AI Self-Evolution Engine( AI 自我进化引擎）

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:24 AM UTC
• Version: 1.0.4

Overview

This skill is a coherent book-analysis memory tool, but it needs review because it persists model-generated content for future agent use and can send personalized analysis to external services without enough scoping or per-run control.

Review this before installing if your USER.md, HEARTBEAT-reading.md, or generated reading notes contain private work, company, client, or project details. Prefer local-only use, keep Feishu/Notion tokens in environment variables rather than markdown files, approve external sync per run, and avoid auto-loading generated knowledge entries into future sessions until they are reviewed as untrusted reference material.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:502
• Finding: Unsanitized External Content Can Poison Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 207-259 and 502-577; related automatic-loading recommendation in `README.md`, lines 190-196 **Vulnerability Type**: Persistent storage of untrusted, instruction-like model output **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md`, lines 207-259: ```markdown #### Source 3: book-scout Web Search When the queue is empty and the user has not specified a book, invoke the `book-scout` skill. ... Invoke book-scout: Topic: {topic} Previously read books: - "The Lean Startup" - "Zero to One" - "Influence" Run the book-scout skill and search for a classic book matching the topic. ``` `SKILL.md`, lines 502-577: ```markdown For Thinking Patterns / Principles, write to: `memory/knowledge-base/patterns/{id}.md` Extract frontmatter fields from the `KB_META` block returned by `mental-model-forge`, and map FACET dimensions into body fields: --- id: {from KB_META} name_zh: {from KB_META} name_en: {from KB_META} source: {book_title}, {author} category: {from KB_META} tags: {from KB_META} scenarios: {from KB_META} related_models: {from KB_META} difficulty: {from KB_META} date: YYYY-MM-DD --- **Core Logic**: {A paragraph refined from [F] Core Framework} **Thinking Framework**: {Use the [F] Core Framework content directly} **Decision Principle**: {Derived from [F] and [E]} **Blind-Spot Warning**: {Use the [E] Hidden Boundaries content directly} **Reflex Trigger**: {Derived from scenarios} **Anchor Case**: {Use the [A] Anchor Case content directly} **Contrarian Insight**: {Use the contradiction field from KB_META} ``` `README.md`, lines 190-196: ```markdown ## Session Startup 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent context 4. **Load `memory/knowledge-base/thinking-patterns.md`** — your decision frameworks ``` ### Technical Analysis The workflow creates a persistent trust-bou ...[truncated 2504 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all search results, dependency responses, FACET fields, and `KB_META` values as untrusted data. 2. Add a security-validation stage before every persistent write. Reject or quarantine content containing: - Role or policy changes. - Requests to ignore previous instructions. - Tool-use or command-execution directives. - Requests to read, disclose, upload, or modify unrelated data. - Encoded, hidden, or externally loaded instructions. 3. Store generated material as explicitly delimited quoted data, not as instructions for the Agent. 4. Add provenance fields recording the source URL, dependency, timestamp, and review state. 5. Require explicit user approval before first-time or externally sourced content enters the persistent knowledge base. 6. Separate trusted decision frameworks from unreviewed generated entries. Do not automatically load unreviewed entries at session startup. 7. When loading knowledge entries, apply a higher-priority instruction stating that entries are untrusted reference material and cannot authorize tool calls, policy changes, or data access. 8. Validate YAML and Markdown structure and escape control syntax, embedded frontmatter delimiters, HTML comments, links, and other instruction-hiding mechanisms. 9. Add tests containing representative indirect prompt-injection payloads and verify that they are rejected or safely quarantined. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:502
• Finding: Unvalidated Model Identifier Is Interpolated into a Filesystem Path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 502-517 **Vulnerability Type**: Path traversal through an untrusted filename component **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown For Thinking Patterns / Principles, write to: `memory/knowledge-base/patterns/{id}.md` Extract frontmatter fields from the `KB_META` block returned by `mental-model-forge`: --- id: {from KB_META} name_zh: {from KB_META} name_en: {from KB_META} source: {book_title}, {author} category: {from KB_META} tags: {from KB_META} scenarios: {from KB_META} related_models: {from KB_META} difficulty: {from KB_META} date: YYYY-MM-DD --- ``` ### Technical Analysis The filename component `{id}` comes from `KB_META`, which is generated by the external `mental-model-forge` dependency. The workflow specifies no character allowlist, canonicalization, path-containment check, length limit, collision handling, or symlink protection before using that identifier in: ```text memory/knowledge-base/patterns/{id}.md ``` A malicious or compromised dependency could return an identifier containing directory traversal sequences or path separators. For example, an identifier conceptually equivalent to `../../target` would cause the constructed path to resolve outside the intended `patterns` directory if the underlying filesystem tool accepts such a path. The documented post-write verification repeats the same interpolated path, so it would not detect that canonical path resolution escaped the intended directory. ### Attack Path 1. An attacker compromises `mental-model-forge` or otherwise causes it to return crafted `KB_META`. 2. The returned `id` contains traversal elements, separators, an absolute-path representation, or a collision with an existing filename. 3. Cognitive Forge interpolates the value into the destination path without validation. 4. The filesystem operation resolves the path outside `memory/knowledge-base/patterns/`. 5. A file accessible to the Agent' ...[truncated 837 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `id` with a strict allowlist before path construction, for example: ```regex ^[a-z0-9][a-z0-9-]{0,63}$ ``` 2. Generate the filename locally from a trusted slugification function instead of trusting a dependency-provided filename. 3. Reject identifiers containing dots, slashes, backslashes, control characters, URL encoding, Unicode separator lookalikes, or absolute-path prefixes. 4. Resolve and canonicalize both the destination directory and final path, then verify that the final path is a direct child of `memory/knowledge-base/patterns/`. 5. Refuse writes through symlinks and verify that every parent component is an actual directory. 6. Use atomic create-without-overwrite behavior unless replacement has been explicitly authorized. 7. Apply a maximum filename length and deterministic collision handling. 8. Perform post-write verification against the canonical path, not the original interpolated string. 9. Enforce filesystem permissions using canonical path containment rather than lexical wildcard matching. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Ssd 3

