self-improving-ai

• Outcome: Pass
• Latest audit: Aug 28, 2026 · 7:03 PM UTC
• Version: 1.1.1

Overview

This skill is a disclosed local logging and reminder aid for AI/LLM lessons, with optional project-scoped hooks and scaffold scripts that users should enable deliberately.

Install only if you want project-local AI/LLM learning logs and reminders. Keep hooks project-scoped, review any generated skill before use, avoid logging secrets or customer data, and treat live production model testing or cross-skill reading as actions that need explicit approval and privacy review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares itself as a logging aid but includes installation and hook workflows that clone from GitHub and execute shell scripts, introducing effective network capability without an explicit permissions declaration. Hidden or undeclared network access expands trust boundaries and can lead to supply-chain risk or unexpected external interactions during setup.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is simple learning/log capture, but the skill also describes behavior that injects reminders into agent context, inspects tool output, and can create new skill scaffolds. This mismatch is dangerous because users may grant trust appropriate for note-taking while the skill influences agent behavior, monitors outputs, and writes additional executable content in places they may not expect.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example proposes live production A/B testing where both the primary and candidate models process the same real user input and a third judging model evaluates outputs, but it does not warn that this can disclose user data to additional providers or systems beyond the one serving the response. In an AI/LLM operations skill, this omission is materially risky because readers may implement the pattern directly and unintentionally expand data exposure, retention, and compliance scope for production traffic.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

### Ownership Rules
- This skill writes only to `.learnings/ai/` in stackable mode.
- It may read other skill folders for cross-linking, but should not rewrite their entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

• Confidence: 71% confidence
• Finding: The ownership rules explicitly allow reading other skill folders for cross-linking, which enables enumeration of adjacent skills and their contents. In multi-skill or shared workspaces, that broad read access can leak sensitive operational metadata, prompt logic, or proprietary workflows beyond what is needed for simple local logging.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.