T06 · System Persistence
Error
- Location
SKILL.md:130- Finding
Persistent Autonomous Agent Execution Through Scheduled Jobs
- Content
View full analysis
- Remediation
View remediation
Security audit
Nova Self-Improver
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly about self-improving agent memory, but it gives the agent broad persistent memory, scheduled-job, and skill-creation authority without clear user approval or limits.
Install only if you intentionally want an agent to maintain persistent memory, update workspace files, schedule recurring self-maintenance runs, and draft or evolve skills. Before use, require explicit approval for any memory writes, cron creation, and skill creation; restrict writable paths; review stored preferences regularly; and disable or remove scheduled jobs when no longer needed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:106- Finding
Unvalidated Interaction Content Is Written to Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:175- Finding
Autonomous Skill Creation Can Convert Poisoned Patterns Into Reusable Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly promotes autonomous file creation and maintenance ('keep own files current without prompting') without any requirement for user consent, confirmation, or scope limits. In an agent context, this can lead to unexpected persistent modifications of workspace state, configuration drift, or overwriting files beyond what the user intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to 'auto-learn preferences from interactions' and later to record corrections, approvals, and preferences into USER.md, but it does not warn users that their behavioral data will be stored across sessions. This creates a privacy and transparency failure that can result in retention of personal, sensitive, or profiling information without informed consent.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages continuous learning, multi-layer memory, self-evaluation logs, and daily logging of interaction-derived content, which naturally promotes broad retention of conversational data. In practice, such logs can capture secrets, personal data, internal project details, or error outputs, creating a durable data leakage surface far beyond the immediate task.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
Maintaining context across sessions is not inherently malicious, but in this skill it is implemented through persistent memory files and autonomous updates without adequate consent, minimization, or disclosure controls. That makes session persistence risky because it can preserve sensitive context indefinitely and influence future agent behavior based on stale or private information.
- Content
md ## What This Skill Does 1. **Continuous Learning**: After each task, reflect and log what worked/didn't 2. **Memory Layers**: Maintain context across sessions (4 layers) 3. **Self-Evaluation**: Track successes, failures, and patterns 4. **Autonomous Updates**: Keep own files current without prompting 5. **Experiment Framework**: Try multiple approaches, measure results
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions direct the agent to automatically record user corrections, approvals, and newly discovered preferences into a persistent USER.md file across sessions. This is dangerous because free-form interaction content often contains sensitive personal or business information, and persistent storage increases the chance of later disclosure, misuse, or unintended reuse in future conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The cron-based self-maintenance section describes recurring scheduled tasks that review learnings, update files, and audit skills without any user-facing warning or approval step. Scheduled autonomous actions increase risk because they can continue modifying persistent state after the original interaction, potentially surprising users and compounding mistakes over time.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase at line 12 is broad enough to match common user requests and may activate the skill outside clearly intended contexts. Because this skill enables autonomous self-improvement and file maintenance, accidental invocation could grant a high-autonomy workflow in situations where the user did not explicitly request it, increasing the chance of unintended state changes or risky behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation phrase on line 14 is ambiguous and lacks scope, making it likely to fire on generic requests such as asking for an 'autonomous agent.' In the context of a self-improving skill with continuous learning and autonomous file maintenance, misactivation is more dangerous than normal because it can enable persistent memory updates or self-modifying workflows without sufficiently clear user intent.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest does not define clear trigger constraints or negative activation boundaries, so the system has no reliable way to distinguish intentional use from incidental matching. Given the skill's self-improving and autonomous-maintenance scope, this lack of guardrails increases the risk of overbroad activation leading to unintended persistence, memory modification, or self-directed actions.
- Content
Static analysis
No suspicious patterns detected.