Keenlycat Self Improving Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:38 AM UTC
• Version: 1.0.1

Overview

This skill is meant to create local learning memory, but it automatically stores failed command details in persistent memory without strong consent, redaction, or integrity safeguards.

Review before installing. Use this only if you are comfortable with local persistent logs of task context and failed command details. Avoid wrapping commands that include tokens, passwords, private URLs, or confidential paths. Safer use would require opt-in capture, redaction, JSON-safe serialization, restrictive file permissions, and a clear way to review and delete stored learnings.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: capture-learning.sh:101
• Finding: Persistent Learning Store Allows Agent Memory Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `capture-learning.sh:21-59, 101-104`; related retrieval behavior in `pre-task-check.sh:25-34` **Vulnerability Type**: Persistent memory poisoning through unescaped attacker-controlled input **Risk Level**: Medium ### Vulnerable Code ```bash while [[ $# -gt 0 ]]; do case $1 in --type) TYPE="$2" shift 2 ;; --severity) SEVERITY="$2" shift 2 ;; --context) CONTEXT="$2" shift 2 ;; --issue) ISSUE="$2" shift 2 ;; --correction) CORRECTION="$2" shift 2 ;; --lesson) LESSON="$2" shift 2 ;; --tags) TAGS="$2" shift 2 ;; --task-slug) TASK_SLUG="$2" shift 2 ;; *) echo "Unknown option: $1" exit 1 ;; esac done ``` ```bash # Create JSON learning entry cat >> "$LEARNINGS_FILE" << EOF {"timestamp":"$TIMESTAMP","type":"$TYPE","severity":"$SEVERITY","context":"$CONTEXT","issue":"$ISSUE","correction":"$CORRECTION","lesson":"$LESSON","tags":"$TAGS","taskSlug":"$TASK_SLUG"} EOF ``` The persisted records are subsequently retrieved before future tasks: ```bash # Search for relevant learnings if [[ -x "$SEARCH_SCRIPT" ]]; then echo "📚 Searching for relevant learnings..." echo "" # Search by task type and keywords "$SEARCH_SCRIPT" "$TASK_TYPE $*" --limit 5 echo "" echo "💡 Tip: Review these learnings before starting your task!" echo "" else echo "❌ Search script not found. Make sure the skill is installed." fi ``` ### Technical Analysis The script accepts attacker-influenced values for `context`, `issue`, `correction`, `lesson`, `tags`, and `taskSlug`, then interpolates them directly into a JSONL reco ...[truncated 2373 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Build JSON records with a proper serializer instead of string interpolation. For example, use `jq -n` with `--arg`: ```bash jq -cn \ --arg timestamp "$TIMESTAMP" \ --arg type "$TYPE" \ --arg severity "$SEVERITY" \ --arg context "$CONTEXT" \ --arg issue "$ISSUE" \ --arg correction "$CORRECTION" \ --arg lesson "$LESSON" \ --arg tags "$TAGS" \ --arg taskSlug "$TASK_SLUG" \ '{ timestamp: $timestamp, type: $type, severity: $severity, context: $context, issue: $issue, correction: $correction, lesson: $lesson, tags: $tags, taskSlug: $taskSlug }' >> "$LEARNINGS_FILE" ``` 2. Validate maximum field lengths and reject unexpected control characters where they are not required. 3. Require explicit user approval before writing corrections or behavioral guidance into persistent memory. 4. Record provenance, creation method, author, and trust level for each learning. 5. Treat retrieved records strictly as untrusted data, not executable instructions. 6. Clearly delimit stored records when presenting them to an agent and warn that their contents must not override system or user instructions. 7. Validate every JSONL record before appending it and before consuming it. 8. Use restrictive permissions, such as `umask 077` and file mode `0600`, for the memory directory and learning file. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: auto-capture-error.sh:14
• Finding: Automatic Error Capture Persists Potential Secrets Without Redaction or Approval<![CDATA[ ## Vulnerability Details **File Location**: `auto-capture-error.sh:14-44`; storage sink in `capture-learning.sh:101-104` **Vulnerability Type**: Plaintext retention of sensitive command arguments and error output **Risk Level**: Medium ### Vulnerable Code ```bash # Run command and capture exit code set +e OUTPUT=$("$@" 2>&1) EXIT_CODE=$? set -e if [[ $EXIT_CODE -ne 0 ]]; then echo "" echo "❌ Command failed with exit code $EXIT_CODE" echo "" echo "Output:" echo "$OUTPUT" echo "" # Auto-capture as learning if [[ -x "$CAPTURE_SCRIPT" ]]; then echo "📝 Capturing error as learning..." # Extract error summary (first 200 chars) ERROR_SUMMARY=$(echo "$OUTPUT" | head -c 200 | tr '\n' ' ' | tr '"' "'") # Capture learning "$CAPTURE_SCRIPT" \ --type error \ --severity high \ --context "Command failed: $*" \ --issue "$ERROR_SUMMARY" \ --correction "Review error and fix" \ --lesson "Command '$1' failed, review error message for details" \ --tags "auto-captured,command-error" \ --task-slug "cmd-$1" ``` The captured data is written to persistent storage: ```bash # Create JSON learning entry cat >> "$LEARNINGS_FILE" << EOF {"timestamp":"$TIMESTAMP","type":"$TYPE","severity":"$SEVERITY","context":"$CONTEXT","issue":"$ISSUE","correction":"$CORRECTION","lesson":"$LESSON","tags":"$TAGS","taskSlug":"$TASK_SLUG"} EOF ``` ### Technical Analysis When a wrapped command fails, the script automatically persists: - The complete command and all arguments through `$*`. - The first 200 bytes of combined standard output and standard error. - The executable name in the lesson and task slug. Command-line arguments frequently contain API keys, passwords, bearer tokens, private URLs, database connection strings, or filesystem locations. Error output can also disclose secrets, environment details, authentication ...