Security audit

Self Improving Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it needs review because it can automatically add reminders and save conversation-derived details into long-lived agent memory without enough privacy controls.

Install only if you want a persistent self-improvement memory workflow. Keep .learnings local and ignored by default, do not enable global hooks unless you accept every-prompt reminders across sessions, review any hook scripts before enabling them, redact secrets and personal or customer data before logging, and require human review before promoting anything into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: hooks/openclaw/handler.js:39
Finding: Automatic Injection of Behavioral Instructions into Agent Bootstrap Context
Content: View full analysis
Vulnerability Details

File Location: hooks/openclaw/handler.js:39-45
Additional Locations: hooks/openclaw/handler.ts:44-57, scripts/activator.sh:8-19, SKILL.md:475-489
Vulnerability Type: Automatic prompt and bootstrap-context modification
Risk Level: High

Vulnerable Code

javascript
// Inject the reminder as a virtual bootstrap file // Check that bootstrapFiles is an array before pushing if (Array.isArray(event.context.bootstrapFiles)) { event.context.bootstrapFiles.push({ path: 'SELF_IMPROVEMENT_REMINDER.md', content: REMINDER_CONTENT, virtual: true, }); }

The associated prompt-submit hook emits additional agent instructions as system context:

bash
# Output reminder as system context cat << 'EOF' <self-improvement-reminder> After completing this task, evaluate if extractable knowledge emerged: - Non-obvious solution discovered through investigation? - Workaround for unexpected behavior? - Project-specific pattern learned? - Error required debugging to resolve? If yes: Log to .learnings/ using the self-improvement skill format. If high-value (recurring, broadly applicable): Consider skill extraction. </self-improvement-reminder> EOF

Technical Analysis

When the documented hooks are enabled, the runtime handler automatically appends a virtual file containing behavioral instructions to event.context.bootstrapFiles. This places Skill-controlled content into the agent's bootstrap context without requiring the Skill to be explicitly invoked during each affected session.

There is also a material discrepancy between the TypeScript source and the distributed CommonJS runtime. The TypeScript handler contains the following sub-agent exclusion:

typescript
// Skip sub-agent sessions to avoid bootstrap issues // Sub-agents have sessionKey patterns like "agent:main:subagent:..." const sessionKey = event.s ...[truncated 1857 chars]
Remediation: View remediation
Remediation Suggestions

Do not insert Skill instructions into bootstrap or system-equivalent context by default.

Require an explicit, per-session user action before adding any reminder to agent context.

Prefer a clearly labeled user-visible notification rather than a virtual bootstrap file.

Rebuild handler.js from the reviewed TypeScript source so both implementations enforce identical session restrictions.

Add automated tests verifying that main-session and sub-agent behavior match the documented policy.

Pin the runtime entry point to a generated artifact and verify source/runtime parity in CI.

Clearly display the exact injected content and affected event types before hook activation.

Provide a narrow configuration that limits injection to explicitly selected repositories and session types.

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:346
Finding: Conversation-Derived Rules Can Poison Persistent Agent Memory and Prompt Files
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:346-361
Additional Locations: SKILL.md:23-26, SKILL.md:262-289, hooks/openclaw/handler.js:18-22
Vulnerability Type: Untrusted task content promoted into persistent agent instructions
Risk Level: High

Vulnerable Instructions

markdown
### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups.

The general promotion workflow further instructs the agent to write into persistent behavioral files:

markdown
### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`

Technical Analysis

The Skill treats user corrections, command failures, tool output, and task-derived observations as learning sources. It then directs the agent to promote recurring learning entries into files such as CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, and Copilot instructions. These files are described as agent-context or system-prompt inputs for future sessions.

Recurrence count is not a trust control. An attacker can repeat a malicious instruction across multiple tasks or cause similar entries to be logged until the promotion threshold is met. The workflow does not require:

Human approval of the final diff.

Validation t ...[truncated 1972 chars]
Remediation: View remediation
Remediation Suggestions

Prohibit automatic promotion of conversation-derived content into agent-context or system-prompt files.

Require explicit human approval for every promotion and show the complete proposed diff before writing.

Preserve provenance, including the originating session, user, task, and exact source text.

Treat user messages, command output, external documentation, and cross-session messages as untrusted input.

Reject proposed rules containing imperative instructions, requests to bypass controls, tool-execution directives, secret-handling directives, or references to hidden context.

Restrict automatic learning storage to factual, non-executable notes in a file that is not loaded as prompt context.

Separate behavioral policy from operational notes and allow only trusted maintainers to edit behavioral policy.

