Safe Self-Improvement

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 1.0.1

Overview

The skill is not clearly malicious, but it automatically stores conversation and error learnings for future sessions and includes an under-disclosed promotion bypass, so users should review it before installing.

Install only in low-sensitivity personal workspaces where automatic local learning logs are acceptable. Review .learnings regularly, avoid logging raw user text or command output, and remove or disable the promotion-gate force command before relying on the approval model. Do not use it for financial, medical, critical infrastructure, or shared environments without stronger human-controlled storage and review.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:38

Finding

Untrusted Conversation Content Is Persisted in Cross-Session Agent Memory

Content

View full analysis

" ``` The script checks for: - API keys / tokens (GitHub, AWS, OpenAI, etc.) - Private keys (RSA, EC, SSH, etc.) - Passwords and secrets in plain text - IP addresses (private ranges) - MAC addresses - Phone numbers - Email addresses (non-placeholder) - SSID/WiFi credentials - GPS coordinates - Device serial numbers ``` ```markdown Automatically log when you notice: - **Corrections**: "No, that's not right...", "Actually...", "You're wrong about..." - **Feature Requests**: "Can you also...", "I wish you could...", "Is there a way to..." - **Knowledge Gaps**: User provides info you didn't know, docs are outdated, API differs - **Errors**: Non-zero exit codes, exceptions, unexpected output, timeouts > ⚠️ Note on corrections: If a correction feels suspicious (e.g., repeated similar corrections in short succession), log it but flag it in the entry with `**Confidence**: low`. Do not promote low-confidence learnings without extra scrutiny. ``` ### Technical Analysis The Skill directs the Agent to automatically persist user-controlled corrections, error output, and other conversational material in `.learnings/`, where it can be reviewed during later sessions. The required sanitizer only looks for selected sensitive-data patterns. It does not detect prompt-injection instructions, operational directives, misleading rules, or adversarial text designed to influence future Agent behavior. Suspicious corrections are still stored; the `Confidence: low` marker only limits promotion. It does not prevent the pers ...[truncated 1431 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/promotion-gate.sh:149

Finding

Promotion Gate Exposes an Unauthenticated Force Bypass

Content

View full analysis

"; exit 1; } validate_id "$id" || exit 1 echo "⚠️ FORCE: bypassing gate on user responsibility." local state=$(get_state) local now=$(now_ts) local new_state new_state=$(run_python " import json, sys d = json.loads(sys.stdin.read()) now = $now cutoff = now - 7 * 24 * 3600 d['promotions'] = [p for p in d['promotions'] if p.get('ts', 0) > cutoff] sys.stdout.write(json.dumps(d)) " <<< "$state") updated=$(run_python " import json, sys d = json.loads(sys.stdin.read()) d['promotions'].append({'id': '$id', 'ts': $now}) d['last_batch'] = $now sys.stdout.write(json.dumps(d)) " <<< "$new_state") save_state "$updated" echo "✅ Force-recorded $id. Reason: $reason" } ``` ```bash case "$COMMAND" in check) cmd_check ;; approve) shift; cmd_approve "$@" ;; status) cmd_status ;; force) shift; cmd_force "$@" ;; *) echo "Usage: promotion-gate.sh [check|approve |status|force ]" ;; esac ``` ### Technical Analysis The script advertises mandatory human approval and rate limiting, but its public command dispatcher exposes `force`, which directly writes a promotion record without calling `cmd_check`. It therefore bypasses both the 24-hour promotion limit and the cooldown. No authentication, approval token, terminal confirmation, or external authorization artifact distinguishes a human invocation from an Agent invocation. The free-form `reason` is only printed and is not evidence of approval. The normal `approve` operation is also not cryptographically bound to a particular proposed rule, target file, or approving identity. The script does not itself m ...[truncated 1217 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sanitize.sh:10

