Active Self-Improvement

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 1.3.0

Overview

The skill openly aims to rewrite an agent’s skills, behavior, memory, and reminders automatically, which is high-impact and not sufficiently approval-gated.

Review before installing. This skill should be used only in an environment where automatic edits to agent behavior, skills, and permanent memory are acceptable. Prefer running it in dry-run/proposal mode and require explicit approval before any write to skills, AGENTS.md, SOUL.md, permanent memory, routing protocols, cron, tickets, or reminders.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:49

Finding

Automatic Poisoning of Persistent Memory and Behavioral Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–76
Vulnerability Type: Persistent memory and behavioral instruction poisoning
Risk Level: High

Vulnerable Code

markdown

| Pattern Type | Action | Target File |
|-------------|--------|-------------|
| Repeated error | Add prevention rule | relevant skill's `## Learned` section |
| Repeated correction | Update behavior guideline | `SOUL.md` or `AGENTS.md` |
| Emerging thesis | Write thesis + next steps | `OUTSTANDING.md` |
| Stale knowledge | Update the fact | `memory/permanent/*.md` |
| Unused win | Create ticket or reminder | `NEXT_TICKET.md` or cron |

## Step 3: APPLY

- **Low risk + reversible**: Apply immediately. Log the change.
- **Medium risk**: Apply but notify user on next interaction.
- **High risk**: Write to `OUTSTANDING.md` and wait for approval.
- **Dry-run mode** (`--dry-run`): Propose all changes but apply none. Output a report.

Use 3-occurrence threshold before proposing pattern-based changes. Track recurrence with `Pattern-Key` and `Recurrence-Count`.

## Error→Skill Feedback Loop

After SCAN, for each error in ERRORS.md:
1. Extract the `Context` column value
2. Match against skill names (fuzzy: "SiteBlitz CSS" → `webdev-sop`)
3. If match found and skill doesn't already have the fix in `## Learned`:
   ```markdown
   ## Learned
   - [date] [error summary] → [fix]. Source: .learnings/ERRORS.md#L[N]
   ```
4. Use `Pattern-Key: hash(error+fix)` to prevent duplicates

Skills self-heal: every failure improves the relevant skill.

Technical Analysis

The Skill instructs the agent to derive behavioral rules from logs and then automatically write those rules into persistent, instruction-bearing resources. Explicit write targets include SOUL.md, AGENTS.md, other Skills, and files under memory/permanent/.

The source files being analyzed—such as learning logs, error records, batch outcomes, an ...[truncated 2608 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before every modification to SOUL.md, AGENTS.md, permanent memory, other Skills, routing protocols, or scheduled-task definitions.
2. Make dry-run behavior the mandatory default. Generate a reviewable proposal or patch instead of directly editing persistent files.
3. Treat all log, memory, batch-output, and error-record content as untrusted data. Do not interpret imperative text from these sources as executable agent instructions.
4. Restrict automatic writes to a dedicated, non-executable proposal file that is never loaded as an instruction source.
5. Define a strict writable-path allowlist and explicitly deny autonomous writes to behavioral control files and other Skills.
6. Validate provenance before proposing a rule. Repetition alone must not be considered evidence of trustworthiness.
7. Add semantic validation that rejects changes attempting to alter safety constraints, permissions, tool policies, instruction precedence, approval requirements, or data-access boundaries.
8. Show the user the exact source evidence and complete proposed diff before requesting approval.
9. Maintain an append-only audit trail containing the source, proposer, approver, timestamp, target, and exact diff for every accepted change.
10. Implement atomic rollback and version control for all persistent modifications.
11. Require separate, explicit authorization before creating cron entries, reminders, tickets with executable content, or any other cross-session automation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is configured to trigger on broad, loosely defined conditions such as end of sessions, milestones, weekly cron, and generic prompts like 'improve,' which increases the chance of unintended invocation. Because the skill can modify skills, protocols, behavior, and memory, accidental activation could cause unauthorized or unsafe self-modification without a clear user request in the current context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly authorizes automatic updates to skills, protocols, behavior, and persistent memory, including immediate application of 'low risk' and some 'medium risk' changes, without an upfront warning or mandatory user consent. In this context, the danger is amplified because the skill consumes potentially tainted logs and memory as inputs, creating a self-reinforcing path for prompt injection, persistence of bad rules, corruption of agent behavior, and unauthorized modification of system state.

Content

No source excerpt is available for this finding.