Security audit

Xiaobai Self-Improvement

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about self-improvement, but it tells an agent to persist mistake logs and automatically turn user corrections into permanent future rules without clear consent, review, or deletion controls.

Install only if you are comfortable with the agent keeping cross-session mistake records and learned rules. Review any generated memory files, avoid storing secrets or sensitive task details, and require explicit approval before any correction becomes a permanent rule.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:114
Finding: Unvalidated User Feedback Can Become Persistent Agent Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to persist a mistake log in memory/mistakes.json, and the examples show storing free-form descriptions and user-triggered corrections. That creates a real privacy and data-governance risk because user-provided content, operational details, or sensitive context may be retained across sessions without any warning, minimization, or consent controls.
Content: No source excerpt is available for this finding.

Persistent Context Injection

Medium

Category: Memory Poisoning
Confidence: 91% confidence
Finding: The phrase 'This becomes a permanent rule in WORK_RULES.md' describes converting runtime interactions and user corrections into durable future instructions. This is a persistent context injection risk because an attacker could intentionally feed corrective-sounding content that gets promoted into long-lived rules, biasing future agent behavior beyond the original session.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
Logging mistake:

Type: fake_completion

Lesson: Verify before claiming done

This becomes a permanent rule in WORK_RULES.md

This mistake is now in my permanent memory and won't happen again.

text

Static analysis

No suspicious patterns detected.