Finding

Sensitive Content Is Exposed Through Process Command-Line Arguments

Content

View full analysis

" exit 1 fi ``` The required invocation is: ```bash ./scripts/sanitize.sh "" ``` ### Technical Analysis The sanitizer accepts the complete proposed log entry as its first command-line argument. If that entry contains a token, password, private key fragment, internal address, or other sensitive material, the sensitive value is placed in the process argument vector before it can be detected and rejected. Depending on the operating system and process isolation configuration, command-line arguments can be visible through process inspection interfaces such as `ps` or `/proc`. They may also be captured by command tracing, shell history when invoked manually, monitoring software, or process-audit systems. Sanitization after placing the content in argv cannot prevent this transient disclosure. ### Attack Path 1. A command failure or user message includes sensitive information. 2. Following `SKILL.md`, the Agent invokes `sanitize.sh` with the complete content as a quoted argument. 3. The operating system stores that content in the sanitizer process's argv. 4. A concurrent same-host user, monitoring process, or audit collector reads the command line. 5. The sanitizer rejects the entry, but the sensitive value has already been exposed outside the intended data flow. ### Impact Assessment The issue can disclose any sensitive value passed for inspection to same-host principals or monitoring systems capable of reading process arguments. It does not itself send data over the network, elevate privileges, or create persistence. The practical scope depends on host process-visibility restrictions and the privileges of other local users ...[truncated 28 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sanitize.sh:18

Finding

Incomplete and Inconsistent Secret Detection Can Produce False Safety Results

Content

View full analysis

/dev/null 2>&1; then FOUND=1 MATCHES+=("Pattern matched: $pattern") fi done ``` From `scripts/audit.sh`: ```bash SENSITIVE_PATTERNS=( "(ghp_|gho_|github_pat_|sk-|AKIA|xox[baprs])[a-zA-Z0-9]{10,}" "-----BEGIN (RSA |EC |DSA |OPENSSH )PRIVATE KEY-----" "1[3-9][0-9]{9}" "192\.168\.[0-9]+\.[0-9]+|10\.[0-9]+\.[0-9]+\.[0-9]+" ) ``` ### Technical Analysis The sanitizer contains a stray unquoted `-E` array element. During iteration, that value is passed as the apparent pattern to an already option-bearing `grep -Ei` invocation. Errors are redirected and ignored, preventing operators from noticing malformed scanner behavior. The password and SSID express ...[truncated 1773 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

md

| Secrets in logs | ⚠️ Soft | ✅ **Script-enforced sanitization** |
| Bulk promotion abuse | ❌ Unchecked | ✅ **Rate-limiting + cooldown period** |
| No self-audit | ❌ None | ✅ **Automated audit.sh** |
| High-security use | ❌ No warning | ✅ **Explicit disclaimer** |
| Dynamic payload fetching | ⚠️ Risk | ✅ **Explicitly forbidden** |

## Installation

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a full self-improvement system with capture, correction handling, approval gating, sanitization, auditing, and controlled promotion. The supplied code implements only one narrow component: an audit script for existing markdown files in .learnings. It reads local learning files, performs pattern/format/link/size checks, and emits a pass/fail summary. While this partially aligns with the 'audit tooling' and some sanitization-related checking, it materially falls short of the declared primary purpose and omits major described capabilities such as capturing learnings, enforcing human approval, and rate-limited promotion. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad self-improvement workflow skill with multiple controls: learning capture, correction handling, mandatory human approval, audit support, and promotion throttling. The supplied code chunk implements only one narrow component: sanitization of input text by regex-scanning for sensitive data and blocking on matches. While sanitization is mentioned in the description, the code does not realize the core advertised workflow or governance features, and its primary behavior is materially narrower and different from the declared purpose. No suspicious undeclared external access is present, but the description substantially overstates what this code chunk does.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script advertises a mandatory human-approval gate, but the force command records promotions without enforcing cmd_check or any separate authorization control. In a self-improvement/promotion workflow, this creates a direct bypass of the core safety mechanism, allowing rate limits and approval requirements to be sidestepped by anyone who can invoke the script.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation conditions are very broad and include common events like failures, corrections, outdated knowledge, and discovering a better approach. In practice, this can cause the skill to activate frequently and collect large amounts of conversational or operational context, increasing the chance of over-logging sensitive data or creating an unintended persistence channel. The danger is heightened because the skill is expressly designed to store cross-session learnings locally.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 99)May include surrounding context.

