测试文件夹上传

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its self-improvement purpose, but it encourages broad persistent changes to future agent instructions and includes all-prompt hook examples that should be reviewed before use.

Install only if you want agents to keep local learning logs and potentially update future agent guidance. Prefer project-local .learnings and project-level hooks, avoid the global ~/.claude/settings.json hook unless you accept all-project activation, review any proposed changes to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions before they are written, and do not allow raw transcripts, secrets, tokens, or command output to be stored or sent across sessions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:462
• Finding: Untrusted Conversation-Derived Content Can Poison Persistent Agent Instructions## Vulnerability Details **File Location**: `SKILL.md:462-469`; related promotion workflows at `SKILL.md:40-43`, `SKILL.md:282-309`, and `references/openclaw-integration.md:87-103` **Vulnerability Type**: Persistent agent memory and instruction poisoning **Risk Level**: Medium ### Vulnerable Code and Instructions `SKILL.md:462-469`: ```markdown 1. **Log immediately** - context is freshest right after the issue 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md 8. **Review regularly** - stale learnings lose value ``` `SKILL.md:40-43`: ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Workflow improvements | Promote to `AGENTS.md` (OpenClaw workspace) | | Tool gotchas | Promote to `TOOLS.md` (OpenClaw workspace) | | Behavioral patterns | Promote to `SOUL.md` (OpenClaw workspace) | ``` `references/openclaw-integration.md:87-103`: ```markdown ## Learning Workflow ### Capturing Learnings 1. **In-session**: Log to `.learnings/` as usual 2. **Cross-session**: Promote to workspace files ### Promotion Decision Tree ``` Is the learning project-specific? ├── Yes → Keep in .learnings/ └── No → Is it behavioral/style-related? ├── Yes → Promote to SOUL.md └── No → Is it tool-related? ├── Yes → Promote to TOOLS.md └── No → Promote to AGENTS.md (workflow) ``` ``` ### Technical Analysis The Skill treats user corrections, conversational observations, errors, and inferred best practices as sources for learning entries. It subsequently directs the agent to promote selected entr ...[truncated 3361 chars]
• Remediation: ## Remediation Suggestions 1. Replace “promote aggressively” with a default-deny promotion policy. Content should remain in `.learnings/` unless it passes explicit review. 2. Require affirmative user or administrator confirmation before modifying `SOUL.md`, `AGENTS.md`, `TOOLS.md`, `CLAUDE.md`, or other automatically loaded instruction files. 3. Generate a proposed patch or staged promotion document instead of directly modifying persistent context. Display the source, destination, and exact proposed rule for review. 4. Record provenance for every promoted entry, including the originating session, source type, author or user, supporting evidence, reviewer, approval timestamp, and destination. 5. Treat conversation-derived text as untrusted data. Summarize it without preserving imperative instructions until its accuracy and safety have been verified independently. 6. Enforce mandatory promotion gates, such as recurrence across multiple distinct tasks, reproducible evidence, successful validation, and human review. 7. Reject or quarantine proposed rules involving credential access, secret collection, external data transmission, safety-control bypasses, privilege changes, destructive commands, or unrelated tool execution. 8. Restrict promotion targets through an allowlist and use filesystem permissions to prevent ordinary learning workflows from silently changing high-trust agent instructions. 9. Add rollback metadata and retain reviewed diffs so poisoned rules can be traced and removed. 10. Clearly distinguish passive historical memory from authoritative instructions; `.learnings/` entries should not automatically acquire instruction priority merely because they recur.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a reflective/operational learning-capture skill: recording failures, corrections, outdated knowledge, and better approaches for future improvement. The supplied code does not implement learning capture, error/correction logging, review of prior learnings, or any continuous-improvement workflow. Instead, it is a helper script for extracting/promoting a learning into a new skill scaffold by creating directories and a templated SKILL.md file. While this may be adjacent to a broader learning system, its primary purpose is materially different from the declared one, so this is a clear mismatch.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Writing to `~/.claude/settings.json` changes agent behavior from the user's config directory, creating persistent cross-session execution of local commands. In the context of a skill that auto-triggers on prompts, this makes the configuration especially sensitive because it affects all future workspaces rather than a single project.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 93% confidence
• Finding: The documented sessions_send capability enables transmitting information to another session, which is a classic exfiltration or lateral-sharing primitive if misused. In a self-improvement context, this is especially risky because learned content may include sensitive operational details, user data, tool output, or secrets that should remain isolated to a single session.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 83% confidence
