Agent自我反思与进化器

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 3.1.0

Overview

This skill is a disclosed local memory system, but it can automatically write broad conversation-derived rules into persistent agent behavior files.

Install only if you want an agent to maintain long-term local memory and periodically update its own behavior rules. Review or disable automatic cron use, require explicit approval before changes to MEMORY.md, SOUL.md, TOOLS.md, AGENTS.md, and new skills, and add redaction rules for tokens, cookies, API keys, URLs, parameters, and private payloads before logging errors.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:192
• Finding: Untrusted conversational signals can be promoted into persistent Agent behavior## Vulnerability Details **File Location**: `SKILL.md:94-99`, `SKILL.md:192-219`, and `SKILL.md:229-233` **Vulnerability Type**: Persistent memory poisoning through overly broad capture and promotion rules **Risk Level**: High ### Vulnerable Code Snippet ```markdown 4. **更新长期记忆** — 最重要 1-3 条洞察追加到 MEMORY.md（保持 ≤80 行） - **出口条件**：MEMORY.md 已追加新洞察且 ≤80 行（超限时已执行 mini 蒸馏） - 追加后若超80行：先执行 **mini 蒸馏**（合并高度相似的条目、删除已过时的旧条目），再追加新洞察 - 判断条件：内容相同只是表述不同 → 合并保留更精准的一条；超过30天未触发的规则 → 移入「## 已归档」 - mini 蒸馏不等于周度蒸馏，只做局部合并，不生成 Narrative - ⚠️ **写入铁律**：修改 MEMORY.md 必须用 `read → write` 覆写（见 IRON LAW #3） ``` ```markdown **正向反馈信号** → LEARNINGS.md positive_signal： - "好"、"可以"、"对"、"行"、"就这样"、"不错"、"喜欢这个" - "这个格式好"、"这次写得好"、"比上次好" - 木老师对特定输出未纠正且直接采用（隐式正向） **偏好信号** → LEARNINGS.md best_practice： - "我喜欢你这样"、"以后都这样"、"永远不要Y"、"我的风格是" - 木老师对特定方案明确赞许 ``` ```markdown | 经验类型 | 提升目标 | 示例 | |----------|---------|------| | 行为风格、原则 | SOUL.md | "输出用数字序号不用 bullet" | | 工作流、子Agent规则 | AGENTS.md | "有专属子Agent先分配给子Agent" | | 工具使用、API配置 | TOOLS.md | "发文件用本地路径而非远程 URL" | | 高频场景规律 | MEMORY.md | 偏好设置、常用 ID 等 | | 可复用能力模式 | 新建 mu-xxx Skill | 独立封装为技能 | ``` ### Technical Analysis The Skill treats broad conversational events as persistent learning signals. Generic acknowledgments such as “OK,” lack of correction, and implicit adoption are classified as positive evidence. The daily workflow then writes selected insights directly to `MEMORY.md`, while later promotion can modify `SOUL.md`, `AGENTS.md`, and `TOOLS.md`. These files can affect future Agent sessions, behavioral constraints, delegation rules, and tool use. Although recurrence and verification gates are documented for formal promotion, the daily `MEMORY.md` update is less strictly controlled, and no mandatory trust classification, provenance validation, prompt-injection screening, or explicit user approval is required before persistence. Consequently, content originating from an a ...[truncated 1586 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, contemporaneous user confirmation before any entry is written to `MEMORY.md`, `SOUL.md`, `AGENTS.md`, or `TOOLS.md`. 2. Treat generic acknowledgments and absence of correction as insufficient evidence for persistent learning. 3. Record provenance for every item, including source type, source identity, session, trust level, and whether the content came from a user, tool, retrieved document, or sub-Agent. 4. Prohibit promotion of content originating from tool output, web content, files, shared channels, or other untrusted sources unless independently confirmed by an authorized user. 5. Separate proposed memories from active Agent configuration. Store proposals in a review queue and activate them only after approval. 6. Apply an allowlisted schema to persistent entries and reject embedded instructions, commands, role changes, credential requests, and tool-routing directives. 7. Maintain an immutable audit trail and support rollback of each promoted memory. 8. Restrict automatic processing to informational memories; require stronger approval for behavioral, tool, security, or delegation rules.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/record-templates.md:65
• Finding: Error logging can persist credentials and sensitive operational data without redaction## Vulnerability Details **File Location**: `SKILL.md:181` and `references/record-templates.md:65-76` **Vulnerability Type**: Plaintext retention of sensitive error context **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown | 内部 API/MCP 失败 | 记录到 ERRORS.md，附接口和 token 状态，WHERE=api_call，WHY=具体根因 | ``` ```markdown ### 错误信息 实际报错内容 ### 上下文 - 尝试的操作 - 使用的参数或输入 - 环境信息（token是否过期、认证状态等） ### 建议修复 修复方向 ``` ### Technical Analysis The logging template directs the Agent to retain actual error messages, attempted operations, parameters or inputs, API details, and authentication context. It does not require redaction of authorization headers, access tokens, cookies, signed URLs, personal data, internal hostnames, or confidential request payloads. API and MCP failures frequently echo sensitive values in exception messages, request dumps, command output, query strings, and diagnostic context. The workflow stores these records in persistent Markdown files and may copy them into daily journals, weekly narratives, long-term memory, and archive files. Archival therefore extends rather than eliminates exposure. The project states that data remains local, but local storage alone does not make sensitive plaintext safe. Later Agent sessions, local users, backup systems, synchronization software, or accidentally published workspaces may gain access to the retained data. ### Attack Path 1. An API, MCP, authentication, or command operation fails. 2. Its diagnostic output includes a token, cookie, request parameter, internal endpoint, personal record, or other sensitive value. 3. Following the template, the Agent copies the actual error and input context into `ERRORS.md`. 4. Daily or weekly processing duplicates or summarizes the record into other persistent memory files. 5. The original record is eventually moved to an archive but remains readable. 6. A later Agent session, local user, backup process, repository co ...[truncated 718 chars]
