Security audit

Self-Smarter Everyday

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a local nightly self-improvement system, but it grants persistent scheduled execution and its docs broaden into self-modifying skills and external integrations beyond the safer local-only claims.

Review this before installing as an autonomous system, not a documentation-only skill. Use --skip-cron until you have inspected the state paths, decide whether prompt and skill changes must be proposal-only, and disable or avoid the optional external integration patterns unless you have explicit destination allowlists, credential handling, and human approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (58)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit permissions while describing behavior that reads and writes files and relies on shell-based setup/scheduling. This creates a transparency and consent gap: a user or orchestrator may authorize the skill assuming it is documentation-only, while it actually persists state and can install scheduled execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description understates important operational behavior such as persistent cron installation, local state initialization, and ongoing inspection/writing of interaction-derived data. Mismatches like this are dangerous because they prevent informed consent and can conceal persistence or data-retention behavior that materially changes the risk profile.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The documentation expands the skill from a self-contained nightly self-improvement mechanism into one that can communicate with external systems and expose metrics over a network port. That increases the attack surface and creates opportunities for data egress or unintended exposure that are not aligned with the stated scope of the skill.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Webhook notifications and Prometheus export are not necessary for a self-improvement skill and introduce outbound and inbound interfaces that can leak operational data or expose internal state. In this context, the mismatch between stated purpose and capabilities makes the behavior more suspicious because users may not expect networked integrations from a reflective local skill.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The guide presents dry-run mode as non-mutating, while nearby instructions state the setup process may automatically create a cron job. That creates a misleading safety boundary: users may believe testing is side-effect free when persistence may already have been established, which can leave unattended scheduled execution in place.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The documentation explicitly lists command execution as a supported ingestion-hook type, which expands the skill from passive self-improvement metrics into arbitrary local command execution. In a nightly autonomous framework, this creates a dangerous path for operators or downstream agents to wire external or untrusted data directly into shell commands, enabling privilege misuse, data exfiltration, or system compromise.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The custom-metrics guide broadens the skill to pull from HTTP APIs and SQL databases, giving the self-improvement system broad external-system access beyond its core reflective purpose. In an autonomous nightly agent, this increases the attack surface substantially by normalizing credential use, remote data ingestion, and access to potentially sensitive systems without corresponding guardrails.

Context-Inappropriate Capability

Low

Confidence: 81% confidence
Finding: Outbound webhook alerting introduces network egress from a self-improvement skill and can transmit sensitive operational details to external endpoints. In the context of nightly autonomous reporting, this can be abused for covert exfiltration or leakage of internal performance, task, or user-derived data if payloads are not strictly minimized and destinations controlled.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The guide expands the skill from local self-improvement into external-facing integrations, including webhook ingestion and outbound notifications. That increases the trust boundary and creates potential data exfiltration and unauthorized network interaction risks, especially for an autonomous nightly process handling agent memory and reports.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Outbound email, webhook, and cloud/file report delivery introduce a direct exfiltration path for nightly reports that may contain sensitive memory, lessons, corrections, or operational data. Because this skill is autonomous and runs on a schedule, such transmission could occur without contemporaneous user review or consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Bidirectional sharing of improvements across multiple agents via git or shared filesystems creates a propagation channel for prompt mutations, memory-derived changes, and potentially unsafe behaviors. In a self-modifying ecosystem, one compromised or poorly validated agent could poison others, spreading harmful instructions or sensitive data across environments.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The guide explicitly authorizes the nightly process to mutate system prompts, test them, and commit accepted changes to a git repository, and also to decide whether to create or modify skills. That crosses from passive self-audit into autonomous self-modification of agent behavior and capabilities, creating a persistent pathway for unsafe prompt drift, policy bypass, or capability expansion without human approval.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The guide explicitly defines a system that can discover, create, modify, activate, and retire other skills, which is a form of autonomous capability expansion and self-modification beyond passive self-analysis. Even if framed as self-improvement, this materially changes future agent behavior and can introduce unreviewed procedures, broaden privileges, or persist unsafe logic across sessions.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: External discovery via marketplaces, GitHub, or documentation updates extends the trust boundary from local introspection to untrusted third-party content. This increases the risk of importing malicious or low-quality workflows into the skill pipeline, especially when combined with downstream drafting or adaptation of discovered skills.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The creation flow includes automatic draft generation and a decision point that allows immediate activation for some skills, meaning the agent can alter its own operational repertoire without mandatory review. This creates a direct path from observed patterns or external inputs to persistent behavior change, which can be abused or can amplify errors from flawed inference.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: Autonomous modification of existing skills is a self-modifying behavior that can silently alter trusted procedures over time. Although the document includes snapshots and rollback, those controls reduce recovery cost but do not prevent harmful, policy-violating, or privilege-expanding changes from being introduced.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: Retiring skills and moving them in the filesystem changes the active capability set and can disable safeguards or operational knowledge without clear user consent. In context, this is less about deletion and more about autonomous control over what the agent can do, which is still a meaningful self-modification risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The changelog describes autonomous reflection, auditing, memory compaction, prompt evolution, and improvement planning that write to and modify persistent state, but it does not include a clear user-facing warning that the skill will automatically alter stored data. In an autonomous self-modification skill, silent state mutation is risky because users may not realize memories, prompts, or audit records are being changed on a schedule, which can affect behavior, data retention, and recoverability.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup description states that installation creates directories/files and installs a daily 2:00 AM cron job, yet it does not clearly warn that the host will be modified and recurring scheduled execution will occur automatically. Scheduled persistence and execution increase risk because they can continue changing prompts, logs, memory tiers, and state without ongoing user awareness or approval.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The invocation guidance is broad enough that the skill could trigger in ordinary conversations about improvement, reflection, or optimization. In context, that is risky because the skill is designed to perform autonomous self-modification and retention-heavy behavior, so accidental invocation could initiate invasive analysis or setup beyond user intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The description does not prominently warn that the skill reviews past interactions, stores memories, compacts them, and may retain promoted memories indefinitely. Because interaction history often contains sensitive user data, the lack of an upfront warning undermines informed consent and increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The examples describe sending webhook payloads and writing structured logs without warning that reflections, metrics, errors, or other potentially sensitive agent data may be transmitted or persisted. Because this skill processes self-audit and memory-related information, silent export or retention can expose sensitive prompts, operational metadata, and user-derived content.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation promotes automatic prompt evolution, self-audit, and behavior changes without clearly warning that the agent will persistently modify its own operating artifacts over time. Users may enable a self-modifying loop without understanding the safety, review, rollback, and governance implications, increasing risk of drift or unsafe behavior.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The instructions add a persistent cron entry that will execute indefinitely, but the guide does not clearly warn the user that this creates ongoing unattended execution on the host. Silent persistence is risky because it can continue changing files, producing logs, and running code long after initial setup, especially if the skill later changes behavior.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: Suggesting interaction logging hooks without warning about privacy, retention, and sensitive-data capture can lead operators to collect user content, credentials, or confidential prompts into local storage. In a self-improvement system, these logs may later be reused for reflection or prompt evolution, amplifying exposure and unintended propagation of sensitive data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.