Security audit

self-improving-agent

Security checks across malware telemetry and agentic risk

Overview

This skill openly records agent learnings and optional session-end error summaries, with disclosed persistence and opt-in hook behavior, though users should treat its logs as potentially sensitive.

Install only if you want durable agent memory for errors, corrections, and workflow patterns. Keep .learnings out of version control unless intentionally sharing it, review entries before promotion into AGENTS.md/TOOLS.md/SOUL.md, and enable the optional hook only if transcript-derived error summaries are acceptable in your workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill embeds shell commands, git clone/cp flows, hook enablement, and references to cross-session features, which imply filesystem, environment, and network capabilities, but the manifest does not declare any permissions or capability boundaries. That mismatch increases the chance an agent or user will run the skill with broader access than expected, weakening review and least-privilege controls.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill presents itself as a logging mechanism, but it also directs agents to modify inherited workspace control files such as AGENTS.md, TOOLS.md, and SOUL.md. That is a scope expansion from passive note-taking into persistent prompt and behavior mutation, which can indirectly alter future agent behavior across sessions without strong user review.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Automatic skill extraction goes beyond recording learnings and creates new reusable agent capabilities from prior observations. This turns the skill into a capability-generation mechanism, which can propagate bad guidance, insecure patterns, or prompt-injection-derived content into future sessions if not tightly reviewed.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Cross-session transcript access and message passing grant visibility into other sessions and a channel to influence them, which is broader than needed for local learning capture. Even though the text advises trusted environments and explicit user intent, the capability materially increases the risk of data leakage, unintended sharing of sensitive context, and lateral prompt contamination between sessions.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The optional hook performs automatic transcript sweeping to detect errors and write them into persistent logs, which introduces passive session monitoring beyond straightforward manual note capture. Even as opt-in, this can collect more context than intended, preserve sensitive operational details, and normalize automated surveillance of session content.

Session Persistence

Medium

Category: Rogue Agent
Content: ## Opt-In and Safety - The sweep only runs when `<workspace>/.learnings/` exists — create that directory to enable it, delete it to disable it - `ERRORS.md` is created only if missing and is otherwise appended to, never overwritten
Confidence: 79% confidence
Finding: This hook intentionally persists excerpts from prior session transcripts into `.learnings/ERRORS.md`, creating cross-session retention of operational data. Even with truncation and regex-based redaction, transcript excerpts can still contain sensitive context, proprietary commands, file paths, internal URLs, or secrets that do not match the redaction patterns, so the persistence mechanism increases confidentiality risk.

Session Persistence

Medium

Category: Rogue Agent
Content: `<workspace>/.learnings/ERRORS.md` (only if `.learnings/` exists — see [Error Detection](#error-detection)) ### 3. Create Learning Files Create the `.learnings/` directory in your workspace:
Confidence: 83% confidence
Finding: The skill explicitly instructs creation of persistent `.learnings/` storage in the workspace or skill directory, and elsewhere describes appending error excerpts from transcripts into `ERRORS.md`. Persisting session-derived content can retain sensitive data, internal paths, commands, or fragments of secrets beyond the active session, increasing exposure through later access, sync, backup, or accidental commit.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.