Self Improving Agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:45 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it needs review because it can automatically add reminders and save conversation-derived details into long-lived agent memory without enough privacy controls.

Install only if you want a persistent self-improvement memory workflow. Keep .learnings local and ignored by default, do not enable global hooks unless you accept every-prompt reminders across sessions, review any hook scripts before enabling them, redact secrets and personal or customer data before logging, and require human review before promoting anything into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: hooks/openclaw/handler.js:39
• Finding: Automatic Injection of Behavioral Instructions into Agent Bootstrap Context## Vulnerability Details **File Location**: `hooks/openclaw/handler.js:39-45` **Additional Locations**: `hooks/openclaw/handler.ts:44-57`, `scripts/activator.sh:8-19`, `SKILL.md:475-489` **Vulnerability Type**: Automatic prompt and bootstrap-context modification **Risk Level**: High ### Vulnerable Code ```javascript // Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); } ``` The associated prompt-submit hook emits additional agent instructions as system context: ```bash # Output reminder as system context cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. </self-improvement-reminder> EOF ``` ### Technical Analysis When the documented hooks are enabled, the runtime handler automatically appends a virtual file containing behavioral instructions to `event.context.bootstrapFiles`. This places Skill-controlled content into the agent's bootstrap context without requiring the Skill to be explicitly invoked during each affected session. There is also a material discrepancy between the TypeScript source and the distributed CommonJS runtime. The TypeScript handler contains the following sub-agent exclusion: ```typescript // Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.s ...[truncated 1857 chars]
• Remediation: ## Remediation Suggestions 1. Do not insert Skill instructions into bootstrap or system-equivalent context by default. 2. Require an explicit, per-session user action before adding any reminder to agent context. 3. Prefer a clearly labeled user-visible notification rather than a virtual bootstrap file. 4. Rebuild `handler.js` from the reviewed TypeScript source so both implementations enforce identical session restrictions. 5. Add automated tests verifying that main-session and sub-agent behavior match the documented policy. 6. Pin the runtime entry point to a generated artifact and verify source/runtime parity in CI. 7. Clearly display the exact injected content and affected event types before hook activation. 8. Provide a narrow configuration that limits injection to explicitly selected repositories and session types.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:346
• Finding: Conversation-Derived Rules Can Poison Persistent Agent Memory and Prompt Files## Vulnerability Details **File Location**: `SKILL.md:346-361` **Additional Locations**: `SKILL.md:23-26`, `SKILL.md:262-289`, `hooks/openclaw/handler.js:18-22` **Vulnerability Type**: Untrusted task content promoted into persistent agent instructions **Risk Level**: High ### Vulnerable Instructions ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` The general promotion workflow further instructs the agent to write into persistent behavioral files: ```markdown ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` ### Technical Analysis The Skill treats user corrections, command failures, tool output, and task-derived observations as learning sources. It then directs the agent to promote recurring learning entries into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and Copilot instructions. These files are described as agent-context or system-prompt inputs for future sessions. Recurrence count is not a trust control. An attacker can repeat a malicious instruction across multiple tasks or cause similar entries to be logged until the promotion threshold is met. The workflow does not require: - Human approval of the final diff. - Validation t ...[truncated 1972 chars]
