T01 · Skill Instruction Hijacking
Error
- Location
scripts/agent_memory.py:31- Finding
Persistent Instruction Hijacking Through Auto-Loaded Workspace Hooks
- Content
View full analysis
- Remediation
View remediation
Security audit
Daily Growth & Maturity
Security checks for vulnerabilities and agentic risk
Overview
This skill openly aims to add persistent memory, but it also installs self-recreating scheduled automation that can rewrite core agent instruction files without per-change approval.
Install only if you intentionally want an agent memory system that can persist across sessions, append hooks to workspace instruction files, create or recreate a nightly cron job, and rewrite core .md files with learned rules. Review the generated hooks and cron prompt first, keep backups of SOUL.md, AGENTS.md, IDENTITY.md, HEARTBEAT.md, and avoid using it in workspaces containing sensitive or regulated information unless scheduling and control-file rewrites are disabled or manually reviewed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
scripts/agent_memory.py:155- Finding
Persistent Memory Poisoning Through Autonomous Control-File Rewrites
- Content
View full analysis
30 days from HOT (memory.md) to WARM (projects/ or domains/) 9. TRIM corrections.md: if more than 50 entries, archive the oldest to ~/self-improving/archive/corrections-YYYY-MM.md and keep only the 50 most recent in corrections.md 10. Create tomorrow's daily log: memory/YYYY-MM-DD.md Report format: - For each file: what changed and why (or "No changes — [reason]") - New rules hardcoded (if any) - Patterns promoted/demoted (if any) - Total corrections logged today - Corrections trimmed (if any) - Memory.md line count (warn if >80/100)""" ``` ### Technical Analysis The scheduled review reads mutable content from correction logs, session state, project files, and persistent memory. It then ...[truncated 2053 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
scripts/agent_memory.py:36- Finding
Self-Healing Scheduled Agent Task Creates Cross-Session Persistence
- Content
View full analysis
" }') print(' job.payload: { kind: "agentTurn", message: "", timeoutSeconds: 300 }') print(' job.sessionTarget: "isolated"') print(' job.delivery: { mode: "ann ...[truncated 2253 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (38)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description markets the skill as self-improvement and memory management but does not clearly warn that it will install a mandatory cron and later rewrite workspace markdown control files. Omitting that warning undermines informed consent for behavior that has durable effects on future agent operation.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The architecture section says the skill never overwrites native workspace files, but later sections explicitly authorize nightly rewrites of those same files. This mismatch hides persistent modification behavior in what appears to be a benign memory-management skill, making the operational risk substantially higher.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims integration is non-destructive and says to never overwrite existing files, but elsewhere instructs a cron to rewrite core workspace control files. That contradiction is dangerous because it can mislead users and reviewers into authorizing a skill that will later persistently alter high-impact prompt/control documents.
- Content
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section describes a layered persistence chain: inject hooks, verify cron on every session, recreate it if missing, and use it to rewrite control files. That combination entrenches the skill's behavior over time and makes removal harder, which is a classic persistence pattern even if framed as reliability.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'one command' setup minimizes the impact of initialization while actually creating directories, files, hook injections, and enabling later automated modifications through cron. This is dangerous because it can induce users to approve a broad, persistent setup without understanding its consequences.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The phrase "no behavioral compliance required" explicitly attempts to waive safeguards around a nightly cron that rewrites workspace .md files. This is dangerous because it normalizes autonomous persistence and recurring modification while discouraging policy-bound checks, making unauthorized or stealthy tampering more likely.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The daily review prompt directs autonomous rewriting of SOUL.md, AGENTS.md, IDENTITY.md, and HEARTBEAT.md based on accumulated lessons. These are effectively instruction and identity/governance files, so automated mutation can entrench bad inferences, create self-reinforcing behavior, or persist adversarial content derived from prior interactions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The nightly cron is documented to rewrite multiple core .md instruction files on a recurring basis, yet the setup does not present this as a potentially destructive or security-sensitive action. Recurring autonomous rewrites can silently alter future agent behavior, overwrite legitimate instructions, and entrench unsafe rules without fresh user approval.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill clearly directs file reads, file writes, environment-dependent path handling, symlink creation, and cron-oriented setup, yet it declares no explicit tool scope or permissions boundary. This creates ambiguity around what capabilities the skill expects and weakens review and enforcement, increasing the chance of over-broad execution in a privileged agent environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation criteria are extremely broad, covering failures, corrections, better ideas, significant work, persistence needs, and restart recovery. Such vague activation conditions increase the chance that the skill runs during ordinary interactions and performs persistence or file modifications when the user did not intend it.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
A self-improvement/memory skill expanding into rewriting SOUL.md, AGENTS.md, IDENTITY.md, and HEARTBEAT.md is a scope escalation beyond what its core function requires. Because those files influence future agent behavior, this effectively turns a memory tool into a persistent control-plane modification mechanism.
