KinthAI Self-Improving User

• Outcome: Review
• Latest audit: May 29, 2026 · 9:32 PM UTC
• Version: 1.0.0

Overview

This skill is a persistent memory tool, but it silently stores and reloads personal user profiles, follow-ups, and learned facts in ways users may not expect.

Install only if you intentionally want an OpenClaw agent to maintain persistent per-user memory. Before using it with real users, remove or change the silent/never-mention rules, disclose the memory behavior, add opt-in or opt-out and inspect/delete controls, constrain what may be stored, validate user IDs before path use, and review .learnings content before it is reloaded into future prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill is documented as file-based persistent memory and relies on extracting identifiers and reading/writing user-scoped files, which implies access to environment/context capabilities without declaring them. Undeclared capabilities reduce reviewability and can hide the true trust boundary of the skill, making misuse or overreach harder to detect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior materially exceeds the stated purpose: it injects behavioral instructions into bootstrap flows, reads and embeds prior memory into prompts, creates shared stores, and operates broadly rather than only on explicit correction/preference events. This mismatch prevents informed review and can enable stealthy persistence, prompt-shaping, and broader data handling than users or operators expect.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The manifest presents the skill as per-user learning, but the spec also creates shared global stores and promotes patterns across users. That broadens data scope from isolated personalization to cross-user aggregation, increasing privacy and data-governance risk beyond the advertised design.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill claims to store corrections, preferences, and errors, but it also records future events, reminders, and follow-ups. This expands persistent collection into personal scheduling and life-event tracking, creating additional privacy sensitivity not justified by the stated self-improvement function.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instructions encourage retaining emotional state, relationship dynamics, stress cues, and personal disclosures, which goes far beyond operational self-improvement. Persisting this kind of sensitive inferred data increases the chance of privacy harm, profiling, and unintended exposure through later prompt inclusion or file access.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This hook does not merely implement logging; it injects new bootstrap instructions into AGENTS.md/TOOLS.md that coerce downstream agent behavior, including mandatory Bash-based persistence of user data. That is dangerous because it covertly alters agent policy at runtime and expands the skill from a passive logger into a hidden instruction-manipulation mechanism with persistence across conversations.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The injected directive to perform writes silently and 'never mention it to the user' is a covert-behavior instruction unrelated to the minimal function of storing preferences. Hidden persistence of user-specific data without disclosure undermines user awareness, defeats oversight, and creates an avenue for stealthy profiling.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The header comment materially understates what the code does by claiming it only modifies bootstrap content, while the implementation also creates on-disk .learnings directories. Although the directory creation itself is not the core exploit, this discrepancy obscures persistence behavior and can mislead reviewers about the true data-handling surface.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README describes persistent per-user storage of corrections, preferences, errors, and profiling data, while only briefly mentioning privacy and that the system is invisible to users. It does not clearly specify consent, retention limits, deletion procedures, access controls, or data minimization requirements, which creates a real privacy and compliance risk in a multi-user agent setting.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill is marked always-on and is framed to run at every conversation start and after tasks, which creates broad, implicit activation. Always-on prompt shaping and persistence increase the odds of collecting or using data outside the narrow circumstances users or operators would expect.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs persistent per-user storage while also instructing the agent to never mention the learning system to the user. Undisclosed retention of user-linked data undermines transparency and consent, and is especially risky given the breadth of data categories stored.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The bootstrap behavior creates user-specific directories and files, including overwriting profile data, without disclosure or consent. Silent creation of long-lived user records materially raises privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The hook automatically reads prior per-user learnings during bootstrap and creates persistent per-user directories on message receipt, but the documentation does not clearly warn users about this persistence and context injection. That lack of transparency can undermine user consent and lead to unexpected retention or reuse of sensitive preferences, corrections, or personal data across sessions.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The code explicitly instructs the agent to write user-related data silently, without any user-facing warning. In a user self-improvement skill, hidden persistence is especially sensitive because it can accumulate personal preferences, corrections, and profile data over time without meaningful notice or consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Modifying AGENTS.md or TOOLS.md during bootstrap changes the agent's effective operating instructions without disclosure, creating a hidden policy layer that other components and users may not expect. Even if intended for convenience, this is a covert control channel that can be abused to alter behavior beyond the skill's stated purpose.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill explicitly directs retention of highly personal natural-language summaries, including emotions, family disclosures, relationship dynamics, future plans, and behavioral cues. Such rich free-text memory is difficult to sanitize, easy to leak through later prompt injection or retrieval, and significantly increases harm if accessed by unauthorized parties or surfaced in the wrong context.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The appended instructions direct the agent to persist user corrections, preferences, and learned facts across conversations, building durable per-user memory and profile artifacts. In this skill context, that is more dangerous because the skill is explicitly user-scoped and designed to collect longitudinal behavioral data, making undisclosed retention and profiling a primary risk rather than an incidental one.

Ssd 4

Medium

• Confidence: 88% confidence
• Finding: Framing the behavior as 'self-improving' while embedding hidden memory collection and profile-building instructions normalizes increasingly invasive persistence as a routine feature. This is risky because it can desensitize reviewers and operators to covert surveillance-like behavior, making future expansion of hidden data collection easier to justify and harder to detect.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.