self-improving-agent
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on shell scripts (activator.sh, error-detector.sh, extract-skill.sh) to automate task reminders, detect errors in tool output, and scaffold new skills. These scripts perform file system operations like mkdir and printf to manage the .learnings/ directory.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from tool outputs and user feedback.
- Ingestion points: scripts/error-detector.sh reads the CLAUDE_TOOL_OUTPUT environment variable; SKILL.md instructs the agent to capture user corrections and knowledge gaps.
- Boundary markers: The instructions recommend using short summaries or redacted excerpts rather than raw transcripts, and the hooks use specific XML-like tags ().
- Capability inventory: The skill can execute shell scripts, write to the file system, and use OpenClaw tools for cross-session communication (sessions_send).
- Sanitization: The instructions explicitly advise the agent to avoid logging secrets, tokens, or environment variables.
- [DYNAMIC_EXECUTION]: The scripts/extract-skill.sh script dynamically generates new skill directories and SKILL.md files based on a predefined template and user-provided skill names, which facilitates the creation of new executable content within the workspace.
- [EXTERNAL_DOWNLOADS]: Installation instructions suggest downloading the skill or its source via git clone from a GitHub repository (github.com/peterskoett/self-improving-agent.git).
Audit Metadata