Security audit

Self Improving To Expertpack

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent learnings-to-ExpertPack converter, but it can over-export workspace instruction files and overstates its secret-stripping protections before encouraging publication.

Review generated packs carefully before committing or publishing them, especially mind/promoted-rules.md. Avoid running this directly against workspaces whose CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions may contain private instructions, endpoints, credentials, or organization-specific rules. Use a fresh output directory and run an independent secret scan before sharing the result.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/convert.py:114
Finding: Overbroad Collection and Export of Workspace Configuration Files
Content: View full analysis
dict[str, str]: """Check workspace files for content that was promoted from learnings.""" promoted = {} for fname in ["CLAUDE.md", "AGENTS.md", "SOUL.md", "TOOLS.md", ".github/copilot-instructions.md"]: fpath = workspace / fname if fpath.exists(): content = fpath.read_text(errors="replace") content, _ = strip_secrets(content) # Only include if it references learnings or self-improvement if any(kw in content.lower() for kw in ["learning", "self-improv", "lrn-", "err-", "feat-", ".learnings"]): promoted[fname] = content return promoted ``` The collected files are subsequently copied in full into the generated pack: ```python if promoted_content: body_parts = [] for fname, content in promoted_content.items(): body_parts.append(f"## From {fname}\n\n{content}") write_content_file( output, "mind", "promoted-rules.md", "Promoted Rules & Conventions", f"Rules and patterns promoted from learnings to {len(promoted_content)} workspace files.", "\n\n---\n\n".join(body_parts) ) ``` ### Technical Analysis The converter attempts to detect content promoted from learning files by searching several workspace-level agent configuration files for broad keywords. However, finding any one keyword causes the complete file to be copied into `mind/promoted-rules.md`. This does not isolate explicitly promoted sections or verify that the rest of the file is relevant to the conversion. Files such as `CLAUDE.md`, `AGENTS.md`, `SOUL.md`, `TOOLS.md`, and `.github/copilot-instructions.md` may ...[truncated 1937 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/convert.py:27
Finding: Incomplete Secret Redaction and Silently Discarded Detection Warnings
Content: View full analysis
tuple[str, list[str]]: """Strip secret patterns from text. Returns (cleaned_text, warnings).""" warnings = [] for pat in SECRET_PATTERNS: matches = pat.findall(text) if matches: warnings.append(f"Stripped {len(matches)} potential secret(s) matching {pat.pattern[:40]}...") text = pat.sub("[REDACTED]", text) return text, warnings ``` Both callers discard the returned warnings: ```python content = filepath.read_text(errors="replace") content, _ = strip_secrets(content) ``` ```python content = fpath.read_text(errors="replace") content, _ = strip_secrets(content) ``` The warning accumulator is initialized but never populated from these calls: ```python all_warnings: list[str] = [] ``` ### Technical Analysis The redaction implementation recognizes only a small set of credential formats: - OpenAI-style `sk-` strings satisfying a narrow character and length pattern. - Classic GitHub personal access tokens beginning with `ghp_`. - Slack bot tokens beginning with `xoxb-`. - Single-token values assigned to a small set of generic key names. It does not comprehensively cover private-key blocks, cloud access credentials, database connection strings, cookies, session identifiers, authorization headers containing spaces, multiline secrets, quoted values with embedded whitespace, newer provider-specific ...[truncated 1721 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/convert.py:19
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The core purpose matches substantially: this is indeed a converter from Self-Improving Agent learnings into an ExpertPack-like export. However, there are material description/behavior gaps. Most notably, the description explicitly promises YAML frontmatter on all content files for Obsidian compatibility, but write_content_file/write_index/generate_overview/glossary output plain markdown without frontmatter. The description also suggests the produced output includes multi-layer retrieval, context tiers, and EK measurement, while this script only creates a directory structure plus manifest/relations and then instructs the user to run separate chunker and eval-ek tools. Finally, promoted content handling is narrower than described: only a fixed set of workspace files are scanned, and only when they contain certain learning-related keywords. These are meaningful capability mismatches, though the overall conversion intent is aligned.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill advertises and requires code execution that can read a workspace, write an output pack, and reference external resources, but it declares no explicit tool scope or permissions boundary. In agentic environments, missing scope metadata can cause the runtime or user to grant broader access than necessary, increasing the risk of unintended file access, overwrite, or network use during conversion.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill manifest explicitly says the output 'includes YAML frontmatter on all content files' and is Obsidian-compatible. However, write_content_file writes Markdown starting directly with a heading and body, and the other generated Markdown files are similarly written without any frontmatter block, so the converter does not actually produce the claimed file format.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script creates the output directory and writes many files into it without checking whether it already contains data, previewing planned changes, or requiring an explicit overwrite flag. In a migration/export tool operating on user-supplied paths, this can accidentally overwrite existing notes or generated artifacts and cause integrity loss, especially if pointed at an existing vault or important directory.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.