Security audit

Self-Improving + Proactive Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local self-improvement memory system, but it also installs persistent agent steering and long-term memory behavior with scope and consent gaps that users should review first.

Install only if you want an agent to keep long-term local learning files and modify workspace guidance so future sessions consult them. Before setup, review the exact edits to AGENTS.md, SOUL.md, and HEARTBEAT.md, decline the optional Proactivity install unless you trust the resolved package, and avoid storing sensitive corrections or secrets in memory.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Warning

Location: setup.md:75
Finding: Persistent workspace steering can propagate mutable memory rules across sessions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: boundaries.md:44
Finding: Full-memory deletion workflow can retain an exported copy after a forget request
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: setup.md:87
Finding: Optional Proactivity Skill is installed from an unpinned mutable dependency reference
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill claims it only reads within ~/self-improving/, but its documented setup flow references modifying workspace files such as AGENTS.md, SOUL.md, and HEARTBEAT.md. This mismatch weakens user trust and consent boundaries because operators may approve the skill under a narrower filesystem access model than it actually uses.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill describes automatic logging and long-term retention of corrections and preferences, but the user-facing description does not prominently warn that these statements may be stored persistently in local files. This creates a privacy and consent risk because users may reveal preferences, habits, or sensitive workflow details without realizing they will be retained and reused.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatic logging of free-form user statements into persistent memory can capture sensitive data incidentally, including personal preferences, confidential project details, or secrets phrased as corrections. Even with a stated boundary not to store credentials, plain-language workflows are error-prone and may still preserve sensitive content that can later be surfaced or exposed.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
md
- Pattern used 3x in 7 days → promote to HOT - Pattern unused 30 days → demote to WARM - Pattern unused 90 days → archive to COLD - Never delete without asking ### 4. Namespace Isolation - Project patterns stay in `projects/{name}.md`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · boundaries.md (reported line 11)May include surrounding context.
md
| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk | | Medical | Diagnoses, medications, conditions | Privacy, HIPAA | | Biometric | Voice patterns, behavioral fingerprints | Identity theft | | Third parties | Info about other people | No consent obtained | | Location patterns | Home/work addresses, routines | Physical safety | | Access patterns | What systems user has access to | Privilege escalation |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phrase "forget everything" is broad and could plausibly appear in ordinary conversation, quoting, or hypothetical discussion, causing an unintended destructive action. In a self-improving agent with persistent memory, accidental triggering could erase state unexpectedly and disrupt user workflows or destroy user-controlled records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The kill-switch defines immediate export-and-wipe behavior but does not require an upfront warning in the skill description or a just-in-time confirmation that the operation is destructive. Users may invoke it without understanding that stored memory will be irreversibly removed, which is more risky in a skill explicitly designed for long-term self-learning and memory retention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to log and persist user corrections and preferences, but it does not require a clear user-facing disclosure, consent flow, or retention boundary. In a self-improving agent, silent accumulation of behavioral data can create privacy and profiling risk, especially when preferences may span global, domain, and project namespaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented archival and history behavior preserves prior preferences and reversals over time without an explicit warning to the user that historical preference data remains stored. That increases the risk of unexpected long-term retention of behavioral history, which can expose sensitive inferences or create privacy surprises even after a user changes their mind.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill describes automatic loading, searching, writing, deduplication, and cross-tier memory management of user data without any explicit notice, consent boundary, or privacy control. In a self-improving agent, this is dangerous because the agent may persist sensitive user information, corrections, or project context beyond the user's expectations, creating privacy, retention, and data-minimization risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The weekly maintenance workflow automatically scans, moves, archives, and compacts stored memory based on age, but it does not warn users about retention periods or background data lifecycle changes. This can lead to silent long-term preservation or relocation of sensitive information, reducing transparency and increasing the chance of unintended data exposure or noncompliant retention behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file explicitly recommends an "Aggressive learning, minimal confirmation" strategy for power users without any adjacent safeguards on what may be retained, how long it is stored, or when user consent is required. In a self-improving memory skill, this increases the chance that personal preferences, sensitive workflow details, or project data are persistently captured without sufficiently informed user awareness, making privacy harm more likely in context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup directs creation of multiple files and directories under ~/self-improving/ without an upfront, explicit warning that the skill will modify the user’s filesystem. This is risky because it normalizes persistent writes to the home directory and can lead users to approve setup without understanding that durable local state is being created.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions tell the agent to alter AGENTS.md, SOUL.md, and later HEARTBEAT.md, which are behavior/configuration files that can materially change future agent conduct, but they do not prominently warn the user about those modifications. Silent or under-disclosed edits to steering files are especially sensitive because they persistently influence later sessions and may be difficult for users to notice or audit.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill’s setup flow expands scope by instructing installation and activation of an additional Proactivity skill, creating a transitive trust problem: the user asked for one skill, but setup attempts to bring in another with its own behavior and permissions. Even though it asks for user agreement first, this coupling increases attack surface and can surprise users by changing agent behavior beyond the advertised self-improving function.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: L223 states this skill 'NEVER' makes network requests, but L240-L250 instructs installation, starring, and syncing via clawhub, and L051 notes optional installation of another skill may require network access. Even if these are user-confirmed auxiliary actions, the absolute 'never' wording conflicts with the rest of the file's operational guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template explicitly instructs creation of directories and files under ~/self-improving on first activation, which is a real filesystem side effect without any embedded warning, consent check, or scoping guidance. In the context of a proactive self-improving agent, this is more concerning because the agent may autonomously decide to activate the skill and persist data, increasing the chance of unexpected writes to the user's home directory and long-term storage of potentially sensitive content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to read and use files under the user's home directory, including persistent state in ~/self-improving/heartbeat-state.md, without any notice, consent, or scope limitation. In an agent skill, this creates a privacy and data-boundary risk because the model may access local user data or persistent memory outside the immediate task context, and the self-improving/proactive framing makes such background access more likely to be normalized.
Content: No source excerpt is available for this finding.