AI Agent Self-Improving Stack

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.0.1

Overview

This skill is not clearly malicious, but it asks users to install behavior-changing external skills through ambiguous, unpinned package names and has inconsistent package metadata.

Install only if you are comfortable with a memory and self-improvement stack whose actual component skills are resolved externally at install time. Verify the publisher, exact versions, and licenses of each referenced skill, and check what data the memory component stores under ~/self-improving/ before using it with private or business data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned External Skill Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-29; the installation command is repeated in the Quick Start section around line 51
Vulnerability Type: Unpinned and unaudited third-party skill dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Install

```bash
clawhub install ai-agent-self-improving-stack

That installs all 5. Or pick individually:

bash

clawhub install self-improving proactive learning memory hermes-learning-loop

text

### Technical Analysis

The documented workflow installs marketplace skills using mutable package names without exact versions, integrity hashes, verified publisher identities, or immutable source references. The contents of the five individual dependencies are not included in this repository, so their behavior cannot be validated by this audit.

Resolving dependencies only by name means a later release, compromised publisher account, namespace transfer, or dependency-confusion event could cause users to receive code or agent instructions that differ from those originally reviewed. The local `test.py` file only validates package metadata and does not verify dependency identities or integrity.

### Attack Path

1. An attacker compromises a referenced skill publisher, acquires an abandoned package name, or otherwise causes a malicious release to be published under a referenced name.
2. A user or agent follows the installation instructions in `SKILL.md`.
3. ClawHub resolves the mutable package name to the attacker-controlled release.
4. The malicious dependency is installed without a hash or trusted-version comparison.
5. When loaded or invoked, that dependency can execute its instructions or code using the permissions available to the hosting agent.

### Impact Assessment

The exact impact depends on the permissions and tools granted to the installed dependency. A malicious dependency could potentially read or modify files accessib
...[truncated 301 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every referenced skill to an exact, immutable version.
2. Publish and verify cryptographic hashes or signed package manifests before installation.
3. Specify the expected publisher identity and canonical repository for each dependency.
4. Audit and document the contents and permissions of all five dependencies.
5. Require explicit user confirmation before installing or updating third-party skills.
6. Add automated checks that reject unresolved, unsigned, or unexpectedly changed dependencies.
7. Use a trusted lockfile or equivalent mechanism so repeated installations resolve to identical artifacts.

T08 · Insecure Dependencies

Note

• Location: skill.json:2

Finding

Conflicting Package Identity, Version, and License Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md lines 1-4, _meta.json lines 1-5, skill.json lines 1-15, and LICENSE lines 1-18
Vulnerability Type: Package provenance and metadata inconsistency
Risk Level: Low

Vulnerable Code

SKILL.md:

yaml

---
name: AI Agent Self-Improving Stack
description: "Installs 5 essential tools that make your AI agent smarter over time — reflection, proactivity, learning, memory, and skill extraction. Your agent improves with every interaction."
version: 1.0.1

_meta.json:

json

{
  "ownerId": "kn7d3tzh2ec5knzja1yy3mnx3583cgbd",
  "slug": "ai-agent-self-improving-stack",
  "version": "1.0.1"
}

skill.json:

json

{
  "name": "certainlogic-self-improving-stack",
  "slug": "certainlogic-self-improving-stack",
  "version": "1.0.0",
  "description": "CertainLogic's curated self-improving agent stack. Honest comparison of 8 top tools + Company Brain Core OS as recommended foundation.",
  "author": "CertainLogic",
  "license": "MIT",
  "category": "productivity",
  "tags": ["self-improving", "proactive", "learning", "memory", "bundle", "company-brain", "certainlogic", "agent-upgrades", "automation", "ai-tools"],
  "repository": "https://github.com/certainlogic/certainlogic-self-improving-stack",
  "homepage": "https://certainlogic.ai/docs/self-improving-stack",
  "marketplace": {
    "clawhub": "certainlogicai/certainlogic-self-improving-stack"
  }
}

LICENSE:

text

Business Source License 1.1

License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
"Business Source License" is a trademark of MariaDB Corporation Ab.

Parameters

Licensor:             CertainLogic <[e-mail]>
Licensed Work:        The Licensed Work is (c) 2026 CertainLogic
Additional Use Grant: You may use the Licensed Work for any lawful purpose,
                      including production
...[truncated 2393 chars]

Remediation

View remediation

Remediation Suggestions

1. Select one canonical package name, slug, owner namespace, and version.
2. Apply that identity consistently across SKILL.md, _meta.json, skill.json, repository metadata, and marketplace records.
3. Update all files from a single authoritative release manifest during packaging.
4. Reconcile the license declaration: either change skill.json to the actual repository license or replace LICENSE with the intended license after legal review.
5. Add CI checks that compare names, slugs, versions, publishers, repository URLs, and license identifiers across all metadata files.
6. Sign published artifacts and expose checksums so consumers can bind the canonical identity to the reviewed package contents.
7. Reserve or deprecate conflicting marketplace names to reduce dependency-confusion opportunities.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises substantial agent-improvement functionality and installation of five tools, but the supplied code does none of that. It only validates local skill package files and version formatting. This is a materially different primary purpose, making the description inaccurate relative to the actual behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The suggested trigger phrases are broad and generic, especially 'Start using self-improving,' which could overlap with normal user language and cause accidental activation of this skill. In an agent environment, unintended invocation can change behavior unexpectedly, leading to confusion, undesired persistence/memory use, or unreviewed execution of bundled capabilities.

Content

No source excerpt is available for this finding.