Security audit
Security checks for vulnerabilities and agentic risk
The skill is transparent about creating local self-improvement memory, but it can persist user corrections as future agent instructions and alter workspace steering files, so users should review it carefully before installing.
Install only if you want persistent local memory that can shape future agent behavior. Use the Passive or Strict mode, review changes to AGENTS.md, SOUL.md, HEARTBEAT.md, and ~/self-improving/ before relying on it, avoid saving secrets or sensitive personal data, and treat stored learned rules as untrusted until you have reviewed them. Do not enable the optional Proactivity install unless you can verify the exact package version and publisher.
learning.md:5Persistent Learned-Instruction Poisoning Through Cross-Session Memory
setup.md:89Unpinned Third-Party Skill Is Installed Before Security Review
The activation guidance is very broad and can trigger the skill in many ordinary situations such as errors, feedback, or noticing a better approach. In this skill’s context, broad activation increases the chance that persistent memory behaviors run without a clear, task-specific user request, which can lead to unintended collection and retention of user preferences or corrections.
The skill instructs automatic logging of corrections, preferences, and repeated patterns to local storage, but does not present a strong upfront consent and retention warning before collection begins. This creates a privacy and data-governance risk because users may unknowingly have behavioral data and preferences persisted across sessions.
The skill defines autonomous promotion, demotion, and archiving rules that modify persistent memory state without requiring user approval for those state transitions. Even though it says not to delete without asking, these automatic decisions can still alter what information is surfaced or retained, creating integrity and transparency risks in a memory-management skill.
- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking
### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |
The kill-switch trigger "forget everything" is underspecified and lacks scope boundaries, making it vulnerable to accidental activation during normal discussion, quotations, hypotheticals, or third-party text handling. In this skill, where persistent memory affects future behavior, unintended wipes or exports could cause privacy issues, integrity loss, or denial of service against the agent's learned state.
The skill explicitly states that reversed preferences are archived and history is kept, but it does not warn the user that preference history may persist after reversal or inactivity. This creates a privacy and transparency issue because users may reasonably assume a reversed or archived preference is deleted rather than retained for future reference or recovery.
The skill instructs the agent to automatically load persistent memory files at session start, but it provides no explicit notice or consent step before accessing stored user preferences, corrections, or project context. In a self-improving memory skill, this increases privacy risk because personal or sensitive contextual data may be surfaced or used automatically without the user's awareness each time a session begins.
The correction workflow persists user corrections to multiple files with timestamps, counters, context, and inferred namespaces, yet there is no explicit user warning or consent for durable storage. This is risky because users may treat corrections as ephemeral conversation feedback, while the skill silently converts them into long-lived behavioral memory that can retain sensitive preferences, project details, or personal data.
The weekly maintenance routine performs automated moves, archival, compaction, and index updates on stored memory without notifying the user that background modification of persisted data will occur. Even if intended for housekeeping, silent background changes can affect data retention, traceability, and user expectations about what information is kept, moved, or deleted over time.
The phrase "what do you know about me?" is used as an automatic trigger for a full memory export, but it can plausibly appear in ordinary conversation rather than as an authenticated privacy request. In a self-improving, memory-enabled agent, this ambiguity increases the chance of unintended disclosure of stored user context or personal data.
The skill instructs the agent to create directories and files in the user's home directory automatically on first activation, but it does not require explicit user consent or even a warning that persistent filesystem changes will occur. In a self-improving agent context, silent persistence is more dangerous because it establishes long-lived state that can outlast the current task and may surprise users or violate least-privilege expectations.
The setup flow instructs the agent to modify multiple local state files such as AGENTS.md, SOUL.md, HEARTBEAT.md, and files under ~/self-improving/ without an explicit safety warning or confirmation checkpoint immediately tied to those edits. While the changes appear intended to support the skill, silent or assumed file modification can surprise users, alter workspace behavior persistently, and normalize broad write access by a skill.
No suspicious patterns detected.