T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:12- Finding
Excessive Filesystem and Command-Execution Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Improver
Security checks for vulnerabilities and agentic risk
Overview
The skill does not show malicious behavior, but it asks for broad write and command-execution authority while advertising autonomous self-improvement and skill evolution without clear scope, safeguards, or implemented functionality.
Review before installing. This package does not currently perform the learning features it advertises, yet it requests powerful file and command-execution capabilities and is designed to run continuously. Install only in a tightly sandboxed environment unless the publisher narrows permissions, documents clear user controls, and aligns the implementation with the claims.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description promises a functional self-improving agent with autonomous learning, pattern extraction, confidence scoring, and skill evolution on a 17-minute loop. The code only implements the loop structure and phase timing/logging. Each phase contains placeholder comments and sleeps, with no real data capture, analysis, extraction, aggregation, or self-improvement behavior. The 17-minute loop aspect is represented, but the primary promised capabilities are absent, making the description materially overstated relative to actual behavior.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises autonomous self-optimization, learning, and skill evolution while also declaring powerful tools such as Write, Bash, and Exec, yet it does not present a clear warning, consent model, or operational guardrails for file or system modifications. In this context, users may enable a highly privileged autonomous workflow without understanding that it could write files, execute commands, or alter system state if later implemented or interpreted literally by an agent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description says the skill 'learns from every execution' and 'continuously optimizes itself' without specifying when it should be invoked, what scope of executions it applies to, or any exclusion conditions. For a manifest/markdown file, this is vague enough to risk unintended activation because it describes broad autonomous behavior rather than narrow, explicit triggers.
- Content
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md - Write - Bash - Exec model: sonnet --- # Auto-Improver - 自动改进代理
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing title, headings, descriptions, FAQ, and operational guidance are presented in Chinese, with no indication that another language can be selected or that the locale is required for a region-specific purpose. This creates a natural-language policy concern because the skill appears to impose a language choice without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description says the skill is an "Auto-improving AI agent that learns from every execution and continuously optimizes itself," but it does not define any concrete trigger conditions, scope boundaries, or exclusions. In a manifest file, this kind of broad self-improvement description can encourage unintended invocation because it implies applicability to nearly any execution context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest and module header describe substantive autonomous learning and self-optimization behavior, including learning from executions, pattern extraction, confidence scoring, and skill evolution. In the implementation, each phase only logs a message and waits for a configured duration, with TODO comments indicating the claimed learning and evolution logic is not actually implemented.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code includes natural-language descriptions, comments, and user-facing console output in Chinese throughout the file, but provides no indication that the language is configurable or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phase comments state that the code captures execution data, identifies patterns, generates instincts, and aggregates them into skills/commands/agents. However, the function bodies only print status messages, contain TODO placeholders, and sleep, so the comments actively overstate what the code currently does.
- Content
Static analysis
No suspicious patterns detected.