Security audit

self-improving-support

Security checks across malware telemetry and agentic risk

Overview

This skill is a support-learning logger with optional reminder hooks; the sensitive parts are disclosed and limited, though users should keep hooks project-scoped.

Install normally if you want local support-retrospective logging. Enable hooks only per project, prefer the UserPromptSubmit reminder first, narrow the matcher for your workflow, and avoid PostToolUse in repositories where Bash output may include secrets or customer data.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill claims to log support learnings, but a substantial portion of the behavior is actually persistent hook installation, session prompt injection, tool-output inspection, and skill scaffolding. That mismatch can cause operators to enable broader agent interception than intended, increasing the chance of collecting sensitive customer, operational, or tool-output data outside the stated purpose.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document states that the scripts 'only output text' and 'don't modify files or run commands,' but the configuration clearly installs them as command hooks executed by the agent runtime. This is a misleading security claim that can cause operators to underestimate the trust and execution risk of these scripts, especially since hooks inherit the agent's permissions.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The suggested UserPromptSubmit matcher uses broad terms like 'ticket', 'customer', and 'resolve', which are common across many normal workflows. This can over-trigger the hook, causing unnecessary prompt injection or reminders in unrelated contexts and potentially expanding exposure of sensitive support discussions to hook logic more often than users expect.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The advanced setup repeats the same ambiguous matcher and additionally wires a PostToolUse hook for Bash, increasing the number of situations where the skill inspects agent activity. In combination, broad activation plus tool-output inspection raises the risk of inadvertent capture or processing of sensitive command output unrelated to support improvement.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The matcher includes the broad term 'customer', which is likely to trigger in many ordinary support conversations unrelated to improvement capture. Overbroad activation increases unnecessary script execution frequency and expands exposure to sensitive prompt content and hook side effects, even if the scripts are intended to be lightweight.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.