[truncated 2271 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store complete command lines by default. Capture only the executable name and a non-sensitive operation identifier. 2. Require explicit user approval before persisting command arguments or raw error output. 3. Redact sensitive options and their values, including patterns such as: - `--password`, `--token`, `--secret`, `--api-key`, and `--authorization` - Bearer tokens and JWTs - Private keys - Credential-bearing URLs - Cloud provider access keys - Database connection strings 4. Prefer an allowlist of fields that are safe to store instead of relying only on pattern-based redaction. 5. Replace raw output retention with a sanitized error category, exit code, and user-approved summary. 6. Apply length limits after redaction and use a JSON serializer for all stored values. 7. Protect the storage file with restrictive permissions: ```bash umask 077 mkdir -p "$(dirname "$LEARNINGS_FILE")" touch "$LEARNINGS_FILE" chmod 600 "$LEARNINGS_FILE" ``` 8. Add retention controls, secure deletion functionality, and a documented process for removing accidentally captured secrets. 9. If a secret may already have been stored, remove it from the learning file and backups, then rotate or revoke the affected credential. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill advertises very broad activation criteria such as using it after errors, corrections, successes, and periodic reviews, which could cause it to run during many normal interactions. In a memory-writing skill, over-triggering increases the chance that routine conversation content, user feedback, or task context is unnecessarily persisted to disk, creating privacy and data-retention risk.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The "When to Use" section is ambiguous and lacks operational constraints, so an agent may invoke this skill opportunistically without a clear threshold. Because the skill stores contextual details and corrections, ambiguous activation expands collection and persistence of potentially sensitive or unnecessary information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The storage description explains that full context and details are written to `memory/learnings.jsonl`, but it does not prominently warn that those details may include sensitive task context or user feedback. Users and downstream agents may therefore underestimate the privacy impact and persist secrets, personal data, or confidential operational information.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"severity": "high",
  "context": "Installing npm package globally",
  "issue": "Permission denied without sudo",
  "correction": "Use sudo for global installs or configure npm prefix",
  "lesson": "Always check if operation requires elevated privileges",
  "tags": ["npm", "permissions", "installation"],
  "taskSlug": "npm-global-install"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```
Context: Running `npm install -g package`
Issue: EACCES permission error
Correction: Run with sudo or configure npm prefix
Lesson: Check if global install requires elevated privileges
Tags: npm, permissions, installation
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The script’s header presents itself as only executing a command and capturing errors, but on failure it also persists command context and error output into a separate learning system. This hidden data-retention behavior can cause users to expose sensitive command arguments or error content without informed consent, especially in an agent environment where commands may include tokens, paths, or internal system details.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: On command failure, the script automatically forwards failure context and a summary of captured output to another script without explicit warning or consent. In this skill context, failed commands often contain sensitive inputs, filesystem paths, credentials in arguments, stack traces, or internal environment details, so automatic capture increases the chance of unintended disclosure and long-term retention of sensitive data.

Vague Triggers

Low

• Confidence: 77% confidence
• Finding: This manifest file describes the skill as a "self-improving agent with automation" and lists broad capabilities like error capture and learning retrieval, but it does not specify the conditions under which those automations should run. In a manifest context, that lack of trigger specificity can contribute to unintended or overly broad invocation expectations.

Static analysis

No suspicious patterns detected.