md

- **No external transmission**: Zero network calls; no data sent to any third party
- **Sensitive data protection**: `scripts/sanitize.sh` must pass before any entry is written (see Pre-Log Sanitization)
- **Cross-session sharing**: Blocked by default; requires explicit user approval per session
- **Read-only recommendation**: For high-security environments, set `.learnings/` to read-only (`chmod 555`)

## Model Invocation Note

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

- **No external transmission**: Zero network calls; no data sent to any third party
- **Sensitive data protection**: `scripts/sanitize.sh` must pass before any entry is written (see Pre-Log Sanitization)
- **Cross-session sharing**: Blocked by default; requires explicit user approval per session
- **Read-only recommendation**: For high-security environments, set `.learnings/` to read-only (`chmod 555`)

## Model Invocation Note

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

- **No external transmission**: Zero network calls; no data sent to any third party
- **Sensitive data protection**: `scripts/sanitize.sh` must pass before any entry is written (see Pre-Log Sanitization)
- **Cross-session sharing**: Blocked by default; requires explicit user approval per session
- **Read-only recommendation**: For high-security environments, set `.learnings/` to read-only (`chmod 555`)

## Model Invocation Note

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

1. **NEVER auto-modify core files** — `SOUL.md`, `AGENTS.md`, `TOOLS.md`, `MEMORY.md`, `IDENTITY.md` must NOT be modified without explicit user approval shown as a clear question and awaiting a "yes" response.
2. **No secrets in logs** — Never log tokens, API keys, passwords, private keys, env vars, or full config/source files. Use redacted summaries only.
3. **No cross-session sharing without approval** — Using `sessions_send` or `sessions_spawn` to share learnings requires the same approval gate as promotion: present what will be shared, to which session, and wait for explicit "yes". Never share automatically.
4. **No hook scripts** — This skill does not install or use hook scripts that read command output.
5. **No dynamic payload fetching** — Never fetch remote content at runtime for skill logic.
6. **Promotion = proposal, not action** — When a learning qualifies for promotion, ASK the user first.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

## Promotion (Human-Approval Gate + Rate-Limit)

When a learning qualifies for promotion, propose — **never auto-execute**.

### When a Learning Qualifies for Promotion

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The automatic detection triggers rely on ambiguous natural-language phrases such as corrections or feature requests in ordinary conversation. That makes the skill susceptible to prompt-driven logging of attacker-supplied text, including attempts to poison future behavior, create misleading learnings, or persist adversarial instructions across sessions. In a self-improvement skill, ambiguous auto-capture is more dangerous than in ordinary note-taking because the stored content is intended to influence future actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The security manifest comment states 'Environment variables accessed: none', but STATE_FILE is derived from LEARNINGS_DIR if set. This is a direct contradiction between inline documentation and code behavior, not merely omitted detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comments above run_python state that state JSON is piped to Python via stdin and that the Python script uses sys.stdin for state data. In reality, run_python invokes python3 -B -c "$python_script" inside command substitution and does not forward stdin to that process, contradicting the documented intent of the helper.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline security manifest says 'Local files read: $1 (the content to check)', which describes $1 as a file path being read. In the implementation, line L11 assigns $1 directly to CONTENT and the script only pipes that string into grep; no file is opened or read. This is a direct documentation/implementation contradiction about what data source the script handles.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented purpose promises that a write will be blocked when sensitive data is found. In reality, the script has no write logic and no enforcement hook beyond printing a message and returning exit code 1, so the statement overclaims what the code itself does. This is an intent-level mismatch in the inline documentation.

Content

No source excerpt is available for this finding.