Security audit

Self Improving Agent 1.0.2

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed self-improvement logger, but it asks agents to persist conversation-derived content into future instruction files and share session information without enough privacy or approval controls.

Install only if you want an agent to keep durable learning notes and you are comfortable reviewing what gets saved. Keep .learnings/ local by default, do not store secrets or raw command output, require explicit approval before modifying CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, avoid global every-prompt hooks unless you have reviewed the scripts and paths, and do not use cross-session history or message sending without consent and redaction.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:165
Finding: Untrusted Learnings Can Poison Persistent Agent Instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:165-190, SKILL.md:306-312; related injection behavior in references/clawdbot-integration.md:38-44 and promotion workflow in references/clawdbot-integration.md:124-138
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: High

Vulnerable Code

markdown
## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (clawdbot) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (clawdbot) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`

markdown
1. **Log immediately** - context is freshest right after the issue 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .gi ...[truncated 2649 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit human approval before writing to any persistent instruction file.

Treat user corrections, error output, logs, retrieved documentation, and session messages as untrusted data.

Keep learnings as quoted informational records rather than imperative instructions.

Reject promotions that alter safety rules, authorization boundaries, tool permissions, identity, credential handling, or instruction precedence.

Replace “promote aggressively” with a conservative, review-based promotion policy.

Record provenance for every promoted rule, including source session, author, timestamp, and approving reviewer.

Add an allowlist of permitted promotion categories and destination sections.

Present a diff for approval before modifying CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

Add rollback support and periodically review persistent instructions for stale or suspicious entries.

Never automatically extract or publish a Skill from content that has not undergone independent security review.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/clawdbot-integration.md:156
Finding: Cross-Session Transcript Access and Information Propagation Lack Authorization Safeguards
Content: View full analysis
Vulnerability Details

File Location: references/clawdbot-integration.md:156-195; summarized in SKILL.md:540-543
Vulnerability Type: Excessive cross-session data access
Risk Level: Medium

Vulnerable Code

markdown
## Inter-Agent Communication Clawdbot provides tools for cross-session communication: ### sessions_list View active and recent sessions:

sessions_list --active sessions_list --recent 10

text
### sessions_history Read transcript from another session:

sessions_history --session <session-id> --last 50

text
### sessions_send Send message to another session:

sessions_send --to <session-id> --message "Learning: API requires X-Custom-Header"

text
### Learning Sharing Pattern When discovering something valuable in session A: 1. Check if other sessions are working on related code: ``` sessions_list --active ``` 2. Share the learning: ``` sessions_send --to session-b --message "FYI: Discovered that the auth API requires refresh tokens every 30min" ``` 3. Log to workspace file if broadly applicable: - Edit `~/clawd/TOOLS.md` or appropriate file

Technical Analysis

The integration instructs agents to enumerate sessions, read another session's transcript, send information to other sessions, and persist selected content in shared workspace files. No procedure is provided for validating that the requesting user owns or is authorized to inspect the target session.

The workflow also lacks data classification, consent checks, redaction requirements, project-boundary validation, and recipient authorization. Session transcripts can contain user prompts, source code, internal file paths, proprietary data, access tokens, command output, or credentials accidentally printed by tools.

The available platform tools may still enforce their own authorization. Therefore, this finding does not establish an authenti ...[truncated 1580 chars]
Remediation: View remediation
Remediation Suggestions

Remove sessions_history from the default learning workflow.

Require explicit user consent before accessing any other session.

Allowlist specific source and destination session IDs rather than enumerating all sessions.

Verify that source and destination sessions belong to the same authorized user, project, and security context.

Share only manually selected summaries; never forward raw transcript entries by default.

Apply secret and personal-data redaction before calling sessions_send or writing workspace files.

Prevent cross-project and cross-tenant sharing unless separately authorized.

Log cross-session reads and sends in an auditable record that identifies the requester, source, recipient, and reason.

Add a policy that forbids copying credentials, tokens, private prompts, source code, or customer information into persistent memory.

Prefer project-local .learnings/ storage when cross-session access is not strictly necessary.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:84
Finding: Raw Error and Environment Logging Can Commit Sensitive Data to Source Control
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:84-100, SKILL.md:318-323
Vulnerability Type: Plaintext sensitive-data exposure through diagnostic logging
Risk Level: High

Vulnerable Code

markdown
### Error

Actual error message or output

text
### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ### Suggested Fix If identifiable, what might resolve this ### Metadata - Reproducible: yes | no | unknown - Related Files: path/to/file.ext - See Also: ERR-20250110-001 (if recurring)

markdown
## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/

Track learnings in repo (team-wide): Don't add to .gitignore - learnings become shared knowledge.

text
### Technical Analysis The prescribed error-entry format tells the agent to copy the actual error output, command inputs, parameters, and environment details into Markdown files. Diagnostic output frequently contains sensitive information, including authorization headers, tokens embedded in URLs, environment-variable values, database connection strings, private paths, customer data, and command-line credentials. The Skill provides no redaction rules, secret detection, retention limits, file-permission requirements, or prohibited-data list. It also explicitly presents repository tracking as a supported configuration. As a result, sensitive information can move from transient process output into durable plaintext files and then into version-control history. Git history makes remediation particularly difficult because deleting the current file does not remove the secret from previous commits, forks, CI caches, pull-request diffs, or cloned repositories. Skill extraction and cross-workspace promotion can further expand the exposure. ### Attack Path 1. A Bash command or external API operation fails and prints a token, credential ...[truncated 1386 chars]
Remediation: View remediation
Remediation Suggestions

Default .learnings/ to local, ignored storage and require an explicit security decision before repository tracking.

Add mandatory redaction instructions before any error or learning is written.

