continuous-learning

name	continuous-learning
description	After completing a penetration test engagement - When encountering a novel attack technique or defense - After a tool produces unexpected results - When identifying recurring patterns across targets - User says "learn", "remember this", "pattern.
origin	openclaw
version	0.2.0.2
compatibility	["openclaw","claude-code","cursor","windsurf"]
allowed-tools	["Bash","Read","Write","Edit","WebSearch","WebFetch","Agent"]
defense_triple_required	false
metadata	{"domain":"knowledge","tool_count":9,"guide_count":5,"last_reviewed":"2026-07-26"}

Continuous Learning

Summary

Continuous Learning skill domain covering knowledge operations.

Tools: High, Medium, Low, Negative, Attack Patterns, Defense Patterns, Tool Behaviors, Environment Patterns (+1 more)

Domain: knowledge

Use Cases

1. Post-Engagement Learning — After a penetration test, extract reusable patterns from observations and tool outputs
2. Cross-Session Knowledge Building — Accumulate tool behavior knowledge across multiple engagements into structured entries
3. Pattern Recognition — Identify recurring vulnerabilities, tool limitations, and effective technique combinations
4. Knowledge Confidence Tracking — Assign and update confidence scores for learned facts based on corroboration frequency
5. Memory Layering — Distill raw observations into layered knowledge: immediate notes → verified patterns → core principles

Activation

• After completing a penetration test engagement
• When encountering a novel attack technique or defense
• After a tool produces unexpected results
• When identifying recurring patterns across targets
• User says "learn", "remember this", "pattern", "lesson learned"

Learning Cycle

┌──────────┐    ┌───────────┐    ┌───────────┐
│ Pattern  │───→│ Extract & │───→│ Confidence │
│ Detection│    │ Structure │    │  Scoring  │
└──────────┘    └───────────┘    └───────────┘
                                        │
┌──────────┐    ┌───────────┐    ┌───────┴───┐
│ Cross-   │←──│  Memory   │←──│  Storage  │
│ Reference│    │ Retrieval │    │           │
└──────────┘    └───────────┘    └───────────┘

Step 1: Pattern Detection

Identify learnable patterns from observations:

Pattern Category	What to Look For
Attack Patterns	Successful exploitation techniques, unexpected bypasses
Defense Patterns	WAF rules detected, IDS triggers, rate limiting behaviors
Tool Behaviors	Tools that produced false positives, missed findings, gave unusual output
Environment Patterns	Common misconfigurations, typical network architectures
Engagement Patterns