T02 · Agent Memory Poisoning
Error
- Location
scripts/promote-learning.mjs:14- Finding
Unreviewed Text Can Be Appended to Persistent Agent Instruction Files
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Self-Improvement
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent local self-improvement purpose, but it can append arbitrary text to persistent agent instruction files and has insufficient path controls around repair-ticket writes.
Install only if you trust operators to manually review every promotion before running it. Treat writes to AGENTS.md, TOOLS.md, and SOUL.md as privileged policy changes, prefer dry-run plus manual diff review, and avoid using untrusted progress reports, dates, ticket directories, or OBSIDIAN_LEARNINGS_DIR values.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/harness-improvement-lib.mjs:153- Finding
Unvalidated Repair-Ticket Components Permit Writes Outside the Intended Directory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Always review promotion targets first, or run `scripts/promote-learning.mjs ... --dry-run`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 1. Scan logs and receipts with `scripts/analyze-openclaw-failures.mjs`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. Generate same-day agent scorecard with `scripts/daily-agent-scorecard.mjs`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 2. Generate same-day agent scorecard with `scripts/daily-agent-scorecard.mjs`.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - receipts are missing or too thin - back-end fixes never reach the operator-facing surface - code-ready states get confused with production-ready states - teams add new rules without checking whether those rules actually reduce failure OpenClaw Self-Improvement gives you a lightweight operating loop for fixing that.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares environment variable usage and file-writing behavior but does not define an explicit tool/permission scope such as allowed-tools or permissions. That weakens least-privilege controls and can let an agent invoke broader capabilities than operators expect, especially since the skill can modify durable governance files like AGENTS.md, TOOLS.md, SOUL.md and an externally configurable OBSIDIAN_LEARNINGS_DIR path.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The scorecard date is generated with a hard-coded Swedish locale (
sv-SE) andAsia/Shanghaitime zone. This imposes a specific locale/time-zone behavior in code without offering user choice or documenting a justified region-specific constraint.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The script accesses environment variables such as WORKSPACE and HOME to determine where experiment logs will be stored. There is no explanatory comment or warning that execution depends on these environment values and may write under a user-specific directory.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This script performs a persistent file write by appending experiment data to a markdown file in the workspace. Although the filename is printed afterward, there is no prior user-facing warning, confirmation, comment, or docstring disclosing that running the script will modify local files.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script appends content to a workspace file via fs.appendFileSync, which modifies user data on disk. Aside from printing the resulting path after the write, there is no prior warning, confirmation, comment, or docstring disclosing that the command will create and update files under the workspace.
- Content
Static analysis
No suspicious patterns detected.