TrustLoop Skill Evolver

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:30 AM UTC
• Version: 0.1.2

Overview

This skill is purpose-built to manage learned skills, but it can persist workflow records and, in autonomous mode, change future agent behavior without per-change review.

Install only if you want a workspace-local system that observes repeatable workflows and writes managed skill candidates. Keep it in manual mode for normal use, review ./.skill-evolver audit and candidate files before publishing, and enable autonomous mode only in workspaces where automatic changes to learned skills are acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

md

## At A Glance

- Quietly learns repeatable workflows instead of interrupting every successful task.
- Gives users a real review loop, not a black-box self-modifying system.
- Keeps changes workspace-scoped, auditable, and rollback-friendly.
- Prefers patching or merging over spraying new `learned-*` skills everywhere.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · README.md (reported line 446)May include surrounding context.

md

This project is not trying to be:

- background autonomous self-rewrite
- online model fine-tuning
- unrestricted skill mutation
- a replacement for product judgment

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

- The target `SKILL.md` frontmatter contains `managed-by: skill-evolver`

Self-Modification

High

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

This design intentionally allows patching existing skills, which is a form of self-modification. Although limited to skills marked 'managed-by: skill-evolver' and to paths under the workspace, compromising the review/dedupe/risk logic would let the system alter its own future instructions and behavior, which is inherently high impact in an agentic environment.

Content

Scanner excerpt · references/skill-manage-managed-tool.md (reported line 169)May include surrounding context.

md

- only read and write inside the active workspace root
- only publish to `./skills/learned-*`
- only patch skills with `managed-by: skill-evolver`
- perform backup and publish atomically
- update registry and audit together
- reject unmanaged targets

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The documented assisted and autonomous modes allow the system to auto-approve or auto-publish changes to managed skills based on its own low-risk classification. Any misclassification, prompt manipulation, or overbroad rule can let the agent change future behavior without direct human review, increasing the chance of unsafe or persistent workspace modifications.

Content

Scanner excerpt · README.md (reported line 117)May include surrounding context.

md

| Mode | What it does | Best for |
| --- | --- | --- |
| `manual` | Creates candidates and waits for human approval before publishing | Teams that want maximum control |
| `assisted` | Auto-approves low-risk updates but still keeps publishing manual | Teams that want less busywork without giving up review |
| `autonomous` | Auto-publishes low-risk patches to `main` and low-risk new skills to `canary` | Teams that want fast iteration with strict low-risk boundaries |

Default mode: `manual`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly documents an autonomous mode that can publish low-risk patches and create new skills in the workspace, but it does not pair that capability with a prominent warning about file modification, review expectations, or possible unintended changes. Even though the document describes boundaries, users may still underestimate that the system can alter reusable behavior and write artifacts without a per-action prompt in autonomous mode.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

This section reiterates that low-risk updates may be auto-approved and directly published in autonomous mode, which means the system can make durable behavior changes based on internal judgment rather than explicit review. In a self-evolving skill context, that increases the risk of accumulating unsafe instructions, broadened triggers, or unintended file operations across future sessions.

Content

Scanner excerpt · README.md (reported line 182)May include surrounding context.

md

In `manual`, the draft only becomes a managed skill after approval.

In `assisted`, low-risk updates may be auto-approved, but publish still stays manual.

In `autonomous`, low-risk patches can publish directly and low-risk new skills can go out as canaries.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The phrase 'identify reusable workflows when appropriate' leaves activation criteria subjective and underspecified, which is risky for a skill designed to observe user tasks and evolve behavior over time. Without precise thresholds and exclusions, the agent may over-collect, infer learning opportunities from sensitive or one-off workflows, or initiate the review loop in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises both explicit commands and vague natural-language triggering, but does not define clear activation boundaries for when the agent should treat user text as a request to evolve, review, publish, or modify skills. In a self-modifying or skill-managing context, ambiguous triggering can cause unintended candidate creation, approval flow entry, or publication-related actions from ordinary conversation, increasing the risk of unauthorized or surprising workspace changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is explicitly configured as always-on, which broadens its activation surface and allows it to observe or act during many unrelated tasks. Even though the document includes scope limits and safety rules, always-on behavior increases the chance of unintended candidate creation, unsolicited state writes, or interaction with sensitive workspace content without a clear user trigger.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The skill permits assisted and autonomous modes that can auto-approve or auto-publish low-risk changes. Risk classification is performed by the skill itself, so a misclassification or prompt-manipulated workflow could cause unauthorized modification of skills in the workspace, especially because the skill can publish directly into ./skills/.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

