Tmp Self Improving Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:30 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it can save chat-derived details and promote them into persistent agent instructions, so it needs careful review before installation.

Install only if you want persistent learning/memory behavior. Prefer project-local .learnings storage, avoid global always-on hooks, review hook scripts before enabling them, redact secrets and private context before logging, and require explicit human approval before anything is promoted into CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, SOUL.md, TOOLS.md, or a new skill.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:262
• Finding: Untrusted Learning Content Can Be Promoted into Persistent Agent Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:262-289`, `SKILL.md:333-360`, and `SKILL.md:440-448` **Vulnerability Type**: Persistent agent memory poisoning through unsanitized promotion **Risk Level**: High ### Vulnerable Code Snippets From `SKILL.md:262-289`: ```markdown ## Promoting to Project Memory When a learning is broadly applicable (not a one-off fix), promote it to permanent project memory. ### When to Promote - Learning applies across multiple files/features - Knowledge any contributor (human or AI) should know - Prevents recurring mistakes - Documents project-specific conventions ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (OpenClaw workspace) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (OpenClaw workspace) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` From `SKILL.md:333-360`: ```markdown 1. Read `simplify_and_harden.learning_loop.candidates` from the task summary. 2. For each candidate, use `pattern_key` as the stable dedupe key. 3. Search `.learnings/LEARNINGS.md` for an existing entry with that key: - `grep -n "Pattern-Key: <pattern_key>" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: s ...[truncated 3931 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit human approval before every write to `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`, `SOUL.md`, or `TOOLS.md`. 2. Treat user messages, tool output, task summaries, external documentation, and learning files as untrusted data rather than executable agent instructions. 3. Add a promotion review stage that verifies each proposed rule against authoritative project files or documentation. 4. Reject proposed rules containing: - Role or identity changes. - Requests to ignore previous instructions. - Safety-policy overrides. - Automatic command-execution requirements. - Credential or secret-handling directives. - Unreviewed external URLs or installation commands. 5. Store provenance with every learning, including source task, author, timestamp, supporting evidence, and reviewer identity. 6. Replace “Promote aggressively” with a conservative rule requiring verified evidence, clear project relevance, and human authorization. 7. Generate a proposed patch for review instead of directly modifying persistent instruction files. 8. Constrain promoted content to an allowlisted schema of factual project settings and prohibit arbitrary free-form behavioral instructions. 9. Keep untrusted observations in `.learnings/` and clearly mark them as unverified until review is complete. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Mutable and Unverified Remote Sources Are Used for Privileged Hook Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-42` and `SKILL.md:94-103` **Vulnerability Type**: Unpinned supply-chain installation of executable agent hooks **Risk Level**: Medium ### Vulnerable Code Snippets From `SKILL.md:32-42`: ```markdown ### Installation **Via ClawdHub (recommended):** ```bash clawdhub install self-improving-agent ``` **Manual:** ```bash git clone https://github.com/peterskoett/self-improving-agent.git ~/.openclaw/skills/self-improving-agent ``` ``` From `SKILL.md:94-103`: ```markdown ### Optional: Enable Hook For automatic reminders at session start: ```bash # Copy hook to OpenClaw hooks directory cp -r hooks/openclaw ~/.openclaw/hooks/self-improvement # Enable it openclaw hooks enable self-improvement ``` ``` ### Technical Analysis The installation instructions retrieve the skill from a registry or clone the default branch of a remote Git repository without pinning an immutable version, commit hash, signature, or checksum. The documentation then instructs users to copy and enable the package’s hook implementation. Hooks execute in the agent lifecycle and, according to `references/hooks-setup.md:205`, run with the same permissions as the agent environment. Consequently, the effective executable payload depends on the remote content available at installation time rather than the content originally audited. No malicious remote payload was observed in the audited artifact. The vulnerability is the absence of supply-chain integrity controls before locally enabling remotely sourced executable hooks. ### Attack Path 1. An attacker compromises the package registry entry, repository, maintainer account, release process, or default branch. 2. The attacker modifies `hooks/openclaw/handler.js`, a shell script, or another executable package component. 3. A user follows the documented unpinned `clawdhub install` or `git clone` procedure. 4. The user copies the downloaded hook into `~/.openclaw/hooks/self-improvemen ...[truncated 840 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin manual installations to a reviewed immutable commit or signed release tag instead of cloning the mutable default branch. 2. Pin registry installations to an explicit package version and document the expected artifact digest. 3. Publish SHA-256 checksums or signed provenance for every release and require verification before installation. 4. Display and review all executable hook and script files before enabling them. 5. Separate skill documentation installation from executable hook activation so users can inspect the package first. 6. Apply least privilege to hook execution, including filesystem and network restrictions where supported. 7. Add a release manifest listing every executable file and its expected hash. 8. Reverify integrity during upgrades and require approval when hook contents change. 9. Document a rollback and hook-disable procedure for compromised or unexpected releases. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description is about maintaining and using learnings after failures, corrections, outdated knowledge, or improved approaches. The supplied code does not implement any learning-capture or review behavior. Instead, it is a helper utility for extracting/promoting a learning into a new skill by creating a folder and template file on disk. This is a materially different primary purpose and includes undeclared file-creation capabilities. While the script references learnings conceptually, its actual behavior is scaffolding a skill, not capturing or reviewing learnings.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Instructing users to modify ~/.claude/settings.json establishes persistent behavior in a sensitive agent configuration directory. While not inherently malicious, changing global agent config can create durable execution paths for local scripts, so if those scripts are later modified or replaced, every future session may invoke them automatically.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use the skill whenever a user corrects Claude, requests a missing capability, or when a better approach is discovered, which are very broad situations that can occur in many normal interactions. It does not clearly bound when the skill should not activate, increasing the chance of unintended invocation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs agents to persist corrections, errors, and session-derived details to long-term files but gives no upfront privacy or data-handling warning. In practice, this can normalize storing sensitive user content, secrets, or proprietary context in durable memory artifacts without user awareness.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 83% confidence