- Content
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 95% confidence
- Finding
Hardcoding new 'permanent rules' by rewriting SOUL.md, AGENTS.md, IDENTITY.md, and HEARTBEAT.md is direct persistent context injection into files that shape future agent behavior. In this skill context, that is especially dangerous because it lets a self-improvement feature silently convert transient lessons into durable control instructions.
- Content
md 2. Reads SESSION-STATE.md for the day's work 3. Reviews what was learned that day — new patterns, corrections, preferences, rules 4. **Writes** new lessons to ~/self-improving/memory.md (promotes confirmed patterns to HOT) 5. **Rewrites** SOUL.md, AGENTS.md, IDENTITY.md, HEARTBEAT.md — hardcodes new permanent rules, removes stale guidance, updates with latest operational reality 6. Updates ~/self-improving/index.md with current file sizes 7. Demotes patterns unused >30 days from HOT to WARM 8. Reports what changed in each file
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The cold-boot protocol requires reading session state and memory files on every restart, carrying forward recent activity and learned patterns automatically. In context, this increases persistence of user data and operational state beyond a single session, which can be risky if the data is sensitive or stale.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill explicitly instructs the agent to persist user corrections, preferences, and other interaction-derived information for later retrieval. Even if intended to improve continuity, this creates a durable store of user-provided data that may be surfaced across sessions without granular consent or retention limits.
- Content
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
- Content
md - "My style is..." / "For [project], use..." **Track, promote after 3x:** - Same instruction repeated 3+ times → ask to confirm as permanent rule - Workflow that works well repeatedly - User praises specific approach
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Pattern used 3x in 7 days → promote to HOT - Pattern unused 30 days → demote to WARM - Pattern unused 90 days → archive to COLD - **Never delete without asking user** ### Conflict Resolution 1. Most specific wins (project > domain > global)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Mandating cron verification and recreation on every session gives the skill a self-healing persistence mechanism that exceeds normal memory logging needs. This makes the behavior sticky across sessions and resistant to removal, which is especially risky when paired with automated rewriting of core workspace files.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The session instructions make cron verification and creation sound mandatory whenever the session starts, without clearly limiting this to cases where the user intentionally enabled the skill. That ambiguity can cause repeated, unintended persistence actions and workspace modification in routine sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description advertises autonomous workspace modification in broad terms without clearly constraining when, where, or how those changes occur. In a skill centered on persistence, cron, and self-healing behavior, vague activation language increases the chance that an agent will perform unexpected file modifications outside explicit user intent.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Financial | Card numbers, bank accounts, crypto seeds | Fraud risk | | Medical | Diagnoses, medications, conditions | Privacy | | Biometric | Voice patterns, behavioral fingerprints | Identity theft | | Third parties | Info about other people | No consent | | Location patterns | Home/work addresses, routines | Physical safety | | Access patterns | System access details | Privilege escalation |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The kill-switch workflow includes irreversible deletion steps ('wipe all learned data') but does not explicitly require a clear warning, confirmation, or acknowledgment that the action is destructive and may not be recoverable. In a self-improving skill with persistent memory, this increases the chance of accidental or socially induced data loss, especially if the phrase 'forget everything' is triggered unintentionally or adversarially.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The session-start and completion workflow requires reading and updating persistent memory/state files as part of the default critical path, again without any user-facing notice or consent model. In context, this makes retention automatic and habitual, increasing the chance that sensitive task details persist across sessions in ways users do not expect.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The cold-boot recovery flow and daily memory model repeatedly instruct the agent to preserve and accumulate session state over time, which can cause sensitive information to persist and be reintroduced in later sessions. Because this skill is specifically designed for compounding memory across restarts, the context makes the retention risk more pronounced rather than less dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to write corrections and contextual details to persistent files before responding, but provides no requirement to obtain user consent, minimize stored content, or warn about retention. This creates a real privacy and safety risk because user inputs, preferences, and potentially sensitive operational context can be durably stored on disk without transparency.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The WAL protocol directs the agent to persist user corrections, context, timestamps, counters, and namespace associations before replying. That is a direct natural-language data retention channel that can capture sensitive user information or business context and preserve it beyond the immediate interaction, expanding privacy and cross-session leakage risk.
- Content
Static analysis
No suspicious patterns detected.