T02 · Agent Memory Poisoning
Error
- Location
log_correction.py:17- Finding
Persistent Agent Memory Poisoning Through Unvalidated Corrections and Fixes
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent CN
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed self-improvement memory system, but it automatically stores and reuses user corrections and command failures in ways that can persistently change future agent behavior without enough user control.
Review this skill carefully before installing. It is not showing remote execution or hidden exfiltration, but it can persist user text, command failures, and suggested fixes into long-term memory and agent instruction files. Only use it if you are comfortable with automatic memory writes, and avoid letting it save secrets, raw command lines, or sudo-based fixes without explicit review.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
log_error.py:18- Finding
Sensitive Command and Error Data Stored in Plaintext Without Enforced Redaction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill describes persistent reads and writes to user and project files such as ~/.openclaw/memory/self-improving/, .learnings/, AGENTS.md, and MEMORY.md, but it declares no explicit tool scope or permission boundary. That creates an authorization ambiguity where an agent may perform file operations broader than the user expects, increasing the chance of unintended persistence or modification of sensitive local content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description and all operational instructions are presented only in Chinese, which effectively forces a specific language for use of the skill. The file does not indicate that this is an opt-in locale choice or a region-specific tool, so it conflicts with the language-choice policy.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
This repeated finding points to the same session-persistent memory design. In a skill that automatically captures corrections and best practices, indefinite local storage increases the chance of stale guidance, privacy leakage, and hidden cross-session influence on future actions.
- Content
bash # 创建记忆目录 mkdir -p ~/.openclaw/memory/self-improving # 使用本skill cat ~/.openclaw/skills/self-improving-agent/SKILL.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
This repeated finding points to the same session-persistent memory design. In a skill that automatically captures corrections and best practices, indefinite local storage increases the chance of stale guidance, privacy leakage, and hidden cross-session influence on future actions.
- Content
bash # 创建记忆目录 mkdir -p ~/.openclaw/memory/self-improving # 使用本skill cat ~/.openclaw/skills/self-improving-agent/SKILL.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
mkdir -p ~/.openclaw/memory/self-improving
使用本skill
cat ~/.openclaw/skills/self-improving-agent/SKILL.md
text ## 使用方法
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The documented fix for permission errors includes 'use sudo', encouraging privilege escalation as a normal remediation path. In a self-improving memory system, persisting that suggestion can cause future runs to recommend or prefer elevated execution without validating necessity, increasing the blast radius of mistakes or malicious package installs.
- Content
python3 ~/.openclaw/skills/self-improving-agent/log_error.py
--command "npm install xxx"
--error "permission denied"
--fix "use sudo or check permissions"text ### 2. 记录用户纠正
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Automatically recording user corrections into long-term memory creates a durable repository of user-provided text without a clear approval step. Because corrections often contain preferences, identifiers, internal context, or policy guidance, indiscriminate retention can expose sensitive information and shape future outputs in unintended ways.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The memory example stores and re-surfaces a recommendation to switch to sudo when npm install fails. Because the skill reuses persisted memories before execution, this can operationalize privilege escalation advice across future tasks and contexts where it may be unsafe or unnecessary.
- Content
输出示例：
text ⚠️ 发现相关记忆: [错误] 2026-03-05: npm install 权限失败 → 改用 sudo 或在用户目录安装 [纠正] 2026-03-04: 项目使用单引号而非双引号
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The auto-trigger phrases for user corrections are broad natural-language patterns such as '不对', '错了', and '应该', which commonly appear in normal conversation. This can cause the agent to incorrectly treat ordinary dialogue as durable preference updates and persist inaccurate or sensitive content into long-term memory.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The best-practice capture triggers like '更好的', '更高效', and '最优' are subjective and context-free, so the skill may persist casual suggestions or speculative statements as authoritative long-term guidance. This can poison future behavior across sessions and projects, especially if later actions are automatically influenced by these entries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill states that important memories are automatically synchronized into global storage, the current project, AGENTS.md, and MEMORY.md, but it does not present a clear upfront warning or consent model for this persistence. Users may unknowingly have preferences, corrections, or contextual information written into shared or version-controlled files, creating privacy and integrity risks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs propagation of user corrections and preferences into cross-project and project-local persistent files, including AGENTS.md and MEMORY.md. This normalizes long-term retention and reuse of plain-language user data, which can leak sensitive instructions, personal preferences, or project context into unrelated workspaces or version control.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The example workflow says the AI should automatically switch to 'sudo npm install -g xxx' after a previous permission failure. This is more dangerous than a passive mention because it frames privileged execution as an autonomous next action, which could install untrusted packages system-wide or magnify supply-chain compromise.
- Content
md **AI动作**: 1. 记录错误到 `errors.jsonl` 2. 下次执行前检查记忆 3. 自动改用: `sudo npm install -g xxx` 或本地安装 ### 场景3：发现更好做法
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language strings that assume Chinese as the required language for descriptions and runtime messages. Under the policy, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module description is entirely in Chinese and states the tool's purpose in Chinese, while all user-facing help and output strings in the file also use Chinese. This indicates a fixed language choice without offering user opt-in or documenting a justified region-specific constraint, which matches the locale-policy concern for natural-language content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains natural-language strings in Chinese in the module docstring and later user-facing messages, but provides no opt-in or indication that the skill is intentionally region-specific. Under the language/locale policy, forcing a specific language without user choice is a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language description is entirely in Chinese, which imposes a specific language/locale in the skill metadata without any user opt-in or explanation that the skill is intended only for a Chinese-speaking or region-specific context. This matches the policy category for language or locale constraints that are not optional or justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring is entirely in Chinese, and the CLI help/output strings elsewhere in the file are also Chinese-only. This imposes a specific language on users without offering a choice or documenting a justified locale constraint, which matches the language/locale policy violation category.
- Content
Static analysis
No suspicious patterns detected.