• Finding: The skill explicitly creates a persistent directory under the user's home workspace, enabling long-lived retention of session-derived data across tasks and sessions. Persistence itself is not malicious, but in the context of this skill's broad logging guidance it materially increases privacy and data-retention risk.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The inter-session communication guidance encourages sharing learnings across sessions, which can propagate user-provided context beyond its original scope. Without minimization, redaction, or access controls, sensitive information can be copied into other agent sessions and become harder to contain or delete.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The logging templates explicitly ask for full context around corrections and learnings, which creates a strong chance of persisting sensitive user data in long-term markdown files. Because these files may later be reviewed, promoted, or shared, a single overbroad entry can lead to durable exposure of confidential information.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The error template directs the agent to store raw error output, inputs, parameters, and environment details, all of which commonly contain secrets such as API keys, paths, hostnames, tokens, cookies, or customer data. Persisting these verbatim into logs materially increases the likelihood of credential leakage and secondary compromise.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Phrases like "Can you also...", "Is there a way to...", and correction snippets such as "Actually..." are common in ordinary chat and are not specific enough to safely signal this skill. The section presents them as automatic logging triggers without negative examples or contextual constraints.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The recommendation to 'promote aggressively' into persistent memory files expands the blast radius of any sensitive information captured earlier. Once copied into broader agent context files, the data may influence future sessions and be exposed repeatedly, making remediation and deletion much more difficult.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 82% confidence
• Finding: The guide creates persistent hook configuration in agent settings, causing the behavior to survive across sessions and continue running without fresh user review. Persistence is security-relevant here because the feature executes local scripts automatically, so an initially accepted configuration may become unsafe later if surrounding files change.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: An empty matcher causes the hook to fire on every prompt, creating pervasive interception of user interactions and maximizing the blast radius of any bug, prompt injection, or future script change. In a self-improvement skill, this broad trigger is especially risky because it normalizes always-on capture across all work rather than limiting activation to error-handling or debugging contexts.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Using an empty matcher in a user-level configuration enables the hook across all sessions and repositories, turning a local convenience feature into persistent global behavior. That increases exposure to sensitive prompts, unrelated projects, and accidental cross-context data capture, while also making malicious or unsafe script modifications far more impactful.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The Codex CLI example repeats the same always-match behavior, broadening execution to every prompt in another agent environment. Cross-tool propagation of an unrestricted hook increases the chance that sensitive or irrelevant sessions are affected and makes the pattern easier to copy without understanding the security implications.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The document's security section is misleading: the configured hooks are executed as shell commands, so the scripts necessarily run as commands even if their intended behavior is only to print text. This can cause operators to underestimate the execution and trust boundary, increasing the chance they enable unreviewed scripts with the agent's privileges.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 90% confidence
• Finding: The file recommends creating persistent learning storage in either the workspace or installed skill directory, encouraging long-lived retention of agent-generated memory. In the context of a self-improvement skill that captures failures, corrections, and learnings, this can accumulate sensitive operational context and make prompt-injection residue or confidential data persist across sessions.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a self-improvement skill focused on recording learnings, errors, corrections, and reviewing those learnings before major tasks. This script instead scaffolds a new skill directory and writes a SKILL.md template, which is a skill-generation workflow rather than a learning-capture or learning-review operation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Creating directories and generating a new SKILL.md template is a repository authoring capability. That capability is not an obvious requirement of a skill whose stated purpose is to capture corrections and failures for continuous improvement.

Ssd 3

Low

• Confidence: 90% confidence
• Finding: Recording detailed user context for feature requests can preserve private business plans, internal workflows, or personal information in durable files. While less immediately dangerous than logging secrets, it still creates confidentiality and privacy risk through unnecessary retention.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This markdown file includes filesystem-modifying commands (`cp -r` into `~/.openclaw/skills/` and `~/.openclaw/hooks/`) but does not warn that they change the user's local OpenClaw installation and may overwrite existing skill or hook directories. For markdown files, SQP-2 applies when descriptions omit warnings about behavior that could affect user data or system integrity.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The guide explicitly tells users to create persistent `.learnings/` storage but does not warn that model outputs, user prompts, errors, or other session-derived content may be written to disk indefinitely. In a self-improvement skill, that increases the chance of sensitive data retention and later unintended disclosure, especially because the feature is framed as routine workflow.

Static analysis

No suspicious patterns detected.