown ## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/ ``` **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` ### Technical Analysis The prescribed error-entry format tells the agent to copy the actual error output, command inputs, parameters, and environment details into Markdown files. Diagnostic output frequently contains sensitive information, including authorization headers, tokens embedded in URLs, environment-variable values, database connection strings, private paths, customer data, and command-line credentials. The Skill provides no redaction rules, secret detection, retention limits, file-permission requirements, or prohibited-data list. It also explicitly presents repository tracking as a supported configuration. As a result, sensitive information can move from transient process output into durable plaintext files and then into version-control history. Git history makes remediation particularly difficult because deleting the current file does not remove the secret from previous commits, forks, CI caches, pull-request diffs, or cloned repositories. Skill extraction and cross-workspace promotion can further expand the exposure. ### Attack Path 1. A Bash command or external API operation fails and prints a token, credential ...[truncated 1386 chars]
• Remediation: ## Remediation Suggestions 1. Default `.learnings/` to local, ignored storage and require an explicit security decision before repository tracking. 2. Add mandatory redaction instructions before any error or learning is written. 3. Prohibit storing credentials, tokens, cookies, authorization headers, private keys, connection strings, environment-variable values, and personal data. 4. Record environment-variable names only, never their values. 5. Replace raw command output with a minimal sanitized summary and a stable error code. 6. Mask URL query parameters, usernames, filesystem home paths, request bodies, and command-line secret arguments. 7. Run a secret scanner against `.learnings/`, generated Skills, and persistent instruction files before commits or publication. 8. Apply restrictive filesystem permissions to local learning files. 9. Define retention and deletion policies for diagnostic entries. 10. If a secret has already been committed, revoke or rotate it immediately and purge it from Git history, pull-request artifacts, CI logs, caches, and forks.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a logging/self-improvement aid, but it also documents capability for skill extraction and helper scripts that create new skill artifacts. That expands its effective behavior beyond passive note-taking into code/artifact generation, which can surprise operators and reduce review scrutiny for actions that write files or scaffold reusable instructions.

Exfiltration Commands

High

• Category: Prompt Injection

Content

Clawdbot supports session-based communication:
- **sessions_list** - See active/recent sessions
- **sessions_history** - Read transcript from another session
- **sessions_send** - Send message to another session

### Hybrid Setup (Claude Code + Clawdbot)

• Confidence: 99% confidence
• Finding: The documented `sessions_send` capability enables transmission of data to other sessions, and it is paired with transcript access via `sessions_history`. In the context of a skill that collects learnings from conversations, this creates a clear exfiltration pathway where sensitive user content can be redistributed outside the originating session boundary.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send --to <session-id> --message "Learning: API requires X-Custom-Header"
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 91% confidence
• Finding: Guidance to modify ~/.claude/settings.json affects the agent's persistent global configuration directory, which is a high-value control point. Encouraging changes there for a repository-provided skill creates durable cross-session influence and makes compromise of the referenced scripts or paths far more impactful than project-local configuration.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use the skill when a user corrects the agent, requests a missing capability, or when a better approach is discovered, which are common and subjective situations rather than narrowly bounded triggers. Although examples are given, the activation boundary remains broad enough that the skill could be invoked in many routine conversations unintentionally.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to record user corrections, requests, inputs, and context into local markdown files without any privacy screening, minimization, or consent language. This can capture secrets, personal data, internal URLs, tokens, or sensitive business context in durable files that may later be committed, shared, or indexed.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The promotion workflow explicitly moves accumulated learnings into durable memory and instruction files used across future sessions and agents. If those learnings originated from user conversations or incident details, sensitive information can be amplified from a local note into broadly reused prompts and project guidance.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The review workflow encourages grepping and mining `.learnings/` content across files, reinforcing persistent storage of natural-language conversation details and operational context. Because the logged material can include user-provided information and error outputs, this becomes a retention and discoverability channel for sensitive data.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Extraction Workflow

1. **Identify candidate**: Learning meets extraction criteria
2. **Run helper** (or create manually):
   ```bash
   ./skills/self-improvement/scripts/extract-skill.sh skill-name --dry-run
   ./skills/self-improvement/scripts/extract-skill.sh skill-name

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The self-improvement skill introduces inter-agent session listing, transcript reading, and message sending capabilities that are unrelated to simple local learning logs. Those features create a potential lateral data access path where conversation-derived content can be read from or propagated to other sessions without a clear need-to-know boundary.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The configuration example enables session history persistence on disk without warning that conversations may contain secrets, credentials, internal code, or personal data. Persisting transcripts silently or by default increases the chance of later disclosure through local compromise, backup systems, shared machines, or accidental reuse in prompts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide explicitly encourages reading other session transcripts and sending cross-session messages, but provides no privacy boundaries, consent requirements, or guidance on handling secrets. In a prompt-injection-capable environment, this increases the risk of sensitive data exposure between sessions, especially if transcripts contain credentials, proprietary code, or user data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 84% confidence
• Finding: Placing hook configuration in .claude/settings.json establishes persistent behavior at the project level, so automatic command execution survives across sessions and future work in that repository. While persistence is part of the feature, it is security-relevant because it can outlast user awareness and continue injecting behavior into later tasks.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: An empty matcher causes the UserPromptSubmit hook to run on every prompt, greatly expanding the attack surface and normalizing constant automatic script execution. In a self-improvement skill, this means unscoped behavior is injected into all interactions, including sensitive or unrelated tasks, which increases the chance of prompt contamination, data exposure, or unintended side effects from future script changes.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The user-level configuration installs the hook in ~/.claude/settings.json for global activation, causing automatic command execution across all sessions and repositories. That broad persistence magnifies risk because any bug, script modification, or malicious replacement affects every future interaction, including work in unrelated or sensitive environments.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex example also uses an empty matcher, so the hook executes for every prompt without task scoping. This broad trigger is risky because it applies a command-backed hook universally, increasing the likelihood of unnecessary execution and cross-context influence in another agent environment.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document states that the scripts 'only output text' and 'don't modify files or run commands,' but the configured hooks are explicitly executed as shell commands by the agent runtime. This mismatch can mislead users into underestimating the trust and execution risk of these scripts, causing them to enable code execution hooks without appropriate review.

Vague Triggers

Low

• Confidence: 90% confidence
• Finding: The comment says the script 'Triggers on UserPromptSubmit' but does not define any narrower scope, exclusions, or limiting conditions. That broad event can cover essentially every user prompt submission, making the activation behavior unclear and potentially overbroad for a trigger description.

Static analysis

No suspicious patterns detected.