- default mode
  - create candidates, ask for review, and require a human approval before any publish
- `assisted`
  - auto-approve low-risk updates such as low-risk `patch_skill`
  - keep all publishing manual
- `autonomous`
  - auto-publish low-risk `patch_skill` updates to the managed skill directly

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The rules direct the agent to create, modify, publish, and roll back files in the workspace, including under ./skills/ and ./.skill-evolver/, without requiring an explicit user-facing warning or confirmation that local files will be changed. This increases the chance of unintended state changes, especially because the same document also enables approval and publishing flows that can alter managed skills.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The autonomy modes authorize automatic approval and, in autonomous mode, automatic publication of low-risk skill changes, allowing the agent to make trust and deployment decisions without a human in the loop. Because 'low-risk' is not concretely defined or enforced by a robust external policy gate, a misclassified or adversarial candidate could be promoted and modify active skills.

Content

Scanner excerpt · references/evolution-rules.md (reported line 53)May include surrounding context.

md

- create candidates only
  - require human approval before publish
- `assisted`
  - auto-approve low-risk updates
  - keep publishing manual
- `autonomous`
  - auto-publish low-risk `patch_skill` updates to `main`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The assisted-mode rules permit auto-approval of low-risk patch and deprecate changes, which still allows the agent to advance potentially harmful modifications through the workflow without direct user review. Even without auto-publish, automatic approval weakens change-control and can normalize unsafe candidates for later publication.

Content

Scanner excerpt · references/evolution-rules.md (reported line 267)May include surrounding context.

md

### `assisted`

- auto-approve low-risk `patch_skill` and low-risk `deprecate_skill`
- keep low-risk `create_skill` candidates in review
- never auto-publish

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The autonomous-mode rules explicitly allow auto-publishing low-risk patch candidates to main and create-skill candidates to canary, giving the agent authority to deploy workflow changes into managed skill locations. In the context of a skill that writes SKILL.md files and maintains publication state, this materially increases the risk of unauthorized or unsafe behavior being operationalized.

Content

Scanner excerpt · references/evolution-rules.md (reported line 275)May include surrounding context.

md

- auto-publish low-risk `patch_skill` candidates to `main`
- auto-publish low-risk `create_skill` candidates to `canary`
- auto-approve, but do not auto-publish, low-risk `deprecate_skill`
- leave medium- and high-risk candidates in review

## Publish Procedure

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · references/review-policy.md (reported line 15)May include surrounding context.

md

- access sensitive paths such as SSH keys, token stores, or shell profiles
- copy, upload, or exfiltrate secrets, credentials, or private files
- expand the workflow to use more dangerous tools than the source workflow required
- encode prompt-injection text as reusable instructions
- depend on bundled-skill internals or third-party skill directories
- duplicate an existing managed skill without a clear material difference

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

### `assisted`

- auto-approve only low-risk updates
- do not auto-publish
- keep low-risk new-skill candidates in review

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/review-policy.md (reported line 64)May include surrounding context.

md

### `assisted`

- auto-approve only low-risk updates
- do not auto-publish
- keep low-risk new-skill candidates in review

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/skill-manage-managed-tool.md (reported line 152)May include surrounding context.

md

### `assisted`

- auto-approve only low-risk updates
- do not auto-publish
- keep low-risk new-skill candidates in review

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/review-policy.md (reported line 107)May include surrounding context.

md

- silence
- unrelated follow-up
- vague praise without approval intent
- approval for a different candidate

Treat these as revision input rather than approval or rejection:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents auto-publish, backup, registry updates, audit writes, and rollback-related operations that can affect user data and system state. While it describes safety guarantees, it does not clearly warn users that these behaviors will write files and may automatically publish changes when autonomous mode is enabled.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The autonomous mode explicitly permits auto-publishing low-risk patch and create operations. Even with scope restrictions, misclassification of 'low-risk' changes or weak review logic could allow unreviewed self-modifying updates to be written into the workspace and skill registry, making the agent behavior drift over time without human verification.

Content

Scanner excerpt · references/skill-manage-managed-tool.md (reported line 160)May include surrounding context.

md

- auto-publish low-risk `patch_skill` candidates to `main`
- auto-publish low-risk `create_skill` candidates only as `canary`
- auto-approve low-risk non-patch updates when safe
- leave medium- and high-risk changes in review

## Required Safety Guarantees

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The audit section states that lifecycle actions can be written under ./.skill-evolver/audit/ and may record why workflows were learned, matched rules, and what changed, but it does not clearly warn that user workflows and review content may be persisted locally. This creates a privacy and data-handling risk because sensitive task details or prompts could be retained longer than users expect.

Content

No source excerpt is available for this finding.