Self-Improving Skill

• Outcome: Review
• Latest audit: May 28, 2026 · 2:09 PM UTC
• Version: 1.1.0

Overview

This skill is transparent about learning from edits, but it stores full draft/final text and can automatically rewrite another skill's instructions on disk.

Install only if you are comfortable with drafts and final edits being stored locally and processed by your configured LLM CLI. Use manual extract/show/apply first, review diffs before updating any SKILL.md, keep logs in explicit per-project directories, avoid sensitive or secret-bearing content, and do not enable cron/auto until rollback and backup behavior has been tested.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

custom_cmd = os.environ.get("IMPROVE_LLM_CMD")
    if custom_cmd:
        try:
            result = subprocess.run(custom_cmd.split(), input=prompt,
                                    capture_output=True, text=True, timeout=timeout)
            if result.returncode == 0 and result.stdout.strip():
                return result.stdout.strip()

• Confidence: 97% confidence
• Finding: The fallback executes a command taken from the IMPROVE_LLM_CMD environment variable, which gives whoever controls the environment the ability to make the skill invoke an arbitrary executable with attacker-controlled prompt data on stdin. Although split() and shell=False avoid classic shell metacharacter injection, this still materially broadens execution to arbitrary programs and can be used for data exfiltration or unexpected side effects.

Tainted flow: 'updated' from os.environ.get (line 312, credential/environment) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow

Content

print("❌ 合并失败")
        return

    target.write_text(updated)

    new_content = proposal_content.replace(
        "status: pending",

• Confidence: 98% confidence
• Finding: The script writes the external LLM's response directly over the target SKILL.md without validation, diff review, schema checks, or bounded patching. Because the prompt includes untrusted log content and proposal content, a prompt-injection or compromised CLI/model can cause destructive or malicious rewrites of the skill definition, creating persistence and downstream unsafe behavior.

Tainted flow: 'prompt' from os.environ.get (line 296, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

custom_cmd = os.environ.get("IMPROVE_LLM_CMD")
    if custom_cmd:
        try:
            result = subprocess.run(custom_cmd.split(), input=prompt,
                                    capture_output=True, text=True, timeout=timeout)
            if result.returncode == 0 and result.stdout.strip():
                return result.stdout.strip()

• Confidence: 96% confidence
• Finding: Here the tainted flow is real because both the executed program choice and the data sent to it are influenced by environment/configuration. An attacker controlling IMPROVE_LLM_CMD can route sensitive prompt contents to any local binary or wrapper, enabling exfiltration, persistence hooks, or execution of an unexpected tool outside the stated workflow.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill advertises local extraction/update behavior but can delegate content to external LLM CLIs and even an arbitrary command via IMPROVE_LLM_CMD. That creates a broader capability surface than users would reasonably expect, including sending potentially sensitive originals/finals/SKILL content outside the local process boundary and to attacker-chosen handlers.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: In apply/auto mode, the script asks an external LLM to regenerate the entire SKILL.md and writes the result verbatim. In this skill context that is especially dangerous because the tool is self-modifying: malicious or simply manipulated training examples can poison the skill's future behavior persistently, and auto mode applies P0 changes without human review.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises an `auto` mode that automatically extracts rules and applies them to `SKILL.md`, but it does not prominently warn that this changes skill behavior on disk. In a self-modifying skill, unclear disclosure materially increases the risk of unintended configuration drift, misuse in automation/cron, and silent degradation or prompt-injection persistence through learned rules.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script persists full original content to local JSONL logs, which can include sensitive user text, proprietary drafts, credentials, or personal data. Even though this appears to be a product/design choice rather than overtly malicious behavior, retaining raw content without minimization, redaction, consent, or clear warning creates a real confidentiality risk if the host is shared, backed up, synced, or later accessed by other tools.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script stores both the original and final versions together under a shared content hash, creating a linked history of user edits. This increases sensitivity because it not only retains raw text, but also exposes how humans modified it, which may reveal private instructions, editorial intent, internal policy changes, or sensitive revisions across time.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill instructs persistent storage of full original and final content, which can easily include secrets, personal data, confidential drafts, API keys, customer information, or regulated content. Because retention is broad, automatic, and stored on disk without minimization, redaction, encryption, or retention limits, compromise of the memory directory or accidental reuse of stored logs could expose sensitive data at scale.

Static analysis

No suspicious patterns detected.