Auto Improve

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:31 PM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it automatically loads, writes, and reuses persistent project and global memory with too little scoping or user control.

Review this skill before installing. It may be useful for remembering project mistakes and successful patterns, but it should be used only where automatic memory loading and .antigravity.md updates are acceptable. Prefer explicit approval before loading repository memory or saving lessons, especially in sensitive or shared repositories.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:69

Finding

Automatic Loading and Persistent Storage of Untrusted Agent State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69-79, 100-122, 136-150, and 174
Vulnerability Type: Agent memory poisoning through automatic cross-session context loading and persistence
Risk Level: Medium

Vulnerable Code

python

# Automatisch bei Session-Start ausführen

# 1. Projekt-Kontext laden
project_root = detect_project_root()
antigravity_file = f"{project_root}/.antigravity.md"

if exists(antigravity_file):
    load_context(antigravity_file)
    
# 2. Globales Memory laden
recall_memory(tags=["mistakes", project_name])

python

save_pattern(
    situation=task.context,
    action=task.approach,
    outcome="success",
    pattern=extract_reusable_pattern(task)
)

python

learn_from_mistake(
    mistake=error.description,
    cause=error.root_cause,
    lesson=error.how_to_avoid,
    tags=["mistakes", project, domain]
)

# Auto-Update .antigravity.md
update_antigravity_mistakes(project, error)

yaml

session_start:
  - load_project_context
  - recall_mistakes
  - warn_known_issues

post_code_edit:
  - run_verification_loop
  - if_error: learn_from_mistake
  - if_success: save_pattern

session_end:
  - summarize_learnings
  - update_antigravity

The anti-pattern table also explicitly directs the agent to learn across sessions:

markdown

| Nur aktuelle Session | Cross-Session lernen |

Technical Analysis

The skill directs the agent to load .antigravity.md automatically from the current project and treat its contents as agent context. Because a repository contributor can control this file, its contents cross a trust boundary from repository data into the agent's operational context.

The skill does not define any content/data separation, schema validation, instruction filtering, provenance tracking, integrity verification, user confirmation, or trust policy for the loaded file. Consequent ...[truncated 2765 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat repository memory as untrusted data

   • Do not insert .antigravity.md directly into the instruction hierarchy.
   • Parse it using a strict schema containing factual project metadata only.
   • Reject behavioral directives, tool instructions, role changes, and requests to override security controls.

2. Require explicit approval

   • Display the file contents or a concise security-relevant summary before loading them.
   • Require separate confirmation before writing project or global memory.
   • Disable automatic global-memory mutation by default.

3. Isolate persistent state

   • Store memory in a project-specific namespace bound to a canonical repository identity.
   • Prevent project-derived content from being promoted automatically into global memory.
   • Apply expiration and size limits to learned entries.

4. Track provenance and trust

   • Record the source file, repository identity, commit, timestamp, authoring process, and verification status for every memory entry.
   • Do not reuse entries outside their original project unless a user explicitly approves promotion.
   • Mark generated inferences separately from verified facts.

5. Validate learning before persistence

   • Save only narrowly scoped, evidence-backed facts.
   • Require successful tests or other objective evidence before storing a pattern.
   • Prevent arbitrary task context, error text, or repository content from becoming persistent behavioral instructions.

6. Make updates reviewable and reversible

   • Present a diff before modifying .antigravity.md.
   • Use append-only audit records or versioned storage.
   • Provide controls to inspect, delete, quarantine, and roll back poisoned entries.

7. Add defensive instruction handling

   • Enforce a policy that content loaded from project files cannot supersede system, developer, user, or safety instructions.
   • Detect ...[truncated 175 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill declares automatic activation at session start, after every task, and on errors without defining scope limits, user consent, or guardrails. In this context, that can cause persistent memory access and automatic updates to project files to occur broadly and repeatedly, increasing the chance of unintended data retention or unauthorized modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The automatic trigger block operationalizes actions like load_project_context, recall_mistakes, summarize_learnings, and update_antigravity on broad lifecycle events, but it does not specify boundaries, authorization checks, or what data may be persisted. Because the skill is explicitly designed for cross-session learning and file updates, vague triggers materially increase the risk of over-collection, accidental persistence of sensitive information, and unwanted writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promotes cross-session learning, memory recall, saving mistakes/patterns, and automatic .antigravity.md updates, but it does not clearly warn users that persistent storage and file modification will happen. This omission undermines informed consent and can expose sensitive project details, errors, or operational context to long-term retention beyond the current session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill's user-facing description, headings, instructions, and trigger explanations are presented in German throughout, with no indication that users may choose another language. This may violate a language/locale policy when the skill is used in broader multilingual contexts without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.