Error-Driven Evolution

• Outcome: Pass
• Latest audit: May 28, 2026 at 8:53 AM UTC
• Version:
  1.0.0

Overview

This is a disclosed markdown-only learning workflow that stores local lessons and optionally shares anonymized lessons, with privacy care needed but no artifact-backed malicious behavior.

Install this only if you want agents to keep persistent workspace lessons that influence future behavior. Review lessons.md periodically, avoid storing secrets or identifiers, and do not run external submission scripts or publish lessons without manual review and redaction.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mandates persistent writes to `{workspace}/lessons.md` and appending new rules without requiring user awareness or consent. In agent environments, silent modification of workspace files can create integrity issues, unintended persistence of sensitive context, and side effects that outlive the current task.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The community-sharing feature encourages external transmission of learned lessons to a public repository but does not present a strong, explicit privacy and data-handling warning in the core instructions. Because lessons are derived from user corrections and mistakes, they may contain confidential prompts, operational details, file names, or other sensitive business context even after imperfect anonymization.

VirusTotal

66/66 vendors flagged this skill as clean.