High

• Confidence: 95% confidence
• Finding: The skill is designed to read USER.md and other local state, then incorporate that personal context into generated outputs and optional external records. This creates a natural-language data exfiltration path: sensitive profession, project, challenge, or organizational details can be restated, stored, and potentially synced outside the workspace.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill describes sending analysis outputs to Feishu or Notion but does not clearly warn that generated content, potentially including user-derived context, may leave the local system. That creates a real privacy and data-governance issue because personal or organizational details can be transmitted to third-party services without sufficiently explicit disclosure.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The instructions direct the skill to obtain credentials from local content and use them to write records externally, combining secret-handling risk with outbound data transmission. If HEARTBEAT-reading.md contains tokens or user-derived analysis fields, the skill encourages both secret exposure and external leakage of contextual information.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Data Persistence**: This skill writes to `thinking-patterns.md` and `reading-history.json` in your workspace. These files persist across sessions.

**Optional Integration**: The "auto-load thinking-patterns.md" feature requires manual configuration in your `AGENTS.md`. The skill does NOT automatically modify your agent's behavior without your explicit setup.

**Export Tokens**: Environment variables (`FEISHU_APP_TOKEN`, `NOTION_API_KEY`) are entirely optional. The skill works perfectly fine without them (local-only mode).

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

- memory/reading-history.json  # Load previously analyzed books for deduplication (book titles only)
      - HEARTBEAT-reading.md  # Optional: read schedule config, topic mapping, and Feishu credentials
    write:
      - memory/knowledge-base/patterns/*.md  # Write individual model files with YAML frontmatter
      - memory/knowledge-base/concepts.md  # Append domain-specific concepts
      - memory/reading-history.json  # Record newly analyzed book + model for future deduplication
  env:

• Confidence: 90% confidence
• Finding: The skill persistently writes pattern files, concepts, and reading-history records across sessions. In this context, persistence is intentional functionality, but it is still security-relevant because it accumulates derived user data and AI-generated material that may outlive the session and be reused in later contexts without clear retention controls.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises dual-value knowledge extraction but does not clearly warn that each run persistently writes AI-generated files and updates reading history. Users may invoke it expecting ephemeral analysis, causing silent accumulation of records and generated content in the workspace without informed consent.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The top-level description and subsequent templates are written as required Chinese output behavior, and no opt-in or language-selection mechanism is provided. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow instructs automatic creation of directories and files during environment checks without a user-facing notice. Silent mutation of workspace state is risky in agent environments because it can surprise users, create unwanted persistence, and normalize unattended file creation.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly requires transfer sections and strategic questions to cite concrete user details such as profession, company, or project context. That requirement increases the chance of disclosing sensitive personal or business information in responses, logs, or copied outputs, even when such detail is not necessary for functionality.

Session Persistence

Medium

• Category: Rogue Agent

Content

}
```

### Step 4.5. Verify Knowledge Base Write (写入验证，必须执行)

**验证逻辑**：

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

}
```

### Step 4.5. Verify Knowledge Base Write (写入验证,必须执行)

**验证逻辑**:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The skill documentation says credentials may be read from HEARTBEAT-reading.md, while the manifest declares secrets as environment variables. This inconsistency creates a real security risk because operators may place tokens into a readable workspace file, expanding exposure from process environment scope to filesystem scope and making accidental disclosure or downstream propagation more likely.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The file mixes headings with extensive Chinese instructions and user utterance examples, implying the skill operates in Chinese by default. There is no indication that users may choose another language or that the Chinese-only behavior is region-specific and justified, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The example declares Chinese as the default output format without indicating that language should be selected based on user preference. While not a direct security exploit, forced default language can mislead users, reduce transparency around agent behavior, and increase the chance that important warnings or consent text are not understood.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly states that output will be written to a local knowledge-base file regardless of mode, but it does not mention asking for user consent, showing the destination clearly at runtime, or providing a way to opt out. Silent or automatic local file modification is risky because it can overwrite, append to, or create persistent data the user did not intend to store.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The routing table and trigger examples prioritize Chinese invocations and a Chinese default path, but do not say that users may interact in other languages or choose output locale. This creates an implicit language policy bias rather than a user-selected language setting.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This markdown file contains core operational instructions in Chinese while other sections are in English, effectively imposing a language/locale expectation on the user. The policy allows fixed locale behavior only when it is clearly documented and justified or when users are given a choice, which is not present here.

Static analysis

No suspicious patterns detected.