Self-Improving Proactive Decision Making Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:32 AM UTC
• Version: 1.0.0

Overview

This decision-support skill is useful and mostly coherent, but it persistently profiles decision habits and asks to modify global agent steering files, so it belongs in Review before installation.

Install only if you want a local, persistent decision profile. Review the proposed SOUL.md, AGENTS.md, and HEARTBEAT.md edits carefully, consider skipping global steering integration, and periodically inspect or delete ~/decision-making/ if it contains sensitive personal or business decisions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:111
• Finding: Persistent Agent Steering Through Global Control-File Modification<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:111-162` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: Medium ### Vulnerable Code ```markdown ### 5. Add SOUL.md Steering Add this section to your `SOUL.md`: ```markdown **Decision Making** Structured decision support is part of the job. Before any decision request, load `~/decision-making/memory.md` and the smallest matching domain or type file. Apply the user's preferred framework unless the situation clearly calls for something different. Always tag confidence level. Never make the final call — present options and tradeoffs. Surface decision points proactively when you notice the user weighing choices without structure. After high-stakes decisions, prompt for a retrospective when results are visible. ``` ### 6. Add AGENTS.md Memory Section (Non-Destructive) Update `AGENTS.md` by complementing the existing `## Memory` section. Do not replace or remove existing lines. Add this line in the continuity list: ```markdown - **Decision making:** `~/decision-making/` (via `decision-making` skill) — decision preferences, risk profile, framework choices, decision history, and retrospective lessons ``` After "Capture what matters...", add: ```markdown Use `~/decision-making/memory.md` for risk profile and framework preferences (HOT, always loaded). Use `~/decision-making/domains/` for domain-specific decision weights and patterns. Use `~/decision-making/types/` for decision-type patterns (strategic/tactical/operational). Use `~/decision-making/decisions/` for individual decision records and retrospectives. Before any decision support task, load memory.md, then the smallest relevant domain + type files. ``` ### 7. Add HEARTBEAT.md Steering Add this section to your `HEARTBEAT.md`: ```markdown ## Decision Making Check - Read `./skills/decision-making/heartbeat-rules.md` - Use `~/decision-making/heartbeat-state.md` for last-run markers - If no file inside `~/decision-making/ ...[truncated 2920 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove instructions that directly modify `SOUL.md` and `AGENTS.md`. Keep operational behavior inside `SKILL.md` so it is active only when the skill is deliberately loaded. 2. Make heartbeat integration disabled by default and expose it as a separate, explicit opt-in feature. 3. Before changing any global control file: - Display the exact target path and proposed patch. - Explain the resulting cross-session behavior. - Obtain explicit user confirmation for each file. - Create a backup or reversible patch record. 4. Scope all mutable state to `~/decision-making/`; do not place skill-owned behavioral rules in general agent memory. 5. Add an uninstall procedure that removes every inserted block from `SOUL.md`, `AGENTS.md`, and `HEARTBEAT.md` without affecting unrelated content. 6. Mark inserted sections with stable start and end delimiters so they can be audited and removed safely. 7. Require explicit confirmation before proactive prompts, recurring maintenance, compaction, or archival operations are enabled. 8. Validate that loaded memory is treated as user data rather than higher-priority instructions, preventing stored content from overriding system or safety constraints. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The user-facing description says the agent 'learns your decision style, risk profile, and framework preferences over time' but does not clearly warn that this information is stored persistently across interactions in local files. That omission undermines informed consent, especially because the stored data can reveal behavioral tendencies, priorities, and decision history that many users would reasonably consider sensitive.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation conditions are broad enough to trigger on routine phrases like 'what do you think' or any implicit tradeoff, which can cause the skill to engage and begin memory-related behavior outside a clearly bounded decision-support context. In a skill that persists user preferences over time, overbroad activation materially increases the chance of collecting or surfacing personal behavioral data without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The automatic learning triggers are generic conversational statements that commonly occur in ordinary dialogue, yet they instruct the agent to update persistent files like memory.md, frameworks.md, and domain files. This creates a privacy and scope-control risk because the skill may infer and store durable preference or risk-profile data from ambiguous, one-off statements without robust consent or contextual validation.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: This section directs the agent to automatically learn, persist, and later use user decision preferences and risk-profile information derived from conversation. Even though the intent is personalization, the behavior creates a durable profile from conversational signals, which can expose sensitive behavioral inferences and exceed user expectations if done automatically.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The proactive template instructs the agent to reference stored past preference data without the user first requesting retrieval in the current interaction. Surfacing prior memory unprompted increases the chance of unwanted disclosure to someone viewing the conversation and may feel invasive even if the data is accurate.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The quick-query behaviors allow direct printing or summarization of persistent memory such as risk profile, preferences, and decision history. While useful for transparency, these retrieval paths can disclose sensitive long-term profiling data too readily if invoked casually, ambiguously, or in a shared environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Financial specifics | Card numbers, bank accounts, exact salaries | Fraud / privacy risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Other people's preferences, decisions, constraints | No consent obtained |
| Location patterns | Home/work addresses, travel routines | Physical safety |

