Self Improving Agent 3.0.16

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it persistently stores conversation-derived learnings and can promote them into future agent instruction files without enough review controls.

Install only if you want an agent to keep durable learning logs. Before enabling hooks or promotion, require review of every entry, redact sensitive content, keep .learnings local by default, and approve the exact text before anything is written to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:366
• Finding: Conversation-Derived Learnings Can Be Promoted into Persistent Agent Instructions Without Trust Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:366-381` **Additional Locations**: `SKILL.md:40-43`, `SKILL.md:282-309`, `SKILL.md:463-468`, `hooks/openclaw/handler.js:30-33`, `hooks/openclaw/handler.ts:31-34` **Vulnerability Type**: Persistent agent-memory poisoning **Risk Level**: Medium ### Vulnerable Code and Instructions `SKILL.md:366-381`: ```markdown ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for OpenClaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` `SKILL.md:463-468`: ```markdown 1. **Log immediately** - context is freshest right after the issue 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` `hooks/openclaw/handler.js:30-33`: ```javascript **Promote when pattern is proven:** - Behavioral patterns → \`SOUL.md\` - Workflow improvements → \`AGENTS.md\` - Tool gotchas → \`TOOLS.md\` ``` The TypeScript source contains the equivalent instructions at `hooks/openclaw/handler.ts:31-34`. ### Technical Analysis The Skill accepts conversation-derived information—including user corrections, claimed knowledge gaps, errors, and suggested workflow improvements—as learning input. It then instructs the agent to promote selected learning content into files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.githu ...[truncated 3527 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before every promotion into an agent-context file. Show the exact target path and exact proposed text before writing it. 2. Treat all conversation-derived learnings as untrusted data. Repetition or recurrence must not be considered a trust signal. 3. Remove the instruction to “promote aggressively” and make non-promotion the default. 4. Introduce a review queue so entries remain in `.learnings/` until a trusted maintainer approves them. 5. Record provenance for every candidate, including source session, author or requester, creation date, related tasks, reviewer, and approval timestamp. 6. Reject promotion candidates that attempt to: - Override system or user instructions. - Weaken security, authorization, or confidentiality controls. - Expand tool permissions or data-access scope. - Require unverified command execution. - Suppress warnings, review, or user confirmation. - Exfiltrate transcripts, credentials, environment data, or source content. 7. Use a structured, allowlisted rule schema rather than copying free-form text into persistent instruction files. 8. Keep project facts and behavioral instructions separate. Prefer promoting verifiable facts, such as a package manager or build command, rather than open-ended behavioral rules. 9. Add duplicate, conflict, and policy checks before promotion, and prevent new rules from overriding higher-priority security guidance. 10. Provide an audit log and rollback mechanism for all changes to persistent agent-context files. 11. Require code review when promoted files are tracked in version control. 12. Update the bootstrap reminder to state that promotion is prohibited without explicit user approval and security validation. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as a note-taking and review mechanism, but it also instructs the agent to create directories/files, configure hooks, and scaffold new skills. That mismatch matters because users or orchestrators may activate it expecting passive logging behavior while it performs persistent workspace modifications, increasing the chance of unintended file writes and trust boundary confusion.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### Option 2: User-Level Configuration

Add to `~/.claude/settings.json` for global activation:

```json
{

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Exfiltration Commands

High

• Category: Prompt Injection

Content

### sessions_send

Send message to another session:
```
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation description is broad enough to trigger during many normal conversations, such as routine corrections, requests, or tool failures. In this skill, activation leads to persistent logging and possible propagation into workspace memory files, so overbroad triggering can cause silent accumulation of user content and unintended state changes.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── FEATURE_REQUESTS.md
```

### Create Learning Files

```bash
mkdir -p ~/.openclaw/workspace/.learnings

• Confidence: 82% confidence
• Finding: The skill directs creation of persistent files under `~/.openclaw/workspace/.learnings`, enabling retention of session-derived information across sessions. Even though the document cautions against storing secrets, this still expands the persistence surface and can leak behavioral, project, or user context into future sessions if used without strict consent and sanitization.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Automatically treating common correction phrases as a logging trigger is risky because such phrases occur frequently in normal interaction and may include sensitive or contextual information. In this skill, that broad trigger directly causes persistent storage of conversation-derived content, creating privacy and data minimization issues.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases for feature requests are common conversational language and are not sufficiently scoped to distinguish casual discussion from an instruction to persist data. Because the skill records these events to disk, this can turn ordinary chat into durable storage without meaningful user awareness.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

When the above learning is extracted as a skill, it becomes:

**File**: `skills/docker-m1-fixes/SKILL.md`

```markdown
---

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 1: Project-Level Configuration

Create `.claude/settings.json` in your project root:

```json
{

• Confidence: 84% confidence
• Finding: The guide instructs users to install persistent hooks that automatically execute scripts on every prompt submission and after Bash tool use. Even though presented as opt-in and benign, this creates session persistence and expands the execution surface across future interactions; if the scripts are modified, replaced, or overly trusted, they can continuously influence agent behavior and potentially expose sensitive tool output.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw hooks enable self-improvement
```

### 3. Create Learning Files

Create the `.learnings/` directory in your workspace:

• Confidence: 78% confidence
• Finding: The guidance instructs persistent storage of '.learnings/' in the workspace or skill directory, creating a durable memory channel that can survive across tasks and sessions. In the context of a self-improvement skill and OpenClaw's prompt-injection workspace model, persistent memory can accumulate sensitive data or attacker-planted instructions that later get reintroduced as trusted context.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list is broad and operationally underspecified, so routine failures, vague 'knowledge gaps,' or ambiguous user feedback could cause the skill to log and retain excessive information. In a system that writes learnings to persistent workspace files and can later promote them into injected prompt context, over-activation increases the risk of storing sensitive or adversarial content that influences future sessions.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Using a common phrase like 'No, that's wrong...' as a standard trigger without stronger validation allows normal conversation patterns or adversarial phrasing to activate the learning path. Because this skill is specifically designed to persist corrections, an attacker or casual user could seed misleading or malicious 'learnings' that later appear as trusted context.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Allowing --output-dir and then creating directories/files under that path implements a general project scaffolding capability. For a skill whose declared purpose is continuous improvement via learnings and corrections, repository file-generation for new skills is not an obvious or necessary requirement.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes a skill focused on recording learnings, corrections, failures, and reviewing them before major tasks. This script instead creates a new skill directory and writes a SKILL.md template, which is a repository scaffolding capability rather than a direct implementation detail of capturing learnings.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The documentation frames the script as extracting or creating a skill from an existing learning entry. In practice, the script neither reads .learnings/LEARNINGS.md nor parses any learning content; it only writes a template containing TODO placeholders and a hardcoded reference to the learnings file.

Static analysis

No suspicious patterns detected.