Self Improvement Daemon

• Outcome: Review
• Latest audit: Jun 2, 2026, 5:27 AM
• Version:
  1.0.0

Overview

This skill has no executable daemon code, but it claims broad self-improvement and background system-optimization behavior without enough scoping or safety detail.

Review this carefully before installing. The package does not include the daemon it claims to document, and its instructions are too broad for a system-improvement tool. Install only if you can verify the missing implementation and are comfortable with any background execution, system changes, and stop or rollback procedures.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill manifest and description present this as a system self-improvement daemon, but the body of the file is dominated by unrelated Bilibili viewing notes and links. This mismatch undermines trust, makes review difficult, and can conceal the real behavior or absence of the claimed functionality in a skill that suggests persistent system-level action.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The file claims the existence of a Python daemon with CLI entrypoints, control functions, and a class, but provides no implementation or meaningful design details. In a security-sensitive context, undocumented or missing implementation behind system-modifying claims creates a review gap that can hide unsafe behavior, overstate capabilities, or mislead operators into enabling an unverified component.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad terms like 'improve' and 'upgrade system' that are likely to match normal user requests. For a skill framed as a daemon capable of ongoing self-improvement, accidental invocation could enable persistent or system-changing behavior without clear user intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill is described as a daemon for continuous self-improvement and system optimization, yet the documentation provides no warnings about persistence, background execution, system modification, or rollback. In this context, the lack of user-facing safety disclosures increases the risk of uninformed consent and unsafe deployment of a potentially privileged component.

VirusTotal

64/64 vendors flagged this skill as clean.