## Store with Caution

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger condition 'User revisits a past decision by name or date' is broad enough to activate on ambiguous references that may not reflect actual intent to begin a retrospective. In a memory-bearing, proactive agent, this can cause unsolicited retrieval and follow-up about prior decisions, increasing the risk of privacy-invasive prompting, mistaken context carryover, and user confusion in high-stakes domains.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Allowing the agent to trigger a retrospective when it 'notices a contradiction between a past decision and new information' delegates activation to a subjective model judgment with no objective threshold. In a self-improving agent that updates memory and patterns over time, this can lead to hallucinated contradictions, unwanted memory edits, and proactive interventions based on incorrect inferences.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Generalizing risk profile from high-pressure decisions (constraints skew behavior)
- Over-indexing on recency (last decision ≠ always right rule)
- Applying domain weight to wrong domain silently
- Confirming a preference without asking after 3 signals

---

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The template explicitly states that a file will be created in the user's home directory and then used and updated over time, but it does not present a clear upfront warning, consent step, or controls for persistent storage. Persistent writes in a home directory can expose sensitive preference data, create privacy surprises, and normalize silent statefulness across sessions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill stores inferred preferences, behavioral signals, and confirmed rules, but the template does not include a clear privacy disclosure describing this collection and retention. Because the skill is designed to learn decision style over time, the context increases sensitivity: even seemingly benign preference data can reveal risk appetite, personal priorities, and behavioral patterns.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The command phrases are broad enough to overlap with normal conversation, which can cause the agent to trigger memory reads, recalls, or workflow actions when the user did not intend to invoke the skill. In a memory-bearing decision assistant, accidental activation increases privacy and integrity risk because sensitive preferences, past decisions, and learned patterns may be surfaced or acted on unexpectedly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The listed deletion commands enable broad memory erasure, including full wipe, without an explicit safety warning or mandatory confirmation flow in the operations spec. If triggered accidentally or through ambiguous phrasing, the user could lose all stored decision history and preferences, creating irreversible integrity and availability harm.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill automatically loads memory and context files at session start and on decision requests without any user-facing notice or consent step. Because these files contain risk profiles, preferences, and historical decisions, silent retrieval can expose sensitive personal data and may violate user expectations about when stored memory is accessed.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The setup instructs the skill to modify global steering files (`SOUL.md`, `AGENTS.md`, and `HEARTBEAT.md`), which extends the skill’s influence beyond its own scoped memory files and affects future agent behavior across unrelated tasks. Even though the stated purpose is decision-support continuity, persistent changes to global instruction files create an unnecessary trust boundary violation and could be abused to bias, over-prioritize, or entrench this skill’s behavior over time.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The template explicitly states that a file will be created under the user's home directory on first use, but it does not mention obtaining explicit consent or warning the user that local files will be modified. In an agent skill that maintains self-improving memory, silent filesystem writes can surprise users, create privacy concerns, and normalize broader unauthorized persistence behavior.

Static analysis

No suspicious patterns detected.