Self-Improving Agent (Proactive Self-Reflection)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:02 AM UTC
• Version: 1.2.11

Overview

The skill is meant to improve an agent using local memory, but it under-discloses broad persistent behavior changes and automatic memory writes.

Install only if you want a persistent local memory system that can shape future agent behavior. Review or decline any setup step that edits AGENTS.md, SOUL.md, workspace config, or HEARTBEAT.md; require exact diffs and explicit consent before memory writes; avoid storing secrets, sensitive personal data, third-party details, or instructions that change safety or permission rules.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:43

Finding

Persistent Behavioral Memory Lacks Safety-Directive Filtering and Consistent Consent

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: setup.md:48

Finding

Setup Modifies Agent Steering Files Outside the Declared Storage Boundary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: boundaries.md:44

Finding

Complete Memory Deletion May Leave a Residual Export Archive

Content

View full analysis

Remediation

View remediation

other

Note

• Location: learning.md:23

Finding

Third-Party Retention Examples Contradict Privacy Boundaries

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description says to use it 'before starting work and after responding to the user,' which is broad enough to trigger in routine interactions without clear user intent. Because the skill persistently stores corrections and preferences, over-broad activation increases the chance of unexpected collection and retention of user data during normal conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level description emphasizes self-improvement benefits but does not prominently warn that the skill stores user corrections and preferences in local files under ~/self-improving/. Users may invoke the skill without understanding that their inputs can be retained across sessions, creating a transparency and consent problem.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger conditions are ambiguous phrases like noticing output 'could be better' or when knowledge 'should compound over time,' which do not reliably distinguish ordinary dialogue from memory-writing events. In this context, ambiguity is risky because it can cause unsolicited persistence of user preferences, corrections, and self-generated reflections.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The skill autonomously promotes, demotes, and archives stored patterns based on internal usage heuristics without asking the user. Although framed as maintenance rather than destructive deletion, it still changes persistence scope and retrieval behavior of user-related data automatically, which can surprise users and entrench incorrect or sensitive inferences.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · boundaries.md (reported line 11)May include surrounding context.

md

| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "forget everything" is broad and underspecified, so ordinary conversation or quoted text could unintentionally invoke destructive state changes. In a self-improving memory skill, this creates a real integrity and availability risk because it can erase persistent context without confirmation or scoping.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states that it will load and automatically update a persistent user memory file across sessions, but it does not warn the user about ongoing data retention or modification. In a self-improving agent context, this is more dangerous because the feature is designed to continuously accumulate and rewrite user-related preferences and patterns, increasing privacy, consent, and integrity risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to automatically load memory.md and consult index.md at session start without a clear notice or opt-in from the user. Because these files may contain prior preferences, project history, or sensitive context, automatic access can expose retained data unexpectedly and influence responses based on information the user did not intend to surface in the current session.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The session-start logic automatically preloads a project namespace whenever a project is merely 'detected', but the detection criteria and user-consent boundary are unspecified. In a self-improving memory skill, this can cause the agent to pull in unrelated or overly broad stored context, increasing the chance of unintended disclosure, cross-project contamination, or applying stale preferences without the user's awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to append information to persistent files under ~/self-improving/ and to do so repeatedly and even before the final response, but it does not warn the user that this modifies long-lived local state. That can cause silent persistence of potentially sensitive user data, corrections, preferences, or workflow details, and creates a cross-session memory channel that may outlive the user’s expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template instructs creating directories and files under the user's home directory on first activation without any warning, consent check, or scope limitation. While the commands are simple and not inherently destructive, they still cause persistent filesystem changes and could be executed automatically by an agent, which makes this a real safety issue in an autonomous skill context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.