• Remediation: ## Remediation Suggestions 1. Add mandatory redaction rules before any error or context is written to disk. 2. Remove or mask authorization headers, cookies, API keys, passwords, signed URLs, query-string secrets, private keys, and token values. 3. Store only authentication state categories such as `expired`, `missing`, or `rejected`; never store the credential itself. 4. Replace raw parameters and payloads with allowlisted, non-sensitive metadata. 5. Sanitize command output and stack traces before persistence. 6. Create memory and learning files with restrictive permissions, such as mode `0600`, and directories with mode `0700`. 7. Define retention periods for sensitive diagnostic records and securely remove expired records instead of indefinitely archiving them. 8. Add automated secret scanning before journal consolidation, promotion, archival, or repository commits. 9. Prevent sensitive error entries from being copied into `MEMORY.md`, narratives, generated Skills, or user-facing summaries.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13
• Finding: Mandatory full-file replacement can overwrite concurrent Agent-state changes## Vulnerability Details **File Location**: `SKILL.md:13` and `SKILL.md:312-313` **Vulnerability Type**: Non-atomic read-modify-write of shared persistent state **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 3. **所有文件修改必须用 `read → write` 覆写，禁止使用 edit 工具。** 原因：本流程耗时长，edit 的 oldText 基于早期读取的内容构造，等到实际执行时文件可能已被其他会话修改，导致匹配失败。用 write 全量覆写不依赖文本匹配，天然避免此问题 ``` ```markdown 1. **并发 write 风险**：read→write 覆写在多会话并发修改同一文件时，可能丢失其他会话的写入。IRON LAW #3 选择 write 是因为 edit 的 oldText 匹配失败概率更高，但 write 并非完美方案 ``` ### Technical Analysis The Skill mandates reading an entire shared file and later replacing it in full. This is a non-atomic read-modify-write pattern with no lock, version check, generation identifier, compare-and-swap operation, or merge step. If another Agent session modifies the same file after the initial read, the subsequent full write uses stale content and silently removes the newer changes. The Skill explicitly acknowledges this race condition but still makes the unsafe behavior mandatory. The affected files include persistent learning ledgers and potentially core Agent files such as `MEMORY.md`, `SOUL.md`, `TOOLS.md`, and `AGENTS.md`. Loss of recent changes can therefore remove user preferences, operational rules, tool configuration, or safety-related instructions. ### Attack Path 1. Session A reads a shared memory or configuration file. 2. Session B writes a legitimate update to the same file. 3. Session A continues processing using its stale in-memory copy. 4. Session A performs the mandated full-file replacement. 5. Session B’s update is silently deleted. 6. Future sessions operate using the older state, without an automatic indication that a conflict occurred. An attacker capable of triggering concurrent sessions could repeatedly induce this race to roll back recent Agent-state changes, although accidental concurrency alone is sufficient to cause the issue. ### Impact Assessment The issue aff ...[truncated 618 chars]
• Remediation: ## Remediation Suggestions 1. Replace the mandatory full overwrite rule with conflict-aware updates. 2. Acquire an exclusive file lock before reading and retain it until the write is complete. 3. Record a content hash or version number at read time and refuse to write if the file changed. 4. Write updates to a temporary file in the same directory, flush and synchronize it, then use an atomic rename. 5. Use append-only event records for journals and learning entries, followed by controlled compaction. 6. For structured state, use stable entry identifiers and perform a three-way merge rather than replacing the complete file. 7. Back up the previous version before modifying core Agent files and provide automatic rollback. 8. Serialize scheduled and interactive maintenance operations so that only one evolution workflow can modify a workspace at a time. 9. Report conflicts to the user instead of silently selecting one session’s state.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (79)

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

• Category: Rogue Agent

Content

# Contributing to mu-self-evolve

Thanks for your interest in contributing! This project keeps things simple — Python standard library only, no external dependencies.

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Static analysis

No suspicious patterns detected.