Skill Self Improving Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:47 AM UTC
• Version: 1.0.0

Overview

This skill is a self-improvement logger, but it can persist conversation-derived content into future agent instructions and supports broad cross-session learning flows without strong review or redaction controls.

Install only if you want durable self-improvement memory. Before enabling hooks or promoting entries, review diffs manually, avoid logging secrets or raw error output, keep .learnings project-local or ignored when sensitive, and treat AGENTS.md, SOUL.md, TOOLS.md, CLAUDE.md, and Copilot instruction changes as security-sensitive.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:262
• Finding: Untrusted Learnings Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 262-289 **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` The recurring-pattern workflow also explicitly instructs the agent to promote content into agent context: ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable ``` ### Technical Analysis The skill captures information originating from conversations, user correcti ...[truncated 2506 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit approval from a trusted workspace owner before writing any learning into persistent instruction files. 2. Treat conversation-derived learnings as untrusted data, regardless of recurrence count. 3. Keep raw learnings in a data-only store that is not automatically injected as agent instructions. 4. Apply a strict promotion schema that permits concise factual statements but rejects: - Instructions to ignore or weaken security controls - Tool-execution mandates - Credential or secret material - External URLs unless separately approved - Shell commands or executable code - Instructions that change authority, trust, or approval boundaries 5. Record immutable provenance for each promoted rule, including source session, author, reviewer, approval time, and original learning ID. 6. Present a diff of the target instruction file and require confirmation immediately before writing it. 7. Add rollback and review mechanisms for all promoted entries. 8. Replace recurrence-based automatic promotion with recurrence-based nomination; promotion should remain a reviewed manual action. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:33
• Finding: Installation Instructions Retrieve Unpinned Executable Skill Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 33-44 **Vulnerability Type**: Unpinned third-party skill installation **Risk Level**: Medium ### Vulnerable Code ```markdown ### Installation **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` Remade for openclaw from original repo : https://github.com/pskoett/pskoett-ai-skills - https://github.com/pskoett/pskoett-ai-skills/tree/main/skills/self-improvement ``` ### Technical Analysis Both documented installation methods retrieve the current content from an external package source without pinning a version, commit hash, digest, or cryptographic signature. The Git command clones the repository's current default branch directly into `~/.openclaw/skills/`, while the registry command does not specify a reviewed release. The destination is security-sensitive because OpenClaw loads skills from this directory, and this project includes executable hook and shell-script content. The effective installed code can therefore differ from the snapshot covered by this audit if the registry entry, repository, maintainer account, or upstream default branch changes. No malicious remote payload is present in the audited snapshot. The risk arises from the documented supply-chain process, which does not guarantee that users install this reviewed content. ### Attack Path 1. An attacker compromises the upstream repository, registry package, release process, or maintainer account. 2. The attacker publishes modified skill content under the same repository or package identity. 3. A user follows the documented `clawdhub install` or `git clone` command. 4. The installation retrieves the attacker's current version without an integrity or revision check. 5. The content is placed in OpenClaw's automatically discoverable skills directory. 6. The skill is l ...[truncated 848 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish immutable, versioned releases and recommend an explicit reviewed version in the installation command. 2. For manual installation, pin a full commit hash rather than cloning the mutable default branch. 3. Publish SHA-256 checksums or signed release manifests and require verification before installation. 4. Use signed Git tags or artifact signatures with a documented trusted signing identity. 5. Install into a staging directory first, verify integrity, and review `SKILL.md`, hook handlers, and scripts before moving content into `~/.openclaw/skills/`. 6. Do not automatically enable hooks during installation. 7. Document that updates require a new security review and integrity verification. 8. If supported by ClawdHub, use package lockfiles, content-addressed package identifiers, or signature enforcement. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill’s stated purpose is logging learnings, but the content also expands into hook installation, workspace mutation, cross-session sharing, and skill extraction. This mismatch is dangerous because users may authorize a seemingly low-risk note-taking skill while it performs broader persistent changes and enables additional automation beyond the declared scope.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The cross-session features encourage reading transcripts from other sessions and sending learnings between them. This is dangerous because it enables propagation of sensitive conversation data across boundaries that may have different users, tasks, trust levels, or least-privilege assumptions.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The error template explicitly asks for full context, parameters, inputs, and actual error output in persistent logs. Error output and command context frequently contain credentials, tokens, file paths, URLs, stack traces, customer data, or internal system details, making this a direct sensitive-data exposure vector.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation guidance is very broad and covers many normal interactions such as errors, corrections, outdated knowledge, and better approaches. Overbroad triggering is risky because it can cause the skill to run frequently, leading to unnecessary persistence of user data and unplanned workspace modifications.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to persist user corrections, requests, and related inputs into local markdown logs. Even if intended for productivity, this creates a data retention risk because natural-language interactions may contain secrets, personal data, proprietary context, or security-sensitive details that are stored beyond the original session.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 76% confidence
• Finding: The skill establishes persistent storage under the user workspace for future sessions. Persistence itself is not always unsafe, but in this context it increases risk because the stored content is explicitly meant to accumulate user interactions, errors, and cross-session learnings over time.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The automatic logging triggers rely on common conversational phrases like corrections or feature wishes, without requiring context validation or consent. This can cause accidental retention of sensitive user input or overcollection from ordinary dialogue that was never intended to become durable memory.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes logic and workflows for generating entirely new skills, which materially extends its capabilities beyond self-improvement logging. This increases the attack surface because logged content or inferred patterns could be transformed into reusable instructions/prompts that persist and influence future agent behavior.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 72% confidence
• Finding: The guide instructs users to install persistent automatic hooks in project or user settings, causing scripts to run on every prompt or tool event across future sessions. Even though the documented scripts are described as lightweight, this creates durable execution and context-injection behavior that can be abused if the scripts or skill directory are later modified, especially in a self-improvement skill that is designed to influence future agent behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 86% confidence
• Finding: The guidance establishes session-persistent learning storage in locations tied to the workspace or installed skill, which increases the chance that data and behavior modifications survive resets and influence later runs. In the OpenClaw context, persistence is especially sensitive because workspace files are part of the prompt-injection model and may be reloaded automatically.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The promotion workflow advises moving learnings into `SOUL.md`, `TOOLS.md`, and `AGENTS.md`, which are explicitly injected into future sessions as prompt context. That creates a durable integrity risk: erroneous, sensitive, or adversarially influenced content can become trusted behavioral instructions and persistently steer future agent actions.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest describes a skill focused on recording learnings, corrections, failures, and reviewing them before tasks. This script instead creates new skill directories and writes a reusable SKILL.md scaffold, which is a skill-generation capability rather than merely capturing or reviewing learnings.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Creating directories and authoring a new SKILL.md template gives the skill the ability to generate additional skills on disk. That goes beyond the manifest's stated remit of capturing learnings, errors, and corrections unless the manifest explicitly says it can convert learnings into new skills.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The documentation instructs users to create persistent `.learnings/` storage in the workspace or skill directory without clearly warning that future agent behavior may be influenced by those retained files. In a prompt-injected workspace system, persistent memory files can silently accumulate sensitive data or become a durable prompt-injection surface across sessions.

Static analysis

No suspicious patterns detected.