Security audit
Security checks for vulnerabilities and agentic risk
This skill is not malicious, but it should be reviewed because it enables broad automatic conversation analysis and persistent self-improvement logs that can influence future agent behavior without clear opt-in or retention limits.
Review this skill before installing if you handle sensitive conversations. Use it only with explicit user consent, restrict it to a dedicated workspace, disable or gate automatic analysis where possible, and periodically inspect or delete improvement_log.md before applying any SOUL.md recommendations.
The skill describes capabilities that read and write local files (for example, an improvement log and SOUL.md) but does not declare any tool scope, permissions, or allowed-tools boundary. That creates an authorization ambiguity where a host agent may grant broader file access than users expect, increasing the chance of unintended data exposure or modification.
The skill advertises automatic conversation analysis and logging behavior without a clear user-facing warning about monitoring, retention, and file writes. This undermines informed consent and can lead to sensitive content being analyzed or stored in local logs unexpectedly.
The statement that the skill 'automatically analyzes conversations after each session' is an overly broad activation condition with no scoping, consent, or trigger constraints. In practice, this could cause the skill to process every conversation, including sensitive sessions, and persist derived data without a deliberate user action.
The skill persistently writes user-provided 'insight' content to a workspace file even though its advertised role is analysis and optimization. Persistent state creation increases risk because it can retain sensitive conversation-derived content, create undeclared side effects, and influence future agent behavior outside the immediate task scope.
The code explicitly inspects improvement logs to produce recommendations for SOUL.md, which is a persona/configuration artifact outside the narrow scope of simple conversation-quality analysis. Even though it only suggests updates rather than directly editing the file, this creates a pathway for conversation content to steer long-term persona changes, enabling prompt-injection-style persistence or unauthorized behavioral drift.
The skill description is extremely broad ('Self-improving agent system for continuous optimization') and does not define clear activation boundaries, allowed inputs, or operational scope. In agent ecosystems, vague self-improvement language can cause over-invocation, unsafe autonomy assumptions, or expansion into behaviors not intended by the author, increasing the chance of misuse or privilege creep.
The natural-language heuristics only look for Chinese and English feedback terms such as '好', '棒', 'good', and 'great'. This embeds a language preference without offering user choice or documenting that the tool is intentionally limited to those languages.