• Finding: The skill directs agents to create and use persistent workspace files under `~/.openclaw/workspace/.learnings`, enabling retention of session-derived information across sessions. Even though the text warns against storing secrets and recommends sanitization, persistence of user corrections, errors, and cross-session sharing still creates confidentiality and privacy risk if sensitive context is summarized, misclassified, or later accessed by other sessions or agents.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The detection triggers use very broad natural-language phrases such as common correction or request wording, which can cause the skill to activate during ordinary conversation without clear user intent. In an agent environment, this can lead to unnecessary persistence of conversation content into local files, increasing privacy risk and creating unintended side effects from normal chat interactions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manual invocation examples include short, everyday phrases like 'Log this to learnings' and 'Check .learnings/ for related issues,' which may be easily echoed or paraphrased in benign conversation and accidentally trigger persistence behavior. Because the skill writes and reviews local state, ambiguous trigger phrases increase the chance of unintended file access or modification from routine user instructions.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 86% confidence
• Finding: The guide instructs users to create persistent hook configuration in `.claude/settings.json`, causing automatic behavior on future sessions rather than a one-time action. Persistence is not inherently malicious, but in this skill it increases risk because hooks execute automatically and may process future prompts or tool outputs without per-session re-consent.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: An empty `matcher` causes the activator hook to run for every submitted prompt, creating a universal trigger with no contextual scoping. In a self-improvement skill, that broad invocation increases exposure of all sessions and prompts to the hook pipeline, including potentially sensitive workflows.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The user-level configuration installs the hook in `~/.claude/settings.json` with an empty matcher, causing it to run across all sessions by default. Combining global persistence with universal triggering greatly expands the blast radius if the script is buggy, modified, or later replaced with unsafe behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The Codex CLI example also uses an empty matcher, which effectively enables the hook for all prompts in that environment. That broad scope is risky because the hook fires regardless of task sensitivity or relevance, increasing unnecessary execution and data exposure.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document states that the scripts 'don't modify files or run commands,' but the configured hook type is explicitly `command`, which launches shell scripts on prompt submission or after tool use. This mischaracterizes the execution model and can cause operators to underestimate the trust and privilege implications of enabling the hooks.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The promotion workflow directs learnings into persistent prompt files such as SOUL.md, TOOLS.md, and AGENTS.md, effectively turning transient observations into durable behavioral reconfiguration. This creates a prompt-persistence channel where mistakes, manipulated inputs, or adversarial content can permanently influence future agent behavior beyond the original task scope.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This documentation introduces cross-session transcript access, message passing, and agent spawning that exceed the narrow purpose of a self-improvement skill. Even though the text includes some cautionary language, exposing transcript-reading and cross-session sharing in this context increases the risk of unauthorized data access, lateral context movement, and accidental disclosure of sensitive information between sessions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger definitions are broad enough that normal operational events, user phrasing, or routine tool errors may activate logging and learning behavior unintentionally. That can cause over-collection of context, persistence of low-quality or sensitive data, and unwanted changes to future agent behavior based on noisy signals.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest describes a skill focused on capturing learnings, errors, corrections, and reviewing those learnings before tasks. This script instead creates new skill directories and writes a templated SKILL.md scaffold, which is a promotion/generation workflow rather than merely recording or reviewing learnings.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: For a skill described as capturing corrections and continuous-improvement learnings, generating new executable skill scaffolds under the skills tree is a broader repository-modification capability. That capability may be useful operationally, but it is not an obvious or explicitly declared requirement of the manifest's described purpose.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: Using a common phrase like a user correction example as a trigger indicator risks accidental activation during ordinary conversation. While lower severity on its own, it can still contribute to noisy or unnecessary learning capture and persistence.

Static analysis

No suspicious patterns detected.