Self-Improving Agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:06 AM UTC
• Version: 0.2.0

Overview

This skill is not outright malicious, but it gives the agent broad long-term learning powers that can persistently change memory and skill behavior.

Install only if you intentionally want an agent to keep long-term records of tasks, errors, feedback, and reusable patterns, and to propose persistent skill changes. Use it in workspaces where that retention is acceptable, review every proposed memory or skill update carefully, and avoid using it around secrets or sensitive project context unless triggers, retention, and review controls are tightened.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:110

Finding

Untrusted Task Content Can Poison Persistent Agent Memory

Content

View full analysis

= 0.9), requires user confirmation | | Append to | `memory/YYYY-MM-DD.md` | Session summary and key learnings, requires user confirmation | | Full CRUD | `memory/self-improving/*` | Self-Improving Agent's own memory space, free to manage | ``` ```markdown ### Phase 4: Memory Consolidation 1. **Update semantic memory** — add or update patterns in `memory/self-improving/semantic/patterns.json` 2. **Store episodic memory** — write episode to `memory/self-improving/episodic/YYYY/YYYY-MM-DD-{task}.json` 3. **Update pattern confidence** — increase confidence for patterns that were successfully applied, decrease for those that led to errors 4. **Prune outdated patterns** — lower confidence for patterns with no recent applications; archive patterns below 0.3 confidence 5. **Supplement Agent memory** — propose additions to Agent's own memory files. ``` ### Technical Analysis The Skill converts task details, errors, user feedback, and inferred lessons into persistent semantic and episodic memory. It grants itself unrestricted create, read, update, and delete access to `memory/self-improving/*`, but does not define a trust boundary, provenance-validation mechanism, instruction sanitizer, or approval gate before behavioral patterns are stored and later reused. The approval requirement for modifying skill files, `MEMORY.md`, and daily Agent memory is a useful mitigating control. However, it does not cover the dedicated semantic and episodi ...[truncated 2111 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:110

Finding

Unconditional Reading of Broad Agent Memory Violates Least-Privilege Access

Content

View full analysis

= 0.9), requires user confirmation | | Append to | `memory/YYYY-MM-DD.md` | Session summary and key learnings, requires user confirmation | | Full CRUD | `memory/self-improving/*` | Self-Improving Agent's own memory space, free to manage | ``` ```markdown ### DO - Learn from EVERY significant task interaction - Extract patterns at the right abstraction level — general enough to reuse, specific enough to be actionable - **Always present proposed changes to the user and wait for explicit confirmation** before writing to skill files OR Agent memory (`MEMORY.md`, `memory/YYYY-MM-DD.md`) - Update multiple related skills when a pattern applies broadly - Track confidence and application counts for all patterns - Ask for user feedback on improvements - Use evolution/correction markers for full traceability - Validate guidance before applying broadly - Read `MEMORY.md` and today's `memory/YYYY-MM-DD.md` at the start of each self-improvement cycle for context ``` ### Technical Analysis The Skill instructs the Agent to read all of `MEMORY.md` and the current daily memory file at the beginning of every self-improvement cycle. Access is unconditional rather than being limited to records necessary for the active task. Core and daily memory may contain unrelated project information, private conversation details, operational data, or other sensitive context. The Skill does not specify field-level filtering, purpose limitation, secret redactio ...[truncated 1615 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The skill explicitly enables self-modification of skill files after user confirmation, which is a real risky capability because it allows persistent prompt/instruction changes based on runtime interactions. Even with a confirmation gate, an attacker could socially engineer approval or poison the proposed updates, leading to durable compromise of future agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

Confirm this update? (yes/no/modify)

text

Once confirmed, update skill files with **evolution markers** for traceability:

```markdown
<!-- Evolution: 2025-01-12 | source: ep-2025-01-12-001 | task: debugging -->

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This section confirms the skill is designed to modify skill files and agent memory, establishing persistent state changes as a core feature. The hard-rule confirmation language reduces accidental writes but does not eliminate the underlying risk of prompt injection, memory poisoning, or approval phishing that can permanently alter agent behavior.

Content

Scanner excerpt · SKILL.md (reported line 445)May include surrounding context.

md

- **NEVER modify skill files or Agent memory files without user confirmation** — this is a hard rule with no exceptions
- **NEVER overwrite** Agent memory content — always append at the end
- Over-generalize from a single experience — wait for 2-3 occurrences before creating a pattern
- Update skills without confidence tracking
- Ignore negative feedback — it's the most valuable signal
- Make changes that break existing, working functionality
- Create contradictory patterns — resolve conflicts explicitly

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The automatic triggers are broad enough that the skill could activate during ordinary workflows without an explicit user request in that moment. In a self-modifying or memory-writing skill, unintended activation increases the chance of collecting extra context, persisting sensitive data, or proposing changes based on incomplete or irrelevant interactions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly describes merging working memory and session context into long-term memory after conversation end, which creates a substantial data-retention risk. Session and error contexts often contain secrets, personal data, tokens, proprietary code, or sensitive prompts, so persistent storage can magnify privacy exposure and leak impact far beyond the original interaction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Several manual trigger phrases are conversational and may overlap with normal reflective dialogue, causing the skill to activate when the user did not intend to invoke long-term learning behavior. Because this skill handles persistent memory and skill-update proposals, accidental invocation can expose more context to retention and alter agent behavior over time.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The memory layout persists current session data, last error context, and dated task records in files, implying broad and durable retention of user-provided content. This is especially risky in a self-improving agent because error logs and episodic records frequently capture the most sensitive material, and the indexed long-term structure makes later retrieval or unintended reuse easier.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill triggers after important tasks, when errors occur, and when sessions end, but it does not clearly define what counts as an 'important task' or the boundaries for activation. These broad conditions could cause unintended invocation during many normal interactions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The appendix repeatedly states that user confirmation is required before updates to skills or long-term memory, but the self-correction flow shows a path where corrections are applied after confirmation without clearly limiting what may be changed, and the broader documentation elsewhere describes autonomous memory writes. In a self-improving agent, ambiguity around approval boundaries is dangerous because the agent may interpret this as authorization to modify persistent behavior or memory beyond what the user explicitly reviewed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The README uses Chinese as the default language for descriptions, examples, and most trigger phrases, with no explicit opt-in or alternative language guidance for users. This can amount to a language policy issue when the skill appears to require or assume a specific language without offering choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The activation description prominently specifies Chinese trigger phrases such as '自我进化' and '总结经验' without stating that users may choose their preferred language or locale. This can create a language-policy issue because the skill appears to privilege a specific language for invocation without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The phrase 'User asks to improve a specific skill or workflow' is a broad natural-language condition, not a constrained trigger phrase. This can overlap with ordinary requests and make it unclear when the skill should activate automatically versus when it should remain inactive.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.