Require code-owner review for changes to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, and Copilot instructions.

Add integrity monitoring and version-control review for all persistent prompt files.

Replace recurrence count with a security-aware review process; repetition must not increase the trust assigned to untrusted content.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:167
Finding: Raw Errors, Parameters, and Environment Details May Be Persisted and Committed
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:167-200
Additional Location: SKILL.md:451-459
Vulnerability Type: Insufficient redaction and unsafe persistence of operational data
Risk Level: Medium

Vulnerable Instructions

markdown
### Error Entry Append to `.learnings/ERRORS.md`: ```markdown ## [ERR-YYYYMMDD-XXX] skill_or_command_name **Logged**: ISO-8601 timestamp **Priority**: high **Status**: pending **Area**: frontend | backend | infra | tests | docs | config ### Summary Brief description of what failed ### Error

Actual error message or output

text
### Context - Command/operation attempted - Input or parameters used - Environment details if relevant ### Suggested Fix If identifiable, what might resolve this ### Metadata - Reproducible: yes | no | unknown - Related Files: path/to/file.ext - See Also: ERR-20250110-001 (if recurring) ---

The Skill also presents repository tracking as a standard storage option:

markdown
## Gitignore Options **Keep learnings local** (per-developer): ```gitignore .learnings/

Track learnings in repo (team-wide): Don't add to .gitignore - learnings become shared knowledge.

text
### Technical Analysis Command output, command-line parameters, API errors, stack traces, and environment details frequently contain sensitive information. Examples include access tokens, authorization headers, signed URLs, database connection strings, customer identifiers, internal hostnames, private filesystem paths, and secret-bearing environment variables. The logging format encourages copying the actual error output, attempted command, input parameters, and environment details into a persistent Markdown file. It does not require secret detection, redaction, field allowlisting, retention limits, or approval before the data is saved. The documentation then allows those files to be tracked in source cont ...[truncated 1530 chars]
Remediation: View remediation
Remediation Suggestions

Make .learnings/ local and ignored by default.

Add .learnings/ to the distributed .gitignore guidance as the secure default rather than presenting repository tracking as equivalent.

Explicitly prohibit recording credentials, tokens, cookies, authorization headers, private keys, complete environment-variable values, and signed URLs.

Summarize errors instead of copying complete command output.

Apply automatic redaction for common secret formats before any write.

Use an allowlist for environment metadata; record only non-sensitive fields such as operating-system family or tool version.

Redact command arguments and query strings unless each field has been reviewed.

Add pre-commit and CI secret scanning for learning files.

Enforce file-size and retention limits to reduce unnecessary data accumulation.

If a secret is committed, revoke or rotate it immediately and remove it from the complete repository history and downstream caches.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill is for capturing learnings, failures, corrections, and improved approaches for future reuse. The supplied code does not implement learning capture, error logging, correction tracking, trigger handling, or review of prior learnings. Instead, it is a helper script for creating a new skill scaffold from a learning entry: it validates a skill name, optionally performs a dry run, creates a directory, and writes a templated SKILL.md file. This is a materially different primary purpose and includes undeclared filesystem write capabilities. While the comments mention 'from a learning entry,' the actual behavior is skill extraction/scaffolding, not continuous-improvement recordkeeping itself.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Cross-session transcript access and message passing create a semantic exfiltration channel: one session can read sensitive content from another and propagate it further under the label of a 'learning.' In the context of a memory-sharing skill, this materially increases the blast radius of any sensitive conversation data.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prescribed format explicitly asks for full context, inputs, parameters, environment details, and actual error output, all of which often contain credentials, identifiers, file paths, prompts, or customer data. Because these are written to durable markdown files, a transient mistake can become a long-lived data exposure.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Directing users to modify ~/.claude/settings.json affects the agent's persistent configuration directory, which is security-sensitive because it controls future automated behavior. While documentation alone is not exploitation, recommending changes there for broad hook execution meaningfully raises risk if the scripts are unsafe, modified later, or used in sensitive environments.
Content: Scanner excerpt · references/hooks-setup.md (reported line 48)May include surrounding context.
Option 2: User-Level Configuration

Add to ~/.claude/settings.json for global activation:

json
{

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 177)May include surrounding context.
sessions_send

