skill-improvement

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:45 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Markdown-only workflow for reviewing and improving other skills, with some broad authority that users should apply carefully.

Install this only if you want an agent to review and modify skill files. Review the selected changes and diffs before applying them, and use disposable test files or a sandbox when verification might execute scripts from another skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Self-Modification

High

• Category: Rogue Agent

Content

**If verification passes:**
- Mark optimization complete
- Update skill documentation
- Optionally re-run diagnostic for final grade

**If verification fails:**

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description is very broad and can trigger on generic requests about skills, optimization, quality checks, or obvious issues. Over-broad activation can cause the wrong skill to be selected, leading it to read and modify unrelated skill files or steer the agent into an unnecessary multi-phase workflow.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Anti-Patterns

❌ Auto-fix all issues without user selection
❌ Skip verification phase
❌ Ignore context (domain-specific needs)
❌ Break existing functionality
❌ Over-engineer simple skills

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The example description at this location uses broad trigger phrases such as optimizing existing skills, checking skill quality, or when skills need improvement without strong exclusion criteria. In an agentic system, overly broad activation guidance can cause inappropriate skill invocation, leading to irrelevant behavior, context pollution, and increased chance of unsafe or unintended actions when the wrong skill is selected.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```markdown
# Skill Diagnostic Report: pdf-processing

**Path:** /skills/pdf-processing/SKILL.md
**Overall Grade:** A
**Issues Found:** 3 total (0 high, 2 medium, 1 low)

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```markdown
# Skill Diagnostic Report: data-helper

**Path:** /skills/data-helper/SKILL.md
**Overall Grade:** D
**Issues Found:** 8 total (3 high, 3 medium, 2 low)

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: In the example description, the phrase "Use when processing data files, validating data formats, or transforming data structures" is broad and lacks boundaries or exclusion conditions. As written in a markdown template/example, it encourages trigger wording that could match many ordinary data-related requests and may cause unintended skill invocation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide instructs subagents to execute workflows, tools, and scripts as part of verification but does not require any safety gating, sandboxing, or user-facing confirmation before potentially impactful actions. In a skill-optimization context, this can normalize autonomous execution of code or file-modifying operations during testing, increasing the risk of unintended side effects or abuse if a referenced skill contains dangerous instructions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The regression example explicitly demonstrates running a command against a file and asks the agent to execute the same task without any caution about environment isolation, file safety, or approval requirements. Example content strongly shapes downstream behavior, so this can encourage unsafe command execution patterns in real verification runs.

Static analysis

No suspicious patterns detected.