Security audit

Super Self Improving

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only self-improvement skill discloses local memory and feedback tracking, with privacy caveats but no hidden execution, exfiltration, or system modification behavior.

Install this only if you want a skill that may keep local, cross-session records of preferences, feedback, errors, metrics, and inferred behavior. Avoid giving it secrets or sensitive personal/business data, periodically inspect or delete ~/.super-self-improving/, and require confirmation before any implementation uses inferred feedback, exports memory, or attempts agent scheduling actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README explicitly describes persistent storage under ~/.super-self-improving/ for memory, feedback, errors, and metadata, but it does not clearly warn users that their prompts, preferences, and interaction-derived data may be written to local disk. For a self-improving agent handling conversational feedback and error traces, this can lead to unintended retention of potentially sensitive user data and surprise persistence on shared or monitored systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly describes inferring implicit feedback from user behavior such as repetition, silence, skipped answers, and topic changes, but it does not warn users that such behavioral inference is taking place. Silent behavioral profiling is risky because it may create inaccurate or sensitive user profiles without informed consent, and those inferences may then influence future interactions or be stored persistently.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents persistent storage of preferences, patterns, metrics, and feedback plus export functionality, but it does not provide a clear user-facing privacy notice, consent model, retention policy, or handling rules for potentially sensitive behavioral data. This can lead to collection or disclosure of personal or confidential information through memory files and exports, especially because the stored data spans multiple categories and persists across sessions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description focuses on multi-modal memory, feedback loops, meta-learning, and confidence calibration for a self-improving agent. Lines L289-L326 add intelligent task allocation, load balancing, and automatic scaling, which are orchestration/platform capabilities rather than an obvious implementation detail of personal self-optimization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Most of the README content, including operational instructions and safety notes, is written in Chinese, with no statement that users may choose another language or that the skill is intended only for a Chinese-speaking context. This can constitute a language or locale policy issue when a specific language is effectively imposed without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The document is bilingual, but major section headings and descriptive content are primarily presented in Chinese-first form without stating that users may choose their preferred language. Under the language policy rule, forcing or defaulting to a language without opt-in can be problematic unless language choice is explicitly offered.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Lines L158-L162 describe deriving feedback from signals like silence, topic changes, and repeated questions, which requires autonomous inference about user intent. This sits in tension with L258's explicit best-practice statement that user control should take priority over autonomous inference, creating an intent-level contradiction in the documentation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest and top-level description describe learning-oriented features such as memory, feedback, meta-learning, and calibration. Token consumption tracking, abnormal-usage alerts, and cost estimation in L262-L285 are operational monitoring features that are not an obvious semantic match to the declared purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill name and description are written entirely in Chinese, and the metadata provides no indication that the language is configurable or chosen by the user. Under the policy scope for natural-language violations, this can be interpreted as imposing a locale/language without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.