Self Review Publish

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.0.0

Overview

The skill is transparent about self-reviewing agent behavior, but it can modify persistent agent configuration from loosely scoped logs, including an optional auto-apply mode.

Install only if you intentionally want an agent self-review system that can read and propose changes to core agent files. Keep AUTO_APPLY disabled, review exact diffs manually, and treat incident logs or memory entries as untrusted evidence rather than instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:67

Finding

Untrusted Incident Data Can Be Converted into Persistent Agent Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-41 and 67-89
Vulnerability Type: Persistent agent memory and configuration poisoning
Risk Level: High

Vulnerable Code

markdown

- Read every entry in `../../trainer/logs/incidents.md` timestamped after the value in
  `../../trainer/logs/.last-review` (create with far-past date if missing)
- Skim `HEARTBEAT.md` and `MEMORY.md` for relevant activity not formally logged

markdown

### Step 4 — Apply or hold
- Read `../../trainer/config.md`
- If AUTO_APPLY: false (default) — stop here. Present the proposal to the agent operator
  in chat and wait for explicit approval before touching any live file.
- If AUTO_APPLY: true — for each approved-category edit:
  1. Copy the current file to `../../trainer/backups/<filename>.<timestamp>.bak`
  2. Apply the edit exactly as drafted — no improvising beyond what was proposed
  3. Log what changed to `../../trainer/logs/applied.md`
- Regardless of AUTO_APPLY, SOUL.md and USER.md always require manual approval —
  never auto-edit identity or user-context files.

### Step 5 — Close out
- Update `../../trainer/logs/.last-review` to the current timestamp
- Summarize in plain language what was found and what changed (or is pending approval)

## Configuration
The `../../trainer/config.md` file controls behavior:

AUTO_APPLY: false

text

Set to `true` to enable automatic application of safe edits (excludes SOUL.md and USER.md which always require manual approval).

Technical Analysis

The skill treats incident logs, HEARTBEAT.md, and MEMORY.md as evidence for proposed changes to persistent agent configuration. When AUTO_APPLY is enabled, those proposals may be applied to live files without per-change operator approval. Only SOUL.md and USER.md are categorically excluded from automatic modification.

No trust-boundary validation, instruction sanitization, source authentication, protected-section policy, or semantic saf ...[truncated 2451 chars]

Remediation

View remediation

Remediation Suggestions

1. Keep AUTO_APPLY disabled by default and remove the option to apply live-file edits without explicit approval.
2. Require operator approval for every individual change to every persistent file, not only SOUL.md and USER.md.
3. Present an exact unified diff, source evidence, destination file, and affected section before requesting approval.
4. Treat incident logs, memory files, and activity records as untrusted data. Explicitly prohibit following instructions embedded within those sources.
5. Authenticate or integrity-protect incident records and record who or what created each entry.
6. Use an allowlist of files and sections that the skill may propose modifying. Permanently deny changes to safety constraints, tool permissions, approval requirements, and trust policies.
7. Add semantic validation that rejects proposals which expand permissions, disable safeguards, introduce external instructions, request secrets, or alter review controls.
8. Separate proposal generation from application using an independent approval process that does not rely on the same model interpretation.
9. Apply edits through constrained, schema-validated operations rather than unrestricted natural-language modifications.
10. Preserve immutable audit records containing the original input, generated proposal, exact approved diff, approving identity, timestamp, and resulting file hash.
11. Restrict filesystem permissions so the skill can write only to its proposal directory until a trusted approval component applies an accepted patch.
12. Validate ../../trainer/config.md against a strict schema and prevent untrusted processes or reviewed content from changing AUTO_APPLY.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 94% confidence

Finding

The skill instructs the agent to read and act on untrusted content from ../../trainer/logs/incidents.md, HEARTBEAT.md, and MEMORY.md when drafting edits to core files. This creates an indirect prompt-injection path: an attacker who can influence those logs or notes can plant malicious instructions that the self-review process may convert into proposed or even automatically applied configuration changes.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

- Creates `../../trainer/logs/`, `../../trainer/proposals/`, `../../trainer/backups/` directories
- Creates `../../trainer/config.md` with: `AUTO_APPLY: false`
- Creates `../../trainer/logs/.last-review` with: `2000-01-01T00:00:00`
- Creates `../../trainer/logs/incidents.md` with: `<!-- format: ## [YYYY-MM-DD HH:MM] short title / type: fail|friction|win / what happened / what was tried / result / suspected file -->`

- Read every entry in `../../trainer/logs/incidents.md` timestamped after the value in
  `../../trainer/logs/.last-review` (create with far-past date if missing)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrase "run self-review" is broad enough that it may be invoked unintentionally in normal discussion, causing the agent to begin a workflow that reads logs and prepares edits to core configuration files. Because this skill targets sensitive files and can progress toward file modification, accidental activation increases the risk of unintended analysis or configuration changes.

Content

No source excerpt is available for this finding.