Security audit

self-improvement

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent self-improvement helper, but it encourages broad prompt-triggered hooks and persistent memory/prompt-file writes without enough scoping or privacy controls.

Install only if you want the agent to keep local learning records and possibly turn them into future-session instructions. Prefer project-level hooks, avoid the global hook setup unless you understand the cross-project exposure, review .learnings before promotion, and do not store secrets, credentials, private personal details, or sensitive business data in MEMORY.md or injected prompt files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The README says the skill activates automatically for broad conditions like any unexpected failure, user correction, missing capability, or discovery of a better approach. In a self-improvement skill, this can cause over-collection of interaction data and trigger logging on sensitive or irrelevant events, especially because the documentation does not define scope limits, consent, filtering, or exclusion rules.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The feature list advertises automatic error logging, learning capture, periodic review, and memory integration, but it does not warn that user prompts, corrections, command output, or operational context may be stored persistently. This creates a privacy and data-handling risk because sensitive information could be retained in `.learnings` or promoted to long-term memory without informed consent or retention controls.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The empty matcher on UserPromptSubmit causes the hook to run for every prompt, creating a broad interception point across all interactions in the project. In the context of a self-improvement skill, this increases the chance of capturing unnecessary or sensitive context and expands the blast radius if the hooked script is later changed, replaced, or abused.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The user-level configuration enables the hook globally for all sessions, not just a specific trusted project, which broadens exposure to unrelated repositories and prompts. Because hook scripts run with the same permissions as the agent environment, global activation increases the impact of script compromise, misconfiguration, or unintended data collection.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The Codex example also uses an empty matcher, so the hook activates on every prompt without meaningful scope restriction. In a skill designed to observe failures, corrections, and learnings, this broad trigger is more dangerous because it normalizes pervasive monitoring rather than event-driven activation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guidance explicitly promotes learned content into persistent workspace prompt files such as AGENTS.md, SOUL.md, and TOOLS.md, which are later injected into future sessions. This creates a prompt-persistence channel where mistakes, adversarial user content, or poisoned summaries can become durable instruction-layer influence without a clear warning, validation step, or trust boundary.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill recommends persisting user preferences, habits, and important information into MEMORY.md without defining sensitivity boundaries, consent rules, or exclusion categories. In practice this can cause retention of personal, confidential, or security-relevant conversation data beyond the original interaction, increasing privacy and data-handling risk.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Routine review and promotion of recent conversation-derived learnings into long-term memory encourages systematic accumulation of user-provided data. Without sensitivity filtering, retention policy, or purpose limitation, this can transform transient chat content into durable records that may later be reused inappropriately or exposed to other tasks.

Session Persistence

Medium

Category: Rogue Agent
Content: - 🎓 **Learning Capture**: Record corrections and discoveries - 🔄 **Periodic Review**: Regular retrospectives to consolidate learnings - 🧠 **Memory Integration**: Promote important patterns to long-term memory - 🛡️ **Rule Formation**: Create hardened rules to prevent recurring mistakes ## How It Works
Confidence: 90% confidence
Finding: Create hardened rules to prevent recurring mistakes ## How It Works ``` Error occurs → Log immediately → Periodic review → Integrate to memory → Form rules → Prevent recurrence ``` This isn't just

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.