T02 Β· Agent Memory Poisoning
Warning
- Location
SKILL.md:282- Finding
Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
π ζΊθ½δ½θͺθΏε
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real self-improvement logger, but it needs Review because it can persist conversation-derived learnings into future agent instruction files and broad hooks.
Install only if you want a persistent agent-learning workflow. Keep .learnings project-local, avoid global hooks and empty matchers, do not enable error-output hooks unless command output may be inspected, and require a human-reviewed diff before writing anything into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 Β· Insecure Dependencies
Note
- Location
SKILL.md:49- Finding
Installation Instructions Use Mutable and Unverified Upstream Sources
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description is about recording learnings and corrections after failures or user feedback, implying a memory/logging or review function for continuous improvement. The supplied code instead implements a command-line scaffold generator that creates a new skill folder and template markdown file. While the template mentions extraction from a learning entry, the script does not actually capture learnings, parse learning entries, review past learnings, or handle the listed triggers. Its primary purpose is materially different from the declared purpose, so this is a clear mismatch.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
Directing users to modify ~/.claude/settings.json introduces agent configuration persistence at the user level, affecting all projects and sessions for that account. Because the setting installs command hooks, compromise, misuse, or simple misconfiguration can create a durable execution path that is harder to notice and remove than project-local changes.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sessions_send
Send message to another session:
text sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description says to use the skill whenever a user corrects the agent or requests a missing capability, and includes very common phrases like 'Actually...' as examples. These are broad conversational patterns that can occur in many contexts, increasing the chance of unintended invocation without clearer scope limits or exclusions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The skill instructs creation and use of persistent files under a user home/workspace path, enabling cross-session retention of errors, learnings, and feature requests. Persistent storage is contextually risky for an agent skill because it can accumulate sensitive operational details over time and later expose them to other sessions, tools, or users sharing the environment.
- Content
βββ FEATURE_REQUESTS.md
text ### Create Learning Files ```bash mkdir -p ~/.openclaw/workspace/.learnings
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The automatic detection rules use vague conversational phrases like corrections and capability requests as triggers for persistent logging. In a real agent environment, this can capture routine user messages into durable storage without clear consent, creating privacy risk and possible retention of sensitive business context even if the skill says not to log secrets.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
Creating .claude/settings.json in the project root establishes persistent agent behavior for that repository, which can survive across sessions and affect future users or contributors if checked in or reused. In the context of auto-learning hooks, this persistence increases the chance that reminders or data-processing behavior continues beyond the original debugging need.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An empty matcher on UserPromptSubmit causes the hook to fire for every prompt, greatly broadening exposure to all session content and increasing the chance of unnecessary data handling or prompt-context manipulation. In a self-improvement skill, this is especially sensitive because the hook is designed to capture learnings from user interactions and may process broadly scoped conversational content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The user-level configuration installs the hook in ~/.claude/settings.json, making it persist across projects and sessions while still using an unconstrained matcher. This expands the blast radius from one repository to all future interactions, including unrelated or sensitive work, and can silently process prompts in contexts where the user did not intend the skill to run.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The 'minimal setup' reduces overhead but still configures an empty matcher, so the hook runs on every prompt. This preserves the core over-collection and broad-trigger risk while making it appear safer simply because fewer hooks are enabled.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Codex example repeats the same empty-matcher pattern without any scope limitation, enabling the hook for all prompts in that environment. Reproducing insecure defaults across multiple agent platforms increases the chance of widespread accidental deployment and normalizes unsafe configuration patterns.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide claims the scripts 'only output text' and 'don't modify files or run commands', but the configuration explicitly executes shell scripts via command hooks. This creates a misleading security model: users may trust and enable hooks without understanding that arbitrary shell code will run with the agent's privileges.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The guidance instructs persistent storage of learnings in workspace or skill directories, creating a durable memory channel that can retain sensitive prompts, errors, operational details, or user data across sessions. In a prompt-injection-prone environment that already injects workspace files at session start, persistent notes can become a contamination vector, allowing accidental propagation of untrusted or sensitive content into future sessions.
- Content
openclaw hooks enable self-improvement
text ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'Detection Triggers' section lists very broad conditions such as 'Knowledge gaps', 'API errors', and user corrections like 'No, that's wrong...' without clear scope boundaries or exclusion conditions. In a markdown integration guide, these vague triggers can overlap with common session behavior and make it unclear when the skill should activate versus when it should not.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a skill focused on recording and reviewing learnings for continuous improvement. This script instead creates new skill directories and writes SKILL.md template files, which is a repository scaffolding capability rather than capturing or reviewing learnings themselves.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Creating directories and authoring new markdown skill manifests is a general code/content generation capability. For a skill whose stated purpose is to capture learnings, errors, and corrections, this write-heavy scaffolding behavior is not an obvious or necessary requirement from the manifest alone.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The changelog text on L7 is written entirely in Chinese, which can indicate a language-specific constraint in the skill metadata without any visible opt-in, alternative language, or justification for a region-specific audience. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content