Send message to another session:

text
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description says to use the skill when a command fails, when a user corrects the agent, when a capability is missing, when an API fails, when knowledge is outdated, or when a better approach is discovered. This covers many ordinary coding-session events without clear boundaries or exclusions, making invocation conditions overly broad for a markdown skill description.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill promotes persistent logging of learnings and cross-session sharing, but provides no data minimization, redaction, or sensitivity-handling rules. That creates a clear pathway for user-provided secrets, internal details, or personal data to be stored durably and redistributed beyond the original context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 79% confidence
Finding: Creating persistent directories under the user's home workspace establishes durable state across sessions, which can retain sensitive operational history indefinitely. Persistence is core to the skill's function, but without retention controls, encryption, or minimization, it increases privacy and data exposure risk.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
└── FEATURE_REQUESTS.md

text
### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are common conversational language and instruct automatic logging without strong gating, which can cause incidental user content to be captured and persisted. In a skill built around durable memory, that increases the risk of over-collection and accidental retention of sensitive information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Telling agents to 'promote aggressively' into persistent memory normalizes retention of conversational content into long-term prompt files, where it may influence future sessions and be harder to audit or delete. This is especially risky because the skill elsewhere encourages broad logging and detailed context capture.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/examples.md (reported line 301)May include surrounding context.
When the above learning is extracted as a skill, it becomes:

File: skills/docker-m1-fixes/SKILL.md

markdown
---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: Placing hook configuration in project-local agent settings establishes persistent behavior that automatically reappears in future sessions. In the context of self-improvement hooks, this persistence makes the automation more dangerous because it silently continues executing unless explicitly removed.
Content: Scanner excerpt · references/hooks-setup.md (reported line 15)May include surrounding context.
Option 1: Project-Level Configuration

Create .claude/settings.json in your project root:

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: An empty matcher causes the hook to trigger on every prompt, creating a broad automatic execution path for the activator script. In an agent environment, this increases exposure, makes unexpected behavior persistent, and amplifies the effect of any bug or future script change.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The user-level configuration installs the hook in ~/.claude/settings.json, making automatic activation apply broadly across sessions and projects without meaningful trigger constraints. This increases blast radius because any issue in the script or hook behavior affects all future agent use, including unrelated repositories and contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The minimal setup still uses an empty matcher, so the supposedly lower-overhead configuration remains broadly triggered on every prompt. That preserves the main risk of unnecessary automatic execution while giving users a false sense that only performance overhead was reduced.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Codex example repeats the empty matcher pattern, causing the activator to run on all prompts in that environment as well. Replicating the same broad trigger across multiple agent platforms normalizes unsafe defaults and widens exposure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document's security section understates the behavior of the referenced scripts by claiming they only output text and do not run commands, while the same guide configures them as command hooks and shows shell execution of an extract script. This can mislead users into granting trust and broad activation to executable components without accurately understanding their capabilities.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: Creating a persistent .learnings/ directory enables session persistence of model observations and user/task details without any documented consent, retention limit, or scoping controls. In the context of a self-improvement skill, this makes accidental long-term storage of sensitive operational context more likely and can compound privacy and prompt-injection risks over time.
Content: Scanner excerpt · references/openclaw-integration.md (reported line 57)May include surrounding context.
openclaw hooks enable self-improvement

text
### 3. Create Learning Files Create the `.learnings/` directory in your workspace:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation instructs users to create persistent .learnings/ storage but does not warn that conversations, failures, corrections, or environment-specific details may be retained across sessions. In a self-improvement skill, this increases the chance of silently storing sensitive data, credentials, internal paths, or user-provided confidential context beyond the immediate task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documented 'Standard Triggers' include very broad conditions such as 'Knowledge gaps' and generic user corrections like 'No, that's wrong...', without defining scope or exclusions. In a markdown integration guide, these ambiguous triggers can overlap with normal conversation and make it unclear when the skill should activate or log learnings versus when it should not.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown template instructs authors to 'Include trigger conditions' but does not require specific trigger phrases, scope limits, or exclusion examples. Because this file is a reusable template, the vague guidance can propagate overly broad invocation descriptions into downstream skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The placeholder 'What this skill does and when to use it' does not instruct authors to make triggers specific or narrow enough to avoid common-speech collisions. In a template file, this omission can result in downstream manifests with ambiguous activation conditions.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Instructions

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Instructions

Remediation Suggestions

SkillSpector

Tp4

Ssd 3

Ssd 3

Agent Config Directory Access

Option 2: User-Level Configuration

Exfiltration Commands

sessions_send

Vague Triggers

Ssd 3

Session Persistence

Vague Triggers

Ssd 3

Skill Enumeration

Session Persistence

Option 1: Project-Level Configuration

Vague Triggers

Vague Triggers

Vague Triggers

Vague Triggers

Intent-Code Divergence

Session Persistence

Missing User Warnings

Vague Triggers

Vague Triggers

Vague Triggers