Security audit
Security checks for vulnerabilities and agentic risk
The skill’s local learning records, optional error-capture hook, and updates to future guidance are disclosed and consistent with its purpose.
Install if you want the agent to retain lessons and update workspace guidance that affects future sessions. Enable the optional hook only if you want ended-session transcript scanning. Keep learning logs private because redaction can miss sensitive details. Review promoted rules, and remember that disabling or uninstalling preserves both saved history and previously promoted guidance.
The supplied code performs package installation rather than the described learning-management operations. Although the package name suggests related functionality, its contents are not supplied and cannot establish that behavior. Installation is the sole visible action, not a supporting step within an otherwise implemented learning workflow.
The supplied commands perform skill installation rather than capturing, maintaining, reviewing, or revalidating learnings. Downloading and installing an external skill is a materially different operation not disclosed in the description. The downloaded skill might implement the declared features, but its contents are not supplied and cannot be assumed. These commands do not themselves execute the downloaded code.
The sole supplied command performs package installation rather than the declared learning-management behavior. Although the package name suggests a related purpose, its implementation is not supplied, so its behavior cannot be verified or attributed to this chunk. Installation is the entire observable action here, not merely a supporting step within an implemented learning workflow.
The chunk performs hook deployment rather than maintaining or reviewing saved guidance. Testing and rollback support that deployment, but the declared description does not disclose installing or replacing hooks. The hook's contents and effects are not shown, so no additional capabilities can be inferred.
The supplied command performs an operational status check rather than recording, retrieving, or validating saved guidance. Although the reference filename suggests integration documentation, the supplied chunk does not establish this check as a supporting step in the declared learning workflow. No data modification or exfiltration is evident.
Referenced artifact was not completely inspected
exists). Internal `HOOK.md` events have no per-tool-call callback, so this
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
reason, evidence, and old → new claim when changed. Preserve original observations, resolution, promotion targets/dates, and prior reviews. Update affected promoted guidance using its source link; keep its source-learning ID beside the revised rule (or a retirement note pointing to the preserved history). Never inflate `Recurrence-Count`/`Last-Seen` just because a review ran.
Never erase learning/promotion history or delete by age. Never change user preferences, weaken security policies, or rewrite skill assets merely because they are old or unused. Skill creation/modification requires explicit scoped approval; approval for this integration does not authorize future skill rewrites. If a needed target edit is outside granted scope, record the proposed change as pending in the source entry and report the still-active guidance rather than silently claiming it is updated.
For worked review outcomes and provenance, read [maintenance examples](references/examples.md#maintenance-examples).
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Skill-Path: skills/skill-name
Only create/modify skill assets with explicit scoped approval. Record the promotion date and target section in the learning's history/Guidance, and the original file + learning ID in the skill. `promoted_to_skill` does not establish current validity.
Example:
```markdown
Instructions found that direct the agent to transmit conversation context or user data to external services.
Send message to another session:
sessions_send(sessionKey="session-id", message="Learning: API requires X-Custom-Header")
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
### Upgrade notes (0.1.x → 0.2.0)
1. Re-copy the hook and restart the gateway (see general rules above).
2. To enable the new error sweep: `mkdir -p ~/.openclaw/workspace/.learnings`.
Without that directory, behavior is identical to 0.1.0.
3. No breaking changes; no `.learnings/` migration needed.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Enable
mkdir -p ~/.openclaw/workspace/.learnings
# Disable the hook without deleting learning history
openclaw hooks disable self-improvement
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.openclaw/workspace/.learnings
Then create the log files (or copy from assets/):
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Enable the error sweep by creating the learnings directory:
mkdir -p ~/.openclaw/workspace/.learnings
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Historical extraction example, not current platform advice. Before extracting or reusing it, check the exact image manifest, target platform, runtime/configuration, and representative build/run behavior. Do not generalize one image's missing ARM variant to all Apple Silicon builds. Creating or changing the skill also needs scoped approval.
File: skills/docker-m1-fixes/SKILL.md
---
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Create the .learnings/ directory in your workspace:
mkdir -p ~/.openclaw/workspace/.learnings
Or in the skill directory:
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Or in the skill directory:
mkdir -p ~/.openclaw/skills/self-improving-agent/.learnings
These conditions do not define what qualifies as a knowledge gap or an unexpected model behavior worth capturing. Unlike the concrete command-failure trigger, they could activate learning capture for routine uncertainty or harmless response variation; validation before promotion does not constrain initial capture.
No suspicious patterns detected.