Security audit

Self-Improving + Proactive Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local memory system, but it persistently changes agent behavior and stores user-derived lessons across sessions with incomplete consent and deletion safeguards.

Install only if you want a durable, local memory layer that can influence future agent behavior. Before use, require explicit opt-in for persistence, review proposed memory entries before they are written, inspect changes to AGENTS.md/SOUL.md/HEARTBEAT.md, avoid storing sensitive or confidential context, and treat any export made during deletion as another copy that must be managed or deleted.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: setup.md:75
Finding: Persistent Behavioral Instructions Can Poison Future Agent Sessions
Content: View full analysis
.md` - Project-only override → append to `~/self-improving/projects/.md` - Keep entries short, concrete, and one lesson per bullet; if scope is ambiguous, default to domain rather than global - After a correction or strong reusable lesson, write it before the final response ``` ```markdown ### 7. Add HEARTBEAT.md Steering Add this section to your `HEARTBEAT.md`: ```markdown ## Self-Improving Check - Read `./skills/self-improving/heartbeat-rules.md` - Use `~/self-improving/heartbeat-state.md` for last-run markers and action notes - If no file inside `~/self-improving/` changed since the last reviewed change, return `HEARTBEAT_OK` ``` ``` ### Technical Analysis The setup process does more than create isolated data files. It inserts durable instructions into `SOUL.md`, `AGENTS.md`, and `HEARTBEAT.md`, which are workspace steering files that may be loaded in futu ...[truncated 2280 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:53
Finding: Persistent Logging Occurs Without a Consistent Cross-Session Consent Gate
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: boundaries.md:44
Finding: Full Memory Deletion Can Create an Undeleted Export Copy
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.md:89
Finding: Optional Companion Skill Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs automatic persistence of user corrections, preferences, and repeated patterns into local files, but the behavior description does not pair this with a clear just-in-time notice or consent flow. This creates a privacy and data-retention risk because users may reveal sensitive preferences or personal information during normal interaction without realizing it will be stored across sessions.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
md
- Pattern used 3x in 7 days → promote to HOT - Pattern unused 30 days → demote to WARM - Pattern unused 90 days → archive to COLD - Never delete without asking ### 4. Namespace Isolation - Project patterns stay in `projects/{name}.md`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · boundaries.md (reported line 11)May include surrounding context.
md
| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk | | Medical | Diagnoses, medications, conditions | Privacy, HIPAA | | Biometric | Voice patterns, behavioral fingerprints | Identity theft | | Third parties | Info about other people | No consent obtained | | Location patterns | Home/work addresses, routines | Physical safety | | Access patterns | What systems user has access to | Privilege escalation |

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The kill switch is triggered by the plain-language phrase "forget everything," which could plausibly appear in ordinary conversation, examples, or quoted text. In a self-improving agent with memory features, an overly broad trigger can cause unintended erasure of stored state and disrupt integrity, continuity, and user expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The procedure performs a destructive wipe immediately after a single trigger phrase and only exports data first, without requiring a separate confirmation step. This creates a risk of accidental or manipulated deletion, especially in an agent designed to persist and organize memory across sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to log and potentially persist user corrections and preferences across scopes such as global, domain, project, and person-specific namespaces, but it provides no notice, consent, retention boundary, or disclosure about how that data is stored and reused. In a self-improving agent context, this is more dangerous because the skill encourages accumulation of behavioral/profile data over time, which can create privacy risks, unintended profiling, and cross-context leakage if the memory system is shared or insufficiently isolated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The reversal flow says to archive old patterns, keep history, and log reversals with timestamps, but it does not warn the user that historical preference data will be retained even after changes. This creates a privacy and governance risk because timestamped behavioral history can reveal user habits or sensitive context over time, and the self-learning nature of the skill increases the likelihood that such records will silently accumulate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill specifies automatic loading of persistent memory files at session start without any indication that the user is informed or asked for consent. In a self-improving memory skill, this increases privacy risk because prior sensitive preferences, corrections, or project context may be silently injected into future conversations and influence outputs without transparency.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes automatic persistence of corrections and namespace data to files, including timestamps and contextual details, without warning the user that their inputs will be stored long-term. This is dangerous because users may provide sensitive instructions, preferences, or project information expecting ephemeral use, while the system instead creates durable records that can later be reused, exposed, or misapplied across contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guidance explicitly recommends 'aggressive learning' with minimal confirmation for power users, which can cause the agent to persist preferences, corrections, or behavioral patterns without sufficiently validating user intent or sensitivity. In a self-improving memory skill, this increases the chance of over-collection, mistaken long-term storage, and privacy-impacting retention of user data or project context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These instructions explicitly tell the agent to persist user corrections and reusable lessons into files under ~/self-improving/ for reuse across future tasks. Cross-task persistence of user-provided content can create privacy, data-retention, and prompt-injection risks because sensitive or adversarial instructions may be stored and later treated as trusted guidance.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to retain and reuse factual continuity and performance lessons from prior conversations, including reading this memory before future non-trivial work. This increases danger because untrusted past content can silently influence later behavior, enabling persistence of malicious user instructions or accidental retention of sensitive information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The 'Write It Down' section operationalizes persistent storage of remembered facts, corrections, preferences, domain lessons, and project overrides from user interactions. That is a real persistence mechanism, and in this self-improving skill context it is more dangerous because the stored material is intended to modify future agent behavior across tasks and sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file explicitly instructs creation of persistent files under ~/self-improving/ but provides no warning, consent check, or data-handling guidance before writing into the user's home directory. In the context of a self-improving agent, this is more concerning because the stored memory, corrections, and heartbeat files can accumulate sensitive behavioral or preference data over time without the user clearly understanding that persistence is occurring.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill directs the agent to read and use files from ~/self-improving/, which is local state outside the immediate task context, without any explicit user consent, disclosure, or data-minimization guardrails. Even if intended for benign persistence, this creates a privacy and boundary-crossing risk because the agent may access or rely on local data the user did not realize would be consulted.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.