Improvement Learner

• Outcome: Review
• Latest audit: May 28, 2026 · 8:38 AM UTC
• Version: 1.0.0

Overview

This skill is meant to improve other skills, but it can modify target directories, run target tests, call the local Claude CLI, and make git commits without clear opt-in boundaries.

Install only if you intend to run an active self-improvement tool on trusted, backed-up, version-controlled skills. Avoid using it on untrusted skill packages or sensitive SKILL.md content unless pytest and Claude execution are sandboxed or disabled, and review diffs before accepting generated changes or commits.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)

    try:
        result = subprocess.run(
            ["claude", "-p", "--output-format", "json"],
            input=prompt,
            capture_output=True,

• Confidence: 95% confidence
• Finding: The code sends untrusted SKILL.md content directly to an external `claude` CLI for evaluation. Because skill content is explicitly adversarial in this review context, this creates an output-injection/prompt-injection risk where embedded instructions can manipulate the evaluator, exfiltrate sensitive prompt context, or cause unsafe downstream decisions in the self-improvement loop.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Base score from tests (0.0-1.0)
    if has_tests:
        try:
            result = subprocess.run(
                [sys.executable, "-m", "pytest",
                 str(skill_path / "tests"), "-q", "--tb=no"],
                capture_output=True, text=True, timeout=30,

• Confidence: 79% confidence
• Finding: Running `pytest` on a target skill's tests executes arbitrary Python from that skill directory. If the evaluated skill is untrusted, this becomes arbitrary code execution in the analyst/agent environment, which is especially dangerous because the tool is designed to inspect and modify third-party skill content.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises shell execution and file read/write behavior via its CLI examples and described automation, but it declares no permissions or capability boundaries. This creates a trust and containment problem: an orchestrator or user may invoke a skill that can modify files or run commands without any explicit consent model, increasing the chance of unintended code execution or repository changes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description frames the skill as a scoring and optimization helper, but the detected behavior includes external LLM invocation, test execution, file creation/modification, git operations, and security scanning with punitive score changes. This mismatch is dangerous because operators may grant or trigger the skill under the assumption that it is a passive evaluator when it can perform materially more powerful actions affecting the filesystem, repository history, and external toolchain.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill's stated purpose is evaluation/improvement, but it also stages and commits repository changes automatically. This hidden write-side effect can be abused to persist unwanted changes, alter audit trails, or surprise users who expected read-mostly analysis behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: `revert_to_backup` deletes the target skill directory with `shutil.rmtree` before restoring it, without confirmation, path safety checks, or rollback hardening. If `skill_path` is wrong, attacker-controlled, or unexpectedly broad, this can cause destructive data loss across arbitrary directories accessible to the process.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code performs `git add` and `git commit` automatically with no user-facing warning or approval. In a self-modifying tool, silent VCS side effects can persist malicious or low-quality changes and make unintended modifications appear authoritative in project history.

Static analysis

No suspicious patterns detected.