Keenlycat Self Improving Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:38 AM UTC
• Version: 1.0.1

Overview

This skill is meant to create local learning memory, but it automatically stores failed command details in persistent memory without strong consent, redaction, or integrity safeguards.

Review before installing. Use this only if you are comfortable with local persistent logs of task context and failed command details. Avoid wrapping commands that include tokens, passwords, private URLs, or confidential paths. Safer use would require opt-in capture, redaction, JSON-safe serialization, restrictive file permissions, and a clear way to review and delete stored learnings.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: capture-learning.sh:101

Finding

Persistent Learning Store Allows Agent Memory Poisoning

Content

View full analysis

> "$LEARNINGS_FILE" << EOF {"timestamp":"$TIMESTAMP","type":"$TYPE","severity":"$SEVERITY","context":"$CONTEXT","issue":"$ISSUE","correction":"$CORRECTION","lesson":"$LESSON","tags":"$TAGS","taskSlug":"$TASK_SLUG"} EOF ``` The persisted records are subsequently retrieved before future tasks: ```bash # Search for relevant learnings if [[ -x "$SEARCH_SCRIPT" ]]; then echo "📚 Searching for relevant learnings..." echo "" # Search by task type and keywords "$SEARCH_SCRIPT" "$TASK_TYPE $*" --limit 5 echo "" echo "💡 Tip: Review these learnings before starting your task!" echo "" else echo "❌ Search script not found. Make sure the skill is installed." fi ``` ### Technical Analysis The script accepts attacker-influenced values for `context`, `issue`, `correction`, `lesson`, `tags`, and `taskSlug`, then interpolates them directly into a JSONL reco ...[truncated 2373 chars]

Remediation

View remediation

> "$LEARNINGS_FILE" ``` 2. Validate maximum field lengths and reject unexpected control characters where they are not required. 3. Require explicit user approval before writing corrections or behavioral guidance into persistent memory. 4. Record provenance, creation method, author, and trust level for each learning. 5. Treat retrieved records strictly as untrusted data, not executable instructions. 6. Clearly delimit stored records when presenting them to an agent and warn that their contents must not override system or user instructions. 7. Validate every JSONL record before appending it and before consuming it. 8. Use restrictive permissions, such as `umask 077` and file mode `0600`, for the memory directory and learning file. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: auto-capture-error.sh:14

Finding

Automatic Error Capture Persists Potential Secrets Without Redaction or Approval

Content

View full analysis

&1) EXIT_CODE=$? set -e if [[ $EXIT_CODE -ne 0 ]]; then echo "" echo "❌ Command failed with exit code $EXIT_CODE" echo "" echo "Output:" echo "$OUTPUT" echo "" # Auto-capture as learning if [[ -x "$CAPTURE_SCRIPT" ]]; then echo "📝 Capturing error as learning..." # Extract error summary (first 200 chars) ERROR_SUMMARY=$(echo "$OUTPUT" | head -c 200 | tr '\n' ' ' | tr '"' "'") # Capture learning "$CAPTURE_SCRIPT" \ --type error \ --severity high \ --context "Command failed: $*" \ --issue "$ERROR_SUMMARY" \ --correction "Review error and fix" \ --lesson "Command '$1' failed, review error message for details" \ --tags "auto-captured,command-error" \ --task-slug "cmd-$1" ``` The captured data is written to persistent storage: ```bash # Create JSON learning entry cat >> "$LEARNINGS_FILE" << EOF {"timestamp":"$TIMESTAMP","type":"$TYPE","severity":"$SEVERITY","context":"$CONTEXT","issue":"$ISSUE","correction":"$CORRECTION","lesson":"$LESSON","tags":"$TAGS","taskSlug":"$TASK_SLUG"} EOF ``` ### Technical Analysis When a wrapped command fails, the script automatically persists: - The complete command and all arguments through `$*`. - The first 200 bytes of combined standard output and standard error. - The executable name in the lesson and task slug. Command-line arguments frequently contain API keys, passwords, bearer tokens, private URLs, database connection strings, or filesystem locations. Error output can also disclose secrets, environment details, authentication ...[truncated 2271 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises very broad activation criteria such as using it after errors, corrections, successes, and periodic reviews, which could cause it to run during many normal interactions. In a memory-writing skill, over-triggering increases the chance that routine conversation content, user feedback, or task context is unnecessarily persisted to disk, creating privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The "When to Use" section is ambiguous and lacks operational constraints, so an agent may invoke this skill opportunistically without a clear threshold. Because the skill stores contextual details and corrections, ambiguous activation expands collection and persistence of potentially sensitive or unnecessary information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The storage description explains that full context and details are written to memory/learnings.jsonl, but it does not prominently warn that those details may include sensitive task context or user feedback. Users and downstream agents may therefore underestimate the privacy impact and persist secrets, personal data, or confidential operational information.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

"severity": "high",
  "context": "Installing npm package globally",
  "issue": "Permission denied without sudo",
  "correction": "Use sudo for global installs or configure npm prefix",
  "lesson": "Always check if operation requires elevated privileges",
  "tags": ["npm", "permissions", "installation"],
  "taskSlug": "npm-global-install"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

text

Context: Running `npm install -g package`
Issue: EACCES permission error
Correction: Run with sudo or configure npm prefix
Lesson: Check if global install requires elevated privileges
Tags: npm, permissions, installation

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script’s header presents itself as only executing a command and capturing errors, but on failure it also persists command context and error output into a separate learning system. This hidden data-retention behavior can cause users to expose sensitive command arguments or error content without informed consent, especially in an agent environment where commands may include tokens, paths, or internal system details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

On command failure, the script automatically forwards failure context and a summary of captured output to another script without explicit warning or consent. In this skill context, failed commands often contain sensitive inputs, filesystem paths, credentials in arguments, stack traces, or internal environment details, so automatic capture increases the chance of unintended disclosure and long-term retention of sensitive data.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This manifest file describes the skill as a "self-improving agent with automation" and lists broad capabilities like error capture and learning retrieval, but it does not specify the conditions under which those automations should run. In a manifest context, that lack of trigger specificity can contribute to unintended or overly broad invocation expectations.

Content

No source excerpt is available for this finding.