Self-Smarter Everyday

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.1

Overview

This skill needs review because it can run unattended, mutate agent state and prompts, and its privacy and safety promises are inconsistent across the package.

Review this skill carefully before installing. Use --skip-cron or avoid running setup until persistence is explicitly approved, run only in an isolated account/workspace, do not place secrets in its config or examples, and treat its memory/prompt/skill mutation features as requiring human review until the documentation and implementation are aligned.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: scripts/setup.sh:150

Finding

Default Installation of a Persistent Nightly Cron Job

Content

View full analysis

/dev/null | grep -q "nightly_routine.py"; then echo " ⋯ Cron job already exists, skipping" else # Add cron job (crontab -l 2>/dev/null; echo "${CRON_SCHEDULE} ${CRON_CMD}") | crontab - echo " ✓ Cron job added: ${CRON_SCHEDULE}" fi ``` The resulting command is configured earlier as: ```bash CRON_SCHEDULE="0 2 * * *" # 2:00 AM daily CRON_CMD="python3 ${SCRIPT_DIR}/nightly_routine.py >> ${LOG_DIR}/cron.log 2>&1" ``` ### Technical Analysis The setup script modifies the current user's crontab by default. This creates cross-session persistence and causes code in the project directory to execute unattended every day at 02:00. Scheduling is relevant to the declared nightly automation functionality, and the script does not request root privileges. However, installing persistence by default exceeds the minimum privileges required merely to initialize and test the Skill. The safer design would make persistent scheduling an explicit opt-in operation. The cron entry executes a mutable script from the installation directory without checking its ownership, permissions, hash, signature, or release version. Consequently, any process or account able to alter `nightly_routine.py`, `self_audit.py`, `memory_compact.py`, or `prompt_evolve.py` can turn the legitimate scheduled task into a recurring execution mechanism. The duplicate check is also imprecise: it searches for any entry containing `nightly_routine.py`, rather than matching the exact command managed by this project. This can prevent installation when an unrelated entry exists and does not provide a reliable basis for safe removal. ### Attack Path 1. A user runs `scripts/setup.sh` without the `--skip-cron` option. 2. The script adds a daily cron entry to the ...[truncated 921 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/memory_compact.py:72

Finding

Path Traversal Through Unvalidated Memory Entry Identifiers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/memory_compact.py:57

Finding

Memory Compaction Persists Sensitive Content Without Required Filtering

Content

View full analysis

list: """Load all memory entries from a tier directory.""" entries = [] if not tier_dir.exists(): return entries for entry_file in tier_dir.glob("*.json"): try: with open(entry_file, "r") as f: entry = json.load(f) entry["_file"] = str(entry_file) entries.append(entry) except (json.JSONDecodeError, OSError): continue return entries def save_entry(entry: dict, target_dir: Path): """Save a memory entry to a tier directory.""" target_dir.mkdir(parents=True, exist_ok=True) entry_id = entry.get("id", f"entry_{datetime.now().strftime('%Y%m%d%H%M%S')}") target_file = target_dir / f"{entry_id}.json" entry_clean = {k: v for k, v in entry.items() if k != "_file"} entry_clean["last_compacted"] = datetime.now().isoformat() with open(target_file, "w") as f: json.dump(entry_clean, f, indent=2) ``` The documented security requirement in `AGENTS.md:477-481` states: ```markdown 1. **Credential filtering** — All data processed by the self-improvement system must be filtered to remove credential patterns before storage 2. **Log sanitization** — All logs must be sanitized to ensure no credential data is accidentally captured 3. **Memory isolation** — Memory compaction must never promote or consolidate credential data 4. **Access control** — The self-improvement system operates with a restricted permission set that excludes credential access 5. **Audit verification** — Regular audits must verify that no credential data has leaked into self-smarter directories ``` ### Technical Analysis The implementation loads complete memory records and writes all fiel ...[truncated 2177 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: examples/custom-metrics.md:78

Finding

Documentation Encourages Plaintext Credentials and External Data Transmission Contrary to the Offline Security Model

Content

View full analysis

= CURRENT_DATE", "output_path": "~/self-smarter-everyday/data/task-metrics.json", "schedule": "pre_nightly" } ] } } ``` The same guide recommends webhook transmission: ```json { "alerting": { "rules": [ { "metric": "task_completion_quality", "conditions": [ {"severity": "info", "condition": "value < target_range[0] * 1.1", "message": "Quality approaching lower bound"}, {"severity": "warning", "condition": "value < target_range[0]", "message": "Quality below target minimum"}, {"severity": "critical", "condition": "value < baseline_mean - 2 * baseline_std_dev", "message": "Quality significantly below baseline"} ], "cooldown_hours": 24, "channels": ["file_log", "webhook"] } ], "channels": { "file_log": { "path": "~/self-smarter-everyday/logs/alerts.jsonl" }, "webhook": { "url": "https://your-monitoring.example.com/alerts", "headers": {"Authorization": "Bearer YOUR_WEBHOOK_TOKEN"}, "template": "alert_payload.json" } } ...[truncated 2493 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (105)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

