T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
setup.md:75- Finding
Persistent Workspace Control-File Modification Exceeds the Declared Filesystem Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
Self improving
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it persistently changes agent memory and workspace behavior in ways users should review before installing.
Install only if you intentionally want a persistent local memory system that can change future agent behavior. Before enabling setup, review proposed edits to `AGENTS.md`, `SOUL.md`, and `HEARTBEAT.md`, decline the companion skill unless you separately trust its exact version, and periodically inspect or delete `~/self-improving/` if it stores more than you intended.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
setup.md:89- Finding
Unpinned Companion Skill Is Installed Before Security Review
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow performs export and wiping immediately after a single phrase, without warning the user about the consequences or confirming the destructive action. This increases the chance of accidental deletion and can also be abused through prompt injection or ambiguous language to cause denial of service against the agent's memory state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to automatically persist user corrections, preferences, and behavioral patterns into local memory files, but it does not require clear upfront user notice or explicit consent before storing that data. Even if storage is local, this can create privacy and trust issues because sensitive personal preferences or repeated behavioral signals may be retained longer than the user expects.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Pattern used 3x in 7 days → promote to HOT - Pattern unused 30 days → demote to WARM - Pattern unused 90 days → archive to COLD - Never delete without asking ### 4. Namespace Isolation - Project patterns stay in `projects/{name}.md`
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Financial | Card numbers, bank accounts, crypto seeds | Fraud risk | | Medical | Diagnoses, medications, conditions | Privacy, HIPAA | | Biometric | Voice patterns, behavioral fingerprints | Identity theft | | Third parties | Info about other people | No consent obtained | | Location patterns | Home/work addresses, routines | Physical safety | | Access patterns | What systems user has access to | Privilege escalation |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The phrase "what do you know about me?" is a natural conversational utterance and could be used in exploratory or hypothetical discussion rather than as an authenticated export command. In a memory-bearing self-improving agent, accidental activation could expose accumulated personal context, making the broad trigger materially risky.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The kill-switch trigger "forget everything" is common enough to appear in ordinary conversation, examples, or quoted text, yet it initiates destructive state changes. In a self-learning agent with persistent memory, accidental or adversarial prompting could erase memory unexpectedly and disrupt safety, auditability, or user data integrity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs the agent to log corrections, promote them to preferences, and make them permanent, but it does not require clear user notice or consent for retention and persistence. In a self-improving memory skill, this creates a privacy and data-governance risk because users may unknowingly have behavioral preferences and project-specific information stored across sessions or contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The reversal flow says old patterns are archived, history is kept, and reversals are logged with timestamps, but users are not warned that superseded preferences and related metadata will continue to be retained. Keeping historical preference data without transparent notice or deletion controls increases privacy exposure and can preserve sensitive behavioral profiles longer than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly says the agent will add, demote, and compact entries in a persistent user memory file on its own. Even though this appears intended as a productivity feature, silent persistent modification of user-owned memory can change future agent behavior without clear consent, transparency, or review, creating integrity and privacy risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill defines automatic loading, writing, retention, and maintenance of persistent memory across sessions without any explicit user consent, notice, or control at the point of collection. This creates a privacy and safety risk because user-provided preferences, corrections, and contextual data may be silently stored, retained, and later reused or exposed in ways the user did not expect.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The correction workflow persistently logs user corrections, timestamps, contexts, counters, and namespace placement into memory files, which can accumulate sensitive behavioral or project information over time. Even if intended for self-improvement, this persistent profiling increases risk of privacy leakage, over-collection, and unintended disclosure if memory is later shown, exported, or accessed by other components.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly preserves historical user preferences and prior states for future recall, including archived preferences such as previous communication style. Retaining historical preference history can expose personal behavior patterns and create unnecessary long-term data accumulation beyond what is needed for current task performance.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The setup flow expands the skill's scope by prompting installation of an additional
Proactivityskill and immediately activating it in the same workspace flow. Although it requires explicit user agreement, bundling a second skill into this setup increases the chance of privilege creep, unexpected behavior changes, and user confusion about which skill is responsible for later actions.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The template explicitly instructs creation of persistent files and directories under the user's home directory without any notice, consent flow, or scoping to the current task. While the actions are not inherently destructive, they cause filesystem side effects and establish long-lived storage, which is risky for an agent skill because it can modify the user's environment unexpectedly and retain data beyond the current interaction.
- Content
Static analysis
No suspicious patterns detected.