Self Improvement

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:28 AM UTC
• Version: 0.1.1

Overview

This skill is a disclosed self-improvement logger, but it asks agents to persist conversation-derived content and promote it into future instruction files too broadly.

Install only if you are comfortable with agents creating persistent learning files and potentially editing instruction files that affect future sessions. Keep hooks disabled unless you explicitly want broad automatic reminders, require review before writing to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md, or Copilot instructions, and redact secrets, customer data, credentials, raw request bodies, and private transcripts before logging.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:165
• Finding: Untrusted Conversation Content Can Be Promoted into Persistent Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 165–190, 306–312, and 488–543 **Vulnerability Type**: Persistent agent memory poisoning through instruction-file promotion **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md`, lines 165–190: ```markdown ### Promotion Targets | Target | What Belongs There | |--------|-------------------| | `CLAUDE.md` | Project facts, conventions, gotchas for all Claude interactions | | `AGENTS.md` | Agent-specific workflows, tool usage patterns, automation rules | | `.github/copilot-instructions.md` | Project context and conventions for GitHub Copilot | | `SOUL.md` | Behavioral guidelines, communication style, principles (bot) | | `TOOLS.md` | Tool capabilities, usage patterns, integration gotchas (bot) | ### How to Promote 1. **Distill** the learning into a concise rule or fact 2. **Add** to appropriate section in target file (create file if needed) 3. **Update** original entry: - Change `**Status**: pending` → `**Status**: promoted` - Add `**Promoted**: CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md` ``` `SKILL.md`, lines 306–312: ```markdown ## Best Practices 1. **Log immediately** - context is freshest right after the issue 2. **Be specific** - future agents need to understand quickly 3. **Include reproduction steps** - especially for errors 4. **Link related files** - makes fixes easier 5. **Suggest concrete fixes** - not just "investigate" 6. **Use consistent categories** - enables filtering 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md 8. **Review regularly** - stale learnings lose value ``` `SKILL.md`, lines 488–492: ```markdown **Activation**: Workspace injection + inter-agent messaging **Setup**: Configure workspace path in `~/.bot/bot.json` **Detection**: Via session tools and workspace files (`AGENTS.md`, `SOUL.md`, `TOOLS.md`) Bot uses a wo ...[truncated 3524 chars]
• Remediation: ## Remediation Suggestions 1. Remove the “promote aggressively” directive and make persistent promotion deny-by-default. 2. Require explicit, informed user approval for every modification to an instruction-bearing file. 3. Present the exact destination path and proposed diff before writing, and require separate confirmation after review. 4. Restrict promotion to verified project facts and conventions. Prohibit promotion of content that changes safety policy, authorization boundaries, tool permissions, command-execution rules, identity, or behavioral constraints. 5. Track provenance for every learning, including the originating user, conversation, trust level, and verification evidence. 6. Treat conversation text, error output, external documentation, and session transcripts as untrusted data. Do not preserve embedded imperative instructions as executable agent policy. 7. Add a review state between `pending` and `promoted`; only a trusted human maintainer should be able to approve promotion. 8. Limit writes to project-local learning records by default. Disallow automatic writes to global workspace files, home-directory configuration, and cross-project agent memory. 9. Disable cross-session transcript access and inter-agent forwarding unless specifically required and separately authorized for the current task. 10. Add automated checks that reject instruction-file changes containing permission escalation, safety bypasses, secret-disclosure directives, unreviewed commands, or external payload references.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The hook configuration uses an empty matcher, which makes the activator run for every submitted prompt. That broad scope increases the chance of collecting or acting on sensitive content from unrelated sessions and creates a pervasive always-on logging mechanism without contextual limitation.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: A second empty matcher applies to PostToolUse for Bash, again creating global activation behavior. This means any shell usage can trigger error-detection logic, potentially sweeping up command outputs, arguments, and environment-derived details into persistent logs across many workflows.

Exfiltration Commands

High

• Category: Prompt Injection

Content

Bot supports session-based communication:
- **sessions_list** - See active/recent sessions
- **sessions_history** - Read transcript from another session
- **sessions_send** - Send message to another session

### Hybrid Setup (Claude Code + Bot)

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The skill broadly instructs agents to persist learnings, errors, corrections, and promoted memory into local files and project memory. Because these categories are derived from natural-language interactions and troubleshooting context, they can easily include sensitive user content or internal project details that outlive the original session.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The error template explicitly asks for raw error output, inputs/parameters, and full context. Those fields frequently contain secrets, access tokens, file paths, customer data, or proprietary system details, so storing them in markdown creates a straightforward data retention and leakage risk.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The automatic triggers cover user corrections, new information, and feature requests, which encourages systematic persistence of user-supplied content. This increases the chance that private or regulated information shared during normal conversation becomes embedded in repository files or local memory artifacts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill defines automatic logging triggers from very common conversational corrections such as 'Actually...' or 'You're wrong about...'. In practice this can cause broad capture of user-provided text and corrections into persistent files even when the content may contain sensitive business context, credentials, or personal data, and it can normalize logging without explicit user consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Extraction Workflow

1. **Identify candidate**: Learning meets extraction criteria
2. **Run helper** (or create manually):
   ```bash
   ./skills/self-improvement/scripts/extract-skill.sh skill-name --dry-run
   ./skills/self-improvement/scripts/extract-skill.sh skill-name

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.