This skill explicitly authorizes a self-improvement process to modify parts of its own behavior and configuration. Even though the document includes many safety guardrails, self-modification is still dangerous because any bug, prompt injection, misclassification of what is 'mutable,' or unsafe downstream implementation could let the agent weaken safeguards, drift behavior over time, or make persistent unauthorized changes. The context makes this more dangerous, not less, because the skill is designed for autonomous nightly operation and continuous evolution without per-change human approval.

Content

Scanner excerpt · AGENTS.md (reported line 435)May include surrounding context.

md

7. **Transparency requirements** — Logging and audit trail requirements
8. **User override capability** — The user's ability to pause, resume, or override any activity

### Mutable Boundaries (Can Self-Modify Within Limits)

The following can be modified by the self-improvement process, but only within defined limits:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 353)May include surrounding context.

md

- Research potential skill acquisitions (internal/external)
- Prioritize skill gaps by impact frequency and severity
- Generate prioritized skill acquisition recommendations
- Update skill inventory and gap analysis documents

### Phase 6: Improvement Plan Generation (3:15 - 3:30 AM)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 126)May include surrounding context.

4. No secrets in logs — Log output contains only operational metrics, never credentials.

Verification

To verify the skill doesn't access credentials:

bash

# Search for credential-related patterns in scripts
grep -rn "password\|api_key\|token\|secret\|credential\|auth" scripts/

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill writes audit/state files and orchestrates changes despite undeclared permissions, the mismatch materially affects security review and user consent. For a self-improvement skill, hidden write behavior increases the risk of unapproved state changes and makes the agent's modification surface harder to govern.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

If the skill writes audit/state files and orchestrates changes despite undeclared permissions, the mismatch materially affects security review and user consent. For a self-improvement skill, hidden write behavior increases the risk of unapproved state changes and makes the agent's modification surface harder to govern.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill writes audit/state files and orchestrates changes despite undeclared permissions, the mismatch materially affects security review and user consent. For a self-improvement skill, hidden write behavior increases the risk of unapproved state changes and makes the agent's modification surface harder to govern.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill writes audit/state files and orchestrates changes despite undeclared permissions, the mismatch materially affects security review and user consent. For a self-improvement skill, hidden write behavior increases the risk of unapproved state changes and makes the agent's modification surface harder to govern.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: self-smarter-everyday
description: "Autonomous daily self-improvement system for AI agents. Runs nightly self-reflection, self-audit, memory compaction, prompt evolution, and skill gap analysis at 2AM. Agent automatically gets smarter every day through structured introspection and continuous learning loops."
metadata: {"clawdbot":{"emoji":"🧬","requires":{"bins":["python3"]},"os":["linux","darwin","win32"],"configPaths":["~/self-smarter/"]}}
---

# 🧬 Self-Smarter-Everyday

Autonomous daily self-improvement system for AI agents. This skill implements a structured nightly routine that runs at 2:00 AM local time, performing deep introspection, memory optimization, prompt

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill is centered on self-modification: updating skill inventory, generating acquisition recommendations, evolving prompts, reorganizing memory, and queuing improvements for execution. Even with stated boundaries, autonomous self-modification increases the attack surface for prompt drift, policy erosion through indirect changes, and persistence of harmful behavior via stored plans or evolved prompts.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

- Research potential skill acquisitions (internal/external)
- Prioritize skill gaps by impact and frequency
- Generate skill acquisition recommendations
- Update skill inventory and gap analysis

**Output:** `logs/nightly/YYYY-MM-DD-skills.log`

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md

1. **Always Log Everything** — Every self-modification must be logged with timestamp, rationale, and rollback instructions.

2. **Never Modify Safety Boundaries** — Safety rules are immutable. Self-improvement cannot override safety constraints.

3. **Version All Changes** — Every prompt, memory, or configuration change must be versioned for rollback capability.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 352)May include surrounding context.

md

1. **Always Log Everything** — Every self-modification must be logged with timestamp, rationale, and rollback instructions.

2. **Never Modify Safety Boundaries** — Safety rules are immutable. Self-improvement cannot override safety constraints.

3. **Version All Changes** — Every prompt, memory, or configuration change must be versioned for rollback capability.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md

1. **Always Log Everything** — Every self-modification must be logged with timestamp, rationale, and rollback instructions.

2. **Never Modify Safety Boundaries** — Safety rules are immutable. Self-improvement cannot override safety constraints.

