Security audit

Self-Learning for Noktasist

Security checks for vulnerabilities and agentic risk

Overview

The skill is instruction-only, but it gives broad standing guidance to inspect systems, store user and identity information, and commit changes without clear consent or review.

Install only in a controlled workspace if you are comfortable with persistent agent memory and operational diagnostics. Require explicit approval before any command execution, log inspection, USER/IDENTITY/SOUL edits, or git commits; review staged files instead of using git add -A; and prohibit saving secrets, credentials, raw logs, or sensitive personal details.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill explicitly tells the agent to test systems with exec and perform system-level debugging/log inspection, which expands its behavior from passive learning into active execution and operational access. In a self-learning skill, this creates unnecessary authority and raises the chance of unintended command execution, environment tampering, or collection of sensitive operational data.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Directing the agent to modify IDENTITY.md and SOUL.md is unrelated to ordinary self-learning and can alter persistent behavior, persona, or policy-adjacent state. That makes the skill capable of drifting the agent's long-term identity without clear authorization or safeguards.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Mandating git add/commit for all meaningful changes gives the skill a built-in persistence and repository-modification mechanism that is broader than a learning-only role requires. This can normalize committing sensitive, mistaken, or policy-violating changes without a review checkpoint.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The guidance to learn from everything touched and use idle time for investigation is overly broad and can trigger the skill in many unrelated contexts. That broad activation increases the likelihood of unnecessary data access, logging, and side effects outside the user's immediate task.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs writing discoveries and troubleshooting outcomes into persistent memory files without warning the user that stored data is being modified. This creates silent state changes and may retain sensitive environment details beyond the current session.

Missing User Warnings

High

Confidence: 97% confidence
Finding: Updating identity and user-related files without privacy warnings or explicit consent is especially dangerous because it can change persistent profile information and store personal data silently. In context, a self-learning skill has no clear need to modify these files as a routine action.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instructions encourage persistent logging of system configuration, test results, and experiences into memory files, creating a durable natural-language record of potentially sensitive operational details. Such records can later expose infrastructure, troubleshooting history, or internal context to other processes or users.

Ssd 3

High

Confidence: 98% confidence
Finding: A mandatory rule to store 'user information' in a dedicated file strongly encourages retaining personal or sensitive user data without safeguards, minimization, or purpose limitation. In a self-learning skill, this creates an unjustified privacy and data leakage risk because user data persistence is not necessary for the stated function.

Static analysis

No suspicious patterns detected.