• Remediation: ## Remediation Suggestions 1. Prohibit automatic promotion of conversation-derived content into agent-context or system-prompt files. 2. Require explicit human approval for every promotion and show the complete proposed diff before writing. 3. Preserve provenance, including the originating session, user, task, and exact source text. 4. Treat user messages, command output, external documentation, and cross-session messages as untrusted input. 5. Reject proposed rules containing imperative instructions, requests to bypass controls, tool-execution directives, secret-handling directives, or references to hidden context. 6. Restrict automatic learning storage to factual, non-executable notes in a file that is not loaded as prompt context. 7. Separate behavioral policy from operational notes and allow only trusted maintainers to edit behavioral policy. 8. Require code-owner review for changes to `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and Copilot instructions. 9. Add integrity monitoring and version-control review for all persistent prompt files. 10. Replace recurrence count with a security-aware review process; repetition must not increase the trust assigned to untrusted content.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:167
• Finding: Raw Errors, Parameters, and Environment Details May Be Persisted and Committed## Vulnerability Details **File Location**: `SKILL.md:167-200` **Additional Location**: `SKILL.md:451-459` **Vulnerability Type**: Insufficient redaction and unsafe persistence of operational data **Risk Level**: Medium ### Vulnerable Instructions ```markdown ### Error Entry Append to `.learnings/ERRORS.md`: ```markdown ## [ERR-YYYYMMDD-XXX] skill_or_command_name **Logged**: ISO-8601 timestamp **Priority**: high **Status**: pending **Area**: frontend | backend | infra | tests | docs | config ### Summary Brief description of what failed ### Error ``` Actual error message or output ``` ### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ### Suggested Fix If identifiable, what might resolve this ### Metadata - Reproducible: yes | no | unknown - Related Files: path/to/file.ext - See Also: ERR-20250110-001 (if recurring) --- ``` The Skill also presents repository tracking as a standard storage option: ```markdown ## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/ ``` **Track learnings in repo** (team-wide): Don't add to .gitignore - learnings become shared knowledge. ``` ### Technical Analysis Command output, command-line parameters, API errors, stack traces, and environment details frequently contain sensitive information. Examples include access tokens, authorization headers, signed URLs, database connection strings, customer identifiers, internal hostnames, private filesystem paths, and secret-bearing environment variables. The logging format encourages copying the actual error output, attempted command, input parameters, and environment details into a persistent Markdown file. It does not require secret detection, redaction, field allowlisting, retention limits, or approval before the data is saved. The documentation then allows those files to be tracked in source cont ...[truncated 1530 chars]
• Remediation: ## Remediation Suggestions 1. Make `.learnings/` local and ignored by default. 2. Add `.learnings/` to the distributed `.gitignore` guidance as the secure default rather than presenting repository tracking as equivalent. 3. Explicitly prohibit recording credentials, tokens, cookies, authorization headers, private keys, complete environment-variable values, and signed URLs. 4. Summarize errors instead of copying complete command output. 5. Apply automatic redaction for common secret formats before any write. 6. Use an allowlist for environment metadata; record only non-sensitive fields such as operating-system family or tool version. 7. Redact command arguments and query strings unless each field has been reviewed. 8. Add pre-commit and CI secret scanning for learning files. 9. Enforce file-size and retention limits to reduce unnecessary data accumulation. 10. If a secret is committed, revoke or rotate it immediately and remove it from the complete repository history and downstream caches.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says this skill is for capturing learnings, failures, corrections, and improved approaches for future reuse. The supplied code does not implement learning capture, error logging, correction tracking, trigger handling, or review of prior learnings. Instead, it is a helper script for creating a new skill scaffold from a learning entry: it validates a skill name, optionally performs a dry run, creates a directory, and writes a templated SKILL.md file. This is a materially different primary purpose and includes undeclared filesystem write capabilities. While the comments mention 'from a learning entry,' the actual behavior is skill extraction/scaffolding, not continuous-improvement recordkeeping itself.