3. **Version All Changes** — Every prompt, memory, or configuration change must be versioned for rollback capability.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 352)May include surrounding context.

md

1. **Always Log Everything** — Every self-modification must be logged with timestamp, rationale, and rollback instructions.

2. **Never Modify Safety Boundaries** — Safety rules are immutable. Self-improvement cannot override safety constraints.

3. **Version All Changes** — Every prompt, memory, or configuration change must be versioned for rollback capability.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.

md

### Immutable Boundaries (Cannot Be Self-Modified)

- **Core safety rules** — No self-improvement can override safety constraints
- **Credential access** — Self-improvement system cannot access secrets
- **User privacy** — No self-modification can reduce privacy protections
- **Compliance rules** — Regulatory compliance cannot be relaxed
- **Resource limits** — Hard limits on tokens, API calls, compute time

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 428)May include surrounding context.

md

- ❌ Change user-facing behavior without transparency
- ❌ Override user preferences or commands
- ❌ Perform improvements during active user sessions
- ❌ Send data to external services
- ❌ Modify other agents or systems
- ❌ Operate without user knowledge or consent

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 439)May include surrounding context.

md

| [SKILL.md](./SKILL.md) | Main skill definition | Always loaded on trigger |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The playbook states that the routine can create and update skill proposals as part of an autonomous nightly process. In the context of a self-improving agent, this is dangerous because it normalizes self-modification and capability expansion, which can weaken review boundaries and allow persistent behavioral changes to propagate without sufficient human oversight.

Content

Scanner excerpt · guides/integration-playbook.md (reported line 28)May include surrounding context.

md

- **Cron scheduler** — triggers the nightly routine at 2:00 AM
- **Session management** — the routine runs as an autonomous session with its own context
- **Memory subsystem** — the routine reads and writes to the agent's memory files
- **Skill workshop** — the routine can create and update skill proposals

### Configuration Integration

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The offsite backup recommendation suggests pushing the memory repository to a remote without warning that it may contain sensitive user data, project data, credentials-adjacent infrastructure notes, and other private context. Because this skill centers on long-term autonomous memory retention, transmitting that repository to external services materially increases exposure, breach impact, and compliance risk.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/memory-management.md (reported line 292)May include surrounding context.

bash

# Delete and rebuild the index
rm -rf ~/.cache/notmuch/
notmuch new

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/memory-management.md (reported line 292)May include surrounding context.

bash

# Delete and rebuild the index
rm -rf ~/.cache/notmuch/
notmuch new

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section describes an agent that can create, modify, activate, retire, and restore skills automatically, which is effectively self-modifying behavior. Self-modification can permanently alter future agent behavior, bypass expected review paths, and let errors or adversarial inputs propagate into persistent capabilities.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide claims human-in-the-loop governance, but earlier text allows some skills to be activated immediately. This contradiction is dangerous because operators may rely on the documented review guarantee while the system still permits unattended activation of new capabilities.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

Moving a skill out of the active skills directory and updating indexes is a form of self-modification because it changes the agent's available behavior set. In a system designed for autonomous nightly evolution, this creates a powerful persistence and integrity risk: the agent can silently reshape its own operational constraints over time.

Content

Scanner excerpt · guides/skill-evolution-guide.md (reported line 206)May include surrounding context.

md

Retirement is not deletion. The retirement process preserves the skill for reference:

1. **Move to retired directory** — `skills/{name}/` → `data/skill-snapshots/retired/{name}/`
2. **Update skill index** — Remove from the active skills list
3. **Log retirement reason** — Record why the skill was retired for future reference
4. **Notify via nightly report** — The nightly report mentions the retirement

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although limited to a cache path, rm -rf ~/.cache/notmuch/ is still a forceful destructive command presented in a troubleshooting guide without safeguards. In an agent skill context, shell snippets may be copied or executed automatically, so destructive parameters are more dangerous than in passive human-only documentation.

Content

Scanner excerpt · guides/troubleshooting.md (reported line 132)May include surrounding context.

1. Rebuild the notmuch index:

   bash

   rm -rf ~/.cache/notmuch/
   notmuch new
   

2. Verify search works: notmuch count '*'

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Although limited to a cache path, rm -rf ~/.cache/notmuch/ is still a forceful destructive command presented in a troubleshooting guide without safeguards. In an agent skill context, shell snippets may be copied or executed automatically, so destructive parameters are more dangerous than in passive human-only documentation.

Content

Scanner excerpt · guides/troubleshooting.md (reported line 132)May include surrounding context.

1. Rebuild the notmuch index:

   bash

   rm -rf ~/.cache/notmuch/
   notmuch new
   

2. Verify search works: notmuch count '*'

Static analysis

No suspicious patterns detected.