Security audit

AI自动进化工程，结合self-improvement技巧+实际运行总结而成

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed agent memory/logging skill, but it can automatically save conversation and error details into persistent project and agent-memory files without strong consent or redaction controls.

Install only if you intentionally want an agent memory/logging workflow. Keep .learnings private or gitignored by default, review any hook configuration before enabling it, and require human review before committing logs or promoting content into CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or new skills. Do not store secrets, credentials, customer data, raw prompts, or sensitive command parameters in these files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The security note is materially misleading: the hook configuration explicitly runs shell commands, yet the text reassures readers that the scripts only output text and do not execute extra commands. Because hooks run automatically with the agent's privileges, understating execution behavior can cause users to enable unreviewed scripts in trusted paths, increasing the risk of unwanted command execution if those scripts are modified or later expanded.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger conditions are extremely broad and overlap with routine conversation patterns, causing the skill to activate during many normal interactions. In context, that matters because activation leads to persistence workflows and hidden review/logging behavior, increasing the chance of collecting and storing user content without a deliberate, task-scoped decision.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs the agent to automatically write learnings, errors, corrections, and requests into persistent files under .learnings without a clear user-facing warning or consent mechanism. This is dangerous because routine conversation content, operational details, and possibly sensitive data can be retained locally or in shared workspaces beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Automatic session-start and session-end review/logging creates background persistence behavior that may occur without the user realizing the agent is consulting or updating historical records. In this skill's context, those phases can silently process prior sensitive notes and generate new retained summaries, compounding privacy and data minimization risks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guidance tells the model to automatically write entries into project `.learnings/` files when certain interaction events occur, without requiring explicit user consent at write time. In an agent context, this can silently modify repository contents, create noisy or policy-violating commits, and persist information the user did not intend to store.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger examples use very broad, everyday phrases such as requests to remember something or comments that a problem happens often. In an always-on self-improvement skill, these phrases can cause unintended activation, leading the agent to capture, transform, or persist conversational content when the user did not explicitly ask for that behavior.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill explicitly tells the agent to log user corrections, feature requests, contextual details, and other session-derived information into persistent markdown files. Because this is natural-language retention, it can capture credentials, proprietary content, personal data, or sensitive business context that later agents or users may read from the workspace.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The error template encourages persisting raw error output plus the inputs or parameters used, which commonly contain tokens, URLs, file paths, prompts, customer data, or other secrets. In a shared repository or synced workspace, this creates a direct leakage channel from transient execution context into durable plain-text logs.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The system-prompt instructions explicitly direct the model to persist user corrections, feature requests, and error details into plain-language project files. That creates a retention and redistribution channel for user-provided content, which may include sensitive business context, internal mistakes, or proprietary requirements that were only meant for the live session.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The general workflow says errors and corrections should be recorded into shared learning files as a normal practice, increasing the chance that sensitive interaction content is retained long-term and committed to a repository. The risk is amplified by the document's explicit support for shared repository storage, which can broaden access to information beyond the original session participants.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.