Ssd 3

High

• Confidence: 96% confidence
• Finding: Cross-session transcript access and message passing create a semantic exfiltration channel: one session can read sensitive content from another and propagate it further under the label of a 'learning.' In the context of a memory-sharing skill, this materially increases the blast radius of any sensitive conversation data.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The prescribed format explicitly asks for full context, inputs, parameters, environment details, and actual error output, all of which often contain credentials, identifiers, file paths, prompts, or customer data. Because these are written to durable markdown files, a transient mistake can become a long-lived data exposure.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Directing users to modify ~/.claude/settings.json affects the agent's persistent configuration directory, which is security-sensitive because it controls future automated behavior. While documentation alone is not exploitation, recommending changes there for broad hook execution meaningfully raises risk if the scripts are unsafe, modified later, or used in sensitive environments.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use the skill when a command fails, when a user corrects the agent, when a capability is missing, when an API fails, when knowledge is outdated, or when a better approach is discovered. This covers many ordinary coding-session events without clear boundaries or exclusions, making invocation conditions overly broad for a markdown skill description.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill promotes persistent logging of learnings and cross-session sharing, but provides no data minimization, redaction, or sensitivity-handling rules. That creates a clear pathway for user-provided secrets, internal details, or personal data to be stored durably and redistributed beyond the original context.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 79% confidence
• Finding: Creating persistent directories under the user's home workspace establishes durable state across sessions, which can retain sensitive operational history indefinitely. Persistence is core to the skill's function, but without retention controls, encryption, or minimization, it increases privacy and data exposure risk.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are common conversational language and instruct automatic logging without strong gating, which can cause incidental user content to be captured and persisted. In a skill built around durable memory, that increases the risk of over-collection and accidental retention of sensitive information.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: Telling agents to 'promote aggressively' into persistent memory normalizes retention of conversational content into long-term prompt files, where it may influence future sessions and be harder to audit or delete. This is especially risky because the skill elsewhere encourages broad logging and detailed context capture.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 84% confidence
• Finding: Placing hook configuration in project-local agent settings establishes persistent behavior that automatically reappears in future sessions. In the context of self-improvement hooks, this persistence makes the automation more dangerous because it silently continues executing unless explicitly removed.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: An empty matcher causes the hook to trigger on every prompt, creating a broad automatic execution path for the activator script. In an agent environment, this increases exposure, makes unexpected behavior persistent, and amplifies the effect of any bug or future script change.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The user-level configuration installs the hook in ~/.claude/settings.json, making automatic activation apply broadly across sessions and projects without meaningful trigger constraints. This increases blast radius because any issue in the script or hook behavior affects all future agent use, including unrelated repositories and contexts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The minimal setup still uses an empty matcher, so the supposedly lower-overhead configuration remains broadly triggered on every prompt. That preserves the main risk of unnecessary automatic execution while giving users a false sense that only performance overhead was reduced.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex example repeats the empty matcher pattern, causing the activator to run on all prompts in that environment as well. Replicating the same broad trigger across multiple agent platforms normalizes unsafe defaults and widens exposure.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document's security section understates the behavior of the referenced scripts by claiming they only output text and do not run commands, while the same guide configures them as command hooks and shows shell execution of an extract script. This can mislead users into granting trust and broad activation to executable components without accurately understanding their capabilities.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 86% confidence
• Finding: Creating a persistent `.learnings/` directory enables session persistence of model observations and user/task details without any documented consent, retention limit, or scoping controls. In the context of a self-improvement skill, this makes accidental long-term storage of sensitive operational context more likely and can compound privacy and prompt-injection risks over time.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs users to create persistent `.learnings/` storage but does not warn that conversations, failures, corrections, or environment-specific details may be retained across sessions. In a self-improvement skill, this increases the chance of silently storing sensitive data, credentials, internal paths, or user-provided confidential context beyond the immediate task.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The documented 'Standard Triggers' include very broad conditions such as 'Knowledge gaps' and generic user corrections like 'No, that's wrong...', without defining scope or exclusions. In a markdown integration guide, these ambiguous triggers can overlap with normal conversation and make it unclear when the skill should activate or log learnings versus when it should not.

Vague Triggers

Low

• Confidence: 89% confidence
• Finding: This markdown template instructs authors to 'Include trigger conditions' but does not require specific trigger phrases, scope limits, or exclusion examples. Because this file is a reusable template, the vague guidance can propagate overly broad invocation descriptions into downstream skills.

Vague Triggers

Low

• Confidence: 92% confidence
• Finding: The placeholder 'What this skill does and when to use it' does not instruct authors to make triggers specific or narrow enough to avoid common-speech collisions. In a template file, this omission can result in downstream manifests with ambiguous activation conditions.

Static analysis

No suspicious patterns detected.