Auto Improver Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:47 AM UTC
• Version: 1.0.1

Overview

This skill needs review because it asks for broad file and command authority for an autonomous self-improvement loop, while its install identity, dependency, data collection, and approval boundaries are unclear.

Install only in a sandbox or disposable test workspace until the publisher provides one canonical package identity, pinned dependencies, auditable source code, explicit data-source limits, and mandatory user review before any write or command execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:107
• Finding: Unpinned and Inconsistently Identified External Skill Dependency## Vulnerability Details **File Location**: `SKILL.md:107-115`, with related package identity and dependency declarations in `package.json:2-15` and `metadata.json:87-90` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:107-115`: ```markdown ## 🚀 快速开始 ```bash # 安装 clawhub install self-improving-skill # 启动自进化循环 self-improving-skill start --skill="skill-name" --interval="17m" ``` ``` `package.json:2-15`: ```json "name": "auto-improver-pro", "version": "1.0.0", "description": "Auto-improving AI skill that learns from every execution", "main": "src/index.js", "scripts": { "test": "jest", "start": "node src/index.js" }, "keywords": ["self-improvement", "learning", "automation", "feedback"], "author": "pagoda111king", "license": "MIT", "clawhub": { "slug": "auto-improver-pagoda", "name": "Self-Improving Skill", ``` `metadata.json:87-90`: ```json "dependencies": [ "skill-evolver" ], ``` ### Technical Analysis The quick-start instructions install `self-improving-skill`, while the package manifest identifies the project as `auto-improver-pro` and assigns it the ClawHub slug `auto-improver-pagoda`. The separate `skill-evolver` dependency is also declared without a version, source, or integrity digest. None of these external components is pinned to an immutable version or cryptographic integrity value. The repository contains no implementation against which the installed package can be compared: `package.json` references `src/index.js`, but the supplied project structure contains no `src` directory. As a result, the reviewed artifact does not establish the identity or contents of the executable code that the documented installation command would retrieve. This creates a supply-chain risk involving dependency confusion, package-name ambiguity, registry compromise, or mutable upstream releases. The risk is amplified ...[truncated 1945 chars]
• Remediation: ## Remediation Suggestions 1. Use one canonical identifier consistently across `SKILL.md`, `package.json`, and `metadata.json`. 2. Pin every external skill and dependency to an exact, reviewed version rather than resolving a mutable latest release. 3. Record the trusted registry or repository URL and verify publisher ownership before installation. 4. Publish and verify cryptographic integrity hashes or signed release attestations for installed artifacts. 5. Include the actual implementation, including `src/index.js`, in the auditable package. 6. Add a dependency lockfile and enforce frozen or immutable dependency resolution in installation and CI workflows. 7. Remove undeclared or unused dependencies, or formally declare their versions, sources, integrity values, and purpose. 8. Apply least privilege: do not grant `Write`, `Bash`, or `Exec` unless required for a specific operation. 9. Restrict writes to an explicitly selected target-skill directory and execute commands inside a sandbox with network and filesystem controls. 10. Require explicit user review and confirmation before applying generated modifications to another skill. 11. Add installation-time validation that rejects package identifiers, versions, or integrity digests that differ from the audited manifest.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill documentation is written entirely in Chinese, including the title, positioning, features, and pricing, with no indication that other languages are supported or that the language is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill requests Bash and Exec in addition to Read/Write even though the documented purpose is feedback analysis and self-improvement. Combined with repeated claims of autonomous optimization, these capabilities enable arbitrary command execution and file modification well beyond what users would reasonably expect, increasing the risk of destructive local actions or abuse if the skill is invoked on sensitive projects.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

- Write
  - Bash
  - Exec
model: sonnet
---

# Auto-Improver Pro - 自动改进专家

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The description explicitly says the skill will continuously optimize itself and execute optimizations, but it does not warn users that this may modify files or trigger actions autonomously. In a skill that also has Write, Bash, and Exec permissions, lack of informed consent is dangerous because users may unknowingly authorize persistent self-modifying or project-altering behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The example outcome promises 'automatic execution of optimization' without warning about irreversible changes, command execution, or scope of modification. Because example workflows strongly influence operator behavior, this normalizes unattended changes and can lead to accidental corruption, unsafe edits, or unintended command execution on real systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The description advertises automatic improvement through analysis of skill usage data but provides no disclosure about what data is collected, whether it may include prompts, outputs, identifiers, or telemetry, or how consent is obtained. This creates a privacy and governance risk because users and developers may enable the skill without understanding that operational data could be processed or retained.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are vague operational events such as version upgrades, performance evaluation, and identifying weaknesses, with no explicit authorization, scope, or user-confirmation boundaries. In a self-improving skill that analyzes other skills and usage data, broad triggers increase the chance of unreviewed activation and unintended processing of sensitive operational metadata.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow explicitly begins with data collection, yet the metadata includes no notice, consent flow, minimization policy, or restriction on the kinds of data gathered. Because this skill is positioned as an autonomous improvement engine, undisclosed collection at the first workflow step makes silent overcollection and downstream misuse more likely.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description claims the skill is 'auto-improving' and 'learns from every execution' without defining any bounded trigger conditions, approval gates, or operational limits. In an agent ecosystem, broad self-improvement and continuous learning language can encourage overly permissive invocation and autonomous behavior, increasing the chance of unintended actions, unsafe data handling, or prompt-scope expansion.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The title and most of the descriptive content are written in Chinese, while some command examples and labels remain in English. This may impose a default locale/language experience without explicit user opt-in or a documented language-selection option.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The FAQ asserts that all data is stored locally with encryption and that sensitive information is automatically detected and redacted. Elsewhere in the file, the only concrete capabilities presented are generic tools and self-improvement workflows; no encryption, redaction, or privacy-control implementation details are described, creating an intent-level documentation claim not reflected by the skill definition.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This manifest-like JSON contains multiple natural-language fields in Chinese, but there is no indication that the skill is intended only for Chinese-speaking users or that users can opt into this locale. Per the policy, forcing a specific language without user choice or documented justification is a natural-language policy concern.

Static analysis

No suspicious patterns detected.