Security audit

Self Improvement

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it asks agents to save conversation and error details and promote them into persistent instruction files with weak redaction and approval controls.

Install only if you are comfortable with agents writing persistent learning files. Keep .learnings local by default, redact secrets and personal or customer data before any entry is written, review diffs before committing learning files, and require explicit trusted-owner approval before anything is promoted into agent instruction files. Prefer a pinned, reviewed source instead of the unpinned npx install command, especially in CI.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:258
Finding: Untrusted Conversation Content Can Be Promoted into Persistent Agent Instructions
Content: View full analysis
= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` - `SOUL.md` / `TOOLS.md` for openclaw workspace-level guidance when applicable Write promoted rules as short prevention rules (what to do before/while coding), not long incident write-ups. ``` Related instructions increase the risk: ```markdown | Broadly applicable learning | Promote to `CLAUDE.md`, `AGENTS.md`, and/or `.github/copilot-instructions.md` | | Behavioral patterns | Promote to `SOUL.md` (openclaw workspace) | ``` ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The skill establishes a workflow in which information derived from conversations, user corrections, errors, and recurring observations can be transformed into instructions stored in persistent agent-context files. Files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, and `.github/copilot-instructions.md` may be loaded by agents in later sessions and influence their behavior. The recurrence threshold is not a security boundary. An attacker or untrusted user can repeat a crafted statement across multiple tasks until it qualifies for promotion. The instructions do not require trusted provenance, repository-owner approval, security review, or validation that the promoted text contains only non-imperative project facts. The direction to “promote aggressively” further weakens human review expectations. Consequently, attacker-influenced co ...[truncated 1377 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Installation Instructions Retrieve an Unpinned Third-Party Skill
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:88
Finding: Raw Errors, Inputs, and Environment Details May Be Persisted Without Redaction
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The install command uses npx skills add ... without pinning a specific package/version, which makes the fetched code mutable over time and exposes users to supply-chain compromise if the upstream package, tag, or resolution path is altered. In a skill installation context, this is more dangerous because users are encouraged to execute the command directly from documentation with little verification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The CI install command also uses an unpinned npx skills add ... invocation, allowing the resolved package/code to change between runs. In CI, this risk is amplified because automated environments may execute the command at scale and with elevated repository credentials or deployment access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs agents to record user corrections, requests, and task context into persistent markdown files without any minimization or privacy warning. This can cause unnecessary retention of user-provided data, including sensitive business context or personal information, especially when the .learnings directory may later be committed or promoted into broader project memory.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: These instructions normalize persisting user-provided corrections, requests, context, and derived learnings into local files and even promoting them into shared memory files like CLAUDE.md or repo instructions. The skill context makes this more dangerous because it turns ephemeral conversation data into durable, potentially version-controlled artifacts that may be visible to teammates, future agents, or external systems.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The logging templates explicitly encourage storing raw error output, inputs, parameters, and environment details, which are frequent carriers of secrets and sensitive operational data. Because the storage format is plain markdown, the data is easy to leak via source control, local indexing, support bundles, or later automated processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The error template asks for raw error messages, command inputs, parameters, and environment details, all of which commonly contain secrets such as tokens, file paths, internal URLs, and customer data. Persisting these verbatim to markdown creates a durable leakage path and can expose sensitive material through commits, sharing, backups, or later agent processing.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The automatic detection triggers tell the agent to log broad categories of user-provided information, including things it 'didn't know' and feature-request context, creating a wide net for conversational data capture. This is risky because the trigger conditions are subjective and can lead to routine retention of unnecessary user content without consent or sensitivity review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: An empty matcher causes the hook to run on every prompt, which broadens collection and persistence behavior far beyond narrowly scoped self-improvement events. In this skill, that means routine user interactions may be continuously evaluated for logging, increasing privacy risk and the chance of over-collection.
Content: No source excerpt is available for this finding.