ClawHub
Back to skill

Security audit

Skill AGI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple learning log, but it tells agents to promote notes into durable agent instruction files without requiring explicit user review.

Install only if you want an agent-maintained memory workflow. Treat any promotion into AGENTS.md, MEMORY.md, TOOLS.md, CLAUDE.md, or auto-memory as a manual review step: check the exact text, source, scope, and reversibility before allowing it to persist.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:44
Finding

Untrusted Learnings Can Be Promoted into Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–56
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Relevant Snippet:

markdown
Periodically (or when the file exceeds ~50 entries):
- Delete entries that no longer apply (dependency upgraded, config changed)
- Merge duplicates into a single entry
- Promote critical entries that affect every session to a permanent location

## Promotion

Move persistent, high-impact learnings out of this file and into durable config:

- **OpenClaw**: Promote to workspace `MEMORY.md`, `TOOLS.md`, or `AGENTS.md`
- **Claude Code**: Promote to project `CLAUDE.md` or auto-memory (`~/.claude/projects/*/memory/`)

Once promoted, delete the entry from `learnings.md` to avoid duplication.

Technical Analysis

The skill directs the agent to promote entries from the session-oriented learnings.md file into durable agent configuration files, including AGENTS.md, CLAUDE.md, MEMORY.md, and TOOLS.md. These files can influence tool use, operational assumptions, and instructions in future sessions.

Entries are derived from project interactions, user corrections, encountered content, and perceived conventions. The promotion process does not require provenance verification, explicit user approval, separation of observations from executable instructions, or validation that an entry is safe before it is copied into persistent configuration. Consequently, an attacker who can influence what the agent interprets as a useful learning may cause attacker-controlled guidance to persist beyond the original session.

Attack Path

  1. An attacker controls or influences project content, task instructions, error output, or another input reviewed by the agent.
  2. The attacker presents a malicious instruction as a project convention, necessary workaround, or user correction—for example, a claim that future tasks must invoke an attacker-controlled t ...[truncated 1304 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not automatically promote content derived from user input, repository files, tool output, logs, or external sources into persistent instruction files.
  • Require explicit, informed user approval for every promoted entry, showing both the source and the exact destination text before writing it.
  • Track provenance and trust level for each learning. Only allow promotion of entries originating from trusted maintainers or independently verified project configuration.
  • Treat AGENTS.md, CLAUDE.md, MEMORY.md, and TOOLS.md as security-sensitive instruction stores rather than general note files.
  • Restrict promoted content to factual, non-executable observations. Reject entries that request commands, weaken safeguards, redirect tools or network endpoints, request secrets, or establish behavioral rules.
  • Prefer a dedicated structured data file for validated project facts instead of copying free-form text into files interpreted as agent instructions.
  • Require a review diff and confirmation before modifying persistent files, and preserve an audit trail so unauthorized changes can be identified and reverted.
  • Keep persistent memory scoped to the individual project. Avoid promotion into user-wide auto-memory unless separately reviewed and explicitly authorized.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.