Security audit

Curiosity Loop — Intrinsic Curiosity-Driven Continuous Learning

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it gives an agent broad long-term learning, logging, scanning, and self-update behavior without enough user control.

Install only if you want an agent to keep a persistent learning log, fetch configured external sources, and potentially update skills or memory. Review ~/.hermes/deltas.json before use, avoid cron/background scanning unless explicitly needed, and require manual approval for any skill patch/create or memory write.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill describes file reads/writes and network-enabled scanning behavior, but it does not declare permissions or clearly scope those capabilities. This is dangerous because users and the host framework cannot reliably enforce least privilege or make informed trust decisions, especially when the skill also recommends periodic unattended execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The top-level description presents the skill as a learning framework, but the body also includes operational behavior such as reading local config, making network requests, scanning YouTube sources, and rewriting local state. This mismatch is risky because reviewers may approve it as conceptual guidance while overlooking concrete data access, network activity, and persistence side effects.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script performs outbound network access to YouTube and persists state changes to a user config file, but the skill description only frames the capability as curiosity-driven learning. This mismatch reduces user transparency and can lead to unexpected data collection and silent state mutation, which is a security-relevant behavior even if not overtly malicious.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The docstring states the script only outputs a summary, but the implementation also updates deltas.json by changing last_scanned timestamps. Hidden write behavior is dangerous because operators may run the script expecting a read-only action, leading to silent state changes that affect future behavior and auditability.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs persistent storage of delta records including context, expected results, actual results, gaps, and resolutions in a local audit file without any retention warning or data minimization guidance. Those fields can easily capture sensitive prompts, user data, internal paths, credentials, or proprietary workflow details and keep them beyond the session.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill promotes proactive external scanning and cron-based scheduled execution without prominently warning about recurring network traffic, remote content retrieval, and silent background behavior. This can surprise users, violate network policy, and create a persistence mechanism that continues operating after the original interaction ends.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script overwrites the persistent deltas.json file unconditionally and without user warning, confirmation, locking, or atomic write safeguards. This can cause unintended state loss or corruption, especially if the file is manually edited, shared across processes, or if the script fails during write operations.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The skill encourages durable storage of interaction-derived information in memory and delta logs, including broad descriptions of what happened and how it was resolved. In context, this creates a natural data retention and leakage risk because troubleshooting details often include sensitive user inputs, system state, tool outputs, or internal operational knowledge.

Self-Modification

High

Category: Rogue Agent
Content: --- name: curiosity-loop description: "Intrinsic curiosity-driven continuous learning: detect gaps between expected and actual results, treat them as curiosity signals, and update skills accordingly. Inspired by developmental AI from Flowers Lab, INRIA." version: 1.0.0 author: Guillaume D license: MIT
Confidence: 95% confidence
Finding: update skill

Self-Modification

High

Category: Rogue Agent
Content: ## Maintenance ### When to patch this skill - If loop steps become redundant or obsolete - If new activation signals are discovered - If the delta tracking format changes
Confidence: 93% confidence
Finding: patch this skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.