Security audit

Self Improving

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly coherent, but it persistently changes agent memory and workspace steering in ways users should review before installing.

Install only if you want a persistent local memory system that can influence future agent behavior. Review the setup changes to AGENTS.md, SOUL.md, and HEARTBEAT.md before applying them, avoid storing sensitive information, and treat the Proactivity companion as a separate skill that needs its own review.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The setup for a self-improving memory skill expands scope by instructing installation and activation of a separate Proactivity skill. That creates an unexpected capability increase and a transitive trust problem: users consenting to one skill may unknowingly enable another with different behaviors, permissions, or risks.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: The HEARTBEAT.md modification adds recurring maintenance behavior that runs beyond the explicit correction/failure-driven trigger conditions described for the skill. Even though the logic is limited, it establishes persistent background review hooks that can normalize ongoing self-modification or stateful behavior without a fresh task-scoped user request.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill prominently describes self-learning and memory but does not clearly warn, up front, that user corrections and preferences are persisted to local files. This creates a consent and privacy risk because users may reveal sensitive preferences or personal information without realizing it will be stored beyond the current session.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The architecture/setup text says workspace setup should add steering to AGENTS, SOUL, and HEARTBEAT.md, but this side effect is not clearly disclosed in the initial description. Silent or under-disclosed modification of workspace control files can change agent behavior persistently and surprise users or contaminate repositories.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The kill-switch flow tells the agent to export current memory to a file before wiping it, which creates a new persisted copy of potentially sensitive data at the exact moment the user is requesting deletion. Without an explicit warning, confirmation, retention limit, or secure handling requirements, this undermines the deletion request and can expand the exposure surface.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: The template explicitly instructs creation of persistent directories and files under the user's home directory on first activation, which modifies the local filesystem without any embedded warning, consent step, or scope limitation. In the context of a self-improving agent, this is more concerning because it establishes durable state and can normalize ongoing writes to user storage, increasing privacy and persistence risks even if the initial files are benign.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file explicitly states it will be created in `~/self-improving/memory.md` and updated automatically, which means the skill performs persistent writes to the user's home directory. Without clear user-facing disclosure and consent, this can unexpectedly retain preferences or prior interaction patterns across sessions, creating privacy and data-governance risk even if the content is not overtly sensitive.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill specifies automatic loading, writing, and updating of persistent memory files and project namespaces without a clear user-facing warning or consent boundary. This can cause users to disclose or alter persistent data unintentionally, especially because the skill is explicitly proactive and self-improving, which increases the likelihood of background state changes across sessions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The weekly maintenance workflow performs automated scanning, tier migration, archival, compaction, and index updates on stored memory data without warning the user that these background lifecycle operations will occur. Even if intended for maintenance, silent archival or compaction can affect data availability, retention expectations, and auditability of prior corrections or preferences.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The file instructs the agent to create/split namespaces and perform memory-management actions based on thresholds, but it provides no requirement to warn the user or obtain consent before changing persistent memory structure. In a self-improving memory skill, silent updates can cause unintended retention, reorganization, or propagation of user data and preferences without the user's awareness.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The compaction and archiving guidance directs the agent to merge, summarize, and archive stored entries, which can alter the fidelity and meaning of user data, yet it omits any warning, approval step, or preservation safeguards. Summarization of preferences or corrections can introduce errors, erase nuance, and retain sensitive data longer than intended, especially when archived for later reuse.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The skill prescribes different confirmation behavior by inferred user type, including 'aggressive learning, minimal confirmation' for power users, without requiring explicit opt-in. That creates a pathway for the agent to reduce consent checks and make more autonomous memory decisions based on assumptions about the user rather than clear authorization.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The setup directs creation and modification of files in the user's home directory and core agent steering files without an upfront warning that local configuration and memory will be written persistently. This undermines informed consent and can lead to unexpected retention of sensitive data, behavior changes across future sessions, and difficult-to-audit workspace modifications.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.