Security audit

Safe Self Improving

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly local and consent-based, but its privacy promises conflict with documented options to install generated skills and publish them externally.

Install only if you are comfortable with a skill that stores local learning records and can generate reusable skill drafts. Before using install or publish options, review generated content for secrets or private project details, because those actions go beyond the stated `.learnings/`-only boundary.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The changelog introduces capabilities beyond simple consent-based learning, including export, analytics, and automatic skill-draft generation. Even without executable code in this file, this discrepancy is security-relevant because it signals scope expansion into data egress and content generation features that can undermine the claimed privacy-first boundary if not explicitly constrained and documented.

Intent-Code Divergence

High

Confidence: 93% confidence
Finding: The security claim that all data is stored only in `.learnings/` is contradicted by the addition of a separate `skill-drafts/` directory. This inconsistency weakens trust in storage-boundary guarantees and can mislead users or reviewers about where potentially sensitive derived content is written, increasing the risk of unreviewed persistence or exposure.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill explicitly promises writes are confined to `.learnings/` and that there is no silent modification, yet later offers saving generated output into `skills/` and publishing externally. This kind of capability/manifest mismatch is dangerous because operators may trust the declared safety boundary while the documented behavior expands write scope and enables propagation of generated content beyond the claimed sandbox.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The file claims 'only write under `.learnings/`' and describes `.learnings/` as the sole write location, but elsewhere permits writing into `skills/`. Contradictory safety guarantees weaken trust boundaries and can lead users or orchestration systems to approve a skill under false assumptions about filesystem scope.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill advertises 'no cross-session' and 'all data stays local, not uploaded', but later includes a publication path to ClawHub. Even if publication requires confirmation, this still contradicts the privacy/storage guarantee and may cause sensitive patterns derived from local learnings to be exfiltrated under a misleading 'local-only' trust model.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Several trigger phrases are common conversational language such as '记下来', '最佳实践', or '怎么改进', which increases the chance of accidental activation during normal discussion. In a skill that reads and writes local files, unintended triggering can lead to undesired persistence, deletion requests, exports, or draft generation even without a deliberate intent to invoke the skill.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.