Prohibit storing credentials, tokens, cookies, authorization headers, private keys, connection strings, environment-variable values, and personal data.

Record environment-variable names only, never their values.

Replace raw command output with a minimal sanitized summary and a stable error code.

Mask URL query parameters, usernames, filesystem home paths, request bodies, and command-line secret arguments.

Run a secret scanner against .learnings/, generated Skills, and persistent instruction files before commits or publication.

Apply restrictive filesystem permissions to local learning files.

Define retention and deletion policies for diagnostic entries.

If a secret has already been committed, revoke or rotate it immediately and purge it from Git history, pull-request artifacts, CI logs, caches, and forks.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a logging/self-improvement aid, but it also documents capability for skill extraction and helper scripts that create new skill artifacts. That expands its effective behavior beyond passive note-taking into code/artifact generation, which can surprise operators and reduce review scrutiny for actions that write files or scaffold reusable instructions.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 99% confidence
Finding: The documented sessions_send capability enables transmission of data to other sessions, and it is paired with transcript access via sessions_history. In the context of a skill that collects learnings from conversations, this creates a clear exfiltration pathway where sensitive user content can be redistributed outside the originating session boundary.
Content: Scanner excerpt · SKILL.md (reported line 543)May include surrounding context.
md
Clawdbot supports session-based communication: - **sessions_list** - See active/recent sessions - **sessions_history** - Read transcript from another session - **sessions_send** - Send message to another session ### Hybrid Setup (Claude Code + Clawdbot)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/clawdbot-integration.md (reported line 175)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send --to <session-id> --message "Learning: API requires X-Custom-Header"

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 91% confidence
Finding: Guidance to modify ~/.claude/settings.json affects the agent's persistent global configuration directory, which is a high-value control point. Encouraging changes there for a repository-provided skill creates durable cross-session influence and makes compromise of the referenced scripts or paths far more impactful than project-local configuration.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says to use the skill when a user corrects the agent, requests a missing capability, or when a better approach is discovered, which are common and subjective situations rather than narrowly bounded triggers. Although examples are given, the activation boundary remains broad enough that the skill could be invoked in many routine conversations unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to record user corrections, requests, inputs, and context into local markdown files without any privacy screening, minimization, or consent language. This can capture secrets, personal data, internal URLs, tokens, or sensitive business context in durable files that may later be committed, shared, or indexed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The promotion workflow explicitly moves accumulated learnings into durable memory and instruction files used across future sessions and agents. If those learnings originated from user conversations or incident details, sensitive information can be amplified from a local note into broadly reused prompts and project guidance.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The review workflow encourages grepping and mining .learnings/ content across files, reinforcing persistent storage of natural-language conversation details and operational context. Because the logged material can include user-provided information and error outputs, this becomes a retention and discoverability channel for sensitive data.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 406)May include surrounding context.
Extraction Workflow

Identify candidate: Learning meets extraction criteria

Run helper (or create manually):
bash
./skills/self-improvement/scripts/extract-skill.sh skill-name --dry-run ./skills/self-improvement/scripts/extract-skill.sh skill-name

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The self-improvement skill introduces inter-agent session listing, transcript reading, and message sending capabilities that are unrelated to simple local learning logs. Those features create a potential lateral data access path where conversation-derived content can be read from or propagated to other sessions without a clear need-to-know boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configuration example enables session history persistence on disk without warning that conversations may contain secrets, credentials, internal code, or personal data. Persisting transcripts silently or by default increases the chance of later disclosure through local compromise, backup systems, shared machines, or accidental reuse in prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly encourages reading other session transcripts and sending cross-session messages, but provides no privacy boundaries, consent requirements, or guidance on handling secrets. In a prompt-injection-capable environment, this increases the risk of sensitive data exposure between sessions, especially if transcripts contain credentials, proprietary code, or user data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: Placing hook configuration in .claude/settings.json establishes persistent behavior at the project level, so automatic command execution survives across sessions and future work in that repository. While persistence is part of the feature, it is security-relevant because it can outlast user awareness and continue injecting behavior into later tasks.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: An empty matcher causes the UserPromptSubmit hook to run on every prompt, greatly expanding the attack surface and normalizing constant automatic script execution. In a self-improvement skill, this means unscoped behavior is injected into all interactions, including sensitive or unrelated tasks, which increases the chance of prompt contamination, data exposure, or unintended side effects from future script changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-level configuration installs the hook in ~/.claude/settings.json for global activation, causing automatic command execution across all sessions and repositories. That broad persistence magnifies risk because any bug, script modification, or malicious replacement affects every future interaction, including work in unrelated or sensitive environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Codex example also uses an empty matcher, so the hook executes for every prompt without task scoping. This broad trigger is risky because it applies a command-backed hook universally, increasing the likelihood of unnecessary execution and cross-context influence in another agent environment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document states that the scripts 'only output text' and 'don't modify files or run commands,' but the configured hooks are explicitly executed as shell commands by the agent runtime. This mismatch can mislead users into underestimating the trust and execution risk of these scripts, causing them to enable code execution hooks without appropriate review.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The comment says the script 'Triggers on UserPromptSubmit' but does not define any narrower scope, exclusions, or limiting conditions. That broad event can cover essentially every user prompt submission, making the activation behavior unclear and potentially overbroad for a trigger description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Tp4

Exfiltration Commands

Exfiltration Commands

sessions_send

Agent Config Directory Access

Option 2: User-Level Configuration

Vague Triggers

Missing User Warnings

Ssd 3

Ssd 3

Session Persistence

Extraction Workflow

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Rp1

Rp1

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Vague Triggers

Intent-Code Divergence

Vague Triggers

Static analysis