Self Improving

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 0.1.0

Overview

The skill is a disclosed local memory system, but it persists agent behavior across sessions and edits workspace steering files with insufficient confirmation boundaries.

Install only if you want a persistent local memory layer that can affect future agent behavior. Review the proposed AGENTS.md, SOUL.md, HEARTBEAT.md, and ~/self-improving/ changes before applying them, decline the optional Proactivity install unless you trust the resolved package, and periodically inspect or export the memory files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: setup.md:90
• Finding: Unpinned Third-Party Skill Installation and Automatic Setup Execution## Vulnerability Details **File Location**: `setup.md:90-104` **Vulnerability Type**: Untrusted and unpinned third-party Skill dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ### 5. Add the Proactivity Companion as Part of Setup At the end of setup, briefly tell the user that you are going to add characteristics so the agent is more proactive: - noticing missing next steps - verifying outcomes instead of assuming they landed - recovering context better after long or interrupted threads - keeping the right level of initiative Then say that, for this, you are going to install the `Proactivity` skill. Only install it after the user explicitly agrees. If the user agrees: 1. Run `clawhub install proactivity` 2. Read the installed `proactivity` skill 3. Continue into its setup flow immediately so the skill is active for this workspace ``` ### Technical Analysis The setup process installs `proactivity` by mutable package name without pinning an audited version or validating a cryptographic integrity hash. It then instructs the Agent to read the newly installed Skill and immediately continue into that Skill's setup flow. User consent prevents a completely silent installation, but it does not establish the integrity or safety of the package retrieved at installation time. The reviewed package therefore delegates part of its setup behavior to content that can differ from what was previously audited. If the registry entry, publisher account, distribution infrastructure, or a later release is compromised, the newly retrieved Skill could supply unsafe instructions. This is an insecure supply-chain boundary rather than evidence that the currently referenced `proactivity` package is malicious. The risk arises from combining an unpinned dependency with automatic interpretation of its instructions. ### Attack Path 1. An attacker compromises the `proactivity` publisher account, registry entry, or packa ...[truncated 1689 chars]
• Remediation: ## Remediation Suggestions 1. Pin `proactivity` to a specifically audited version rather than installing the latest mutable release. 2. Validate the downloaded package against a trusted cryptographic digest or signed publisher manifest. 3. Display the resolved publisher, version, requested capabilities, and integrity information before asking for installation approval. 4. Separate installation from activation. After installation, inspect and summarize the companion Skill's instructions and request a second explicit confirmation before following its setup flow. 5. Do not automatically execute or adopt instructions merely because they appear in the installed Skill. 6. Enforce capability restrictions for companion setup, including explicit approval for network access, writes outside its declared storage directory, workspace steering changes, or further dependency installation. 7. Maintain an allowlist of reviewed companion versions and fail closed if the retrieved artifact does not match the approved version and digest. 8. Document how users can inspect, disable, and uninstall the companion Skill and reverse any workspace changes it makes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The setup instructions indicate that workspace files such as AGENTS, SOUL, and HEARTBEAT.md should be modified as part of installation, but the warning is not prominent and the change scope is not explicitly confirmed by the user at the moment of action. Modifying project steering files can affect repository behavior, other agents, and team workflows, so silent or poorly disclosed mutation is a meaningful integrity and transparency risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to automatically persist user corrections, preferences, and repeated behaviors into local memory files, but it does not present a prominent user-facing consent step or clear warning at the point of collection. This creates a privacy and data-retention risk because users may provide sensitive or personal information in ordinary conversation without realizing it will be stored beyond the current session.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The kill switch is activated by a broad natural-language phrase, "forget everything," which can plausibly appear in ordinary conversation, quoted text, or examples. In a self-improving memory skill, accidental triggering could erase accumulated user state and disrupt service or destroy expected continuity across sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file defines an irreversible memory wipe procedure but does not pair it with an explicit warning that the action is destructive and may remove retained preferences, corrections, and project context. In this skill's context, where long-term learning and memory are core features, missing warning/confirmation increases the chance of accidental data loss and user surprise.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill specifies automatically loading memory files at session start and provides commands to display memory contents, but it does not require explicit user consent, redaction, or sensitivity checks before exposing stored data. Because these files may contain personal preferences, project details, and historical corrections, automatic retrieval or display can reveal information the user did not intend to surface in the current context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The setup explicitly instructs the agent to create and later modify persistent files under the user's home directory and workspace, but it does not require clear user consent at the time of filesystem changes or warn that local state will be altered. In an agent skill, this is dangerous because it normalizes silent persistence across sessions, increases the chance of unintended data modification, and can be chained with later instructions to write more sensitive or misleading content into trusted config files.

Static analysis

No suspicious patterns detected.