Security audit

self-improving

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly local and purpose-related, but it asks the agent to build broad persistent memory and user-profile records with unclear consent and scope controls.

Review before installing. Use this only if you intentionally want persistent local agent memory. Prefer strict or passive mode, avoid global hooks, require confirmation before writes, and periodically inspect or delete ~/self-improving/, .learnings/, USER.md, and notes/*.md. Do not use it in sensitive workspaces unless raw-message logging and proactive profiling are disabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill declares a strict file-access boundary, then later instructs reading and writing additional files such as SESSION-STATE.md, memory/YYYY-MM-DD.md, working-buffer files, USER.md, and notes/*. This contradiction weakens any trust in the stated boundary and can lead to broader-than-expected persistence of user data and unauthorized workspace modification.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill says it never infers preferences from silence, but its confidence-growth rules increase confidence when the user does not correct behavior. That effectively treats non-correction as evidence, which can silently create inaccurate user profiles and persistent behavioral drift.

Description-Behavior Mismatch

High

Confidence: 90% confidence
Finding: A skill presented as local self-improvement and memory logging expands into log-analysis, deployment gating, fleet management, and self-healing automation. This scope creep increases attack surface and makes it harder for users to understand what the skill may do, including triggering actions unrelated to the original purpose.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill claims narrow local behavior, but later adds proactive cron-driven prompting, user profiling, and tracking files like USER.md and recurring-pattern notes. This creates standing surveillance-style behavior that exceeds the stated purpose and can collect unnecessary personal data over time.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document states that the hook scripts 'only output text' and 'don't modify files or run commands,' but the very configuration shown uses command-type hooks that execute shell scripts. This mismatch can mislead users into underestimating the trust and execution risk of enabling the hooks, especially since those scripts run with the agent's permissions.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The kill switch relies on the plain-language phrase "forget everything," which is ambiguous and could be triggered during ordinary conversation, quoting, testing, or discussion of policy rather than as an actual deletion command. In a memory-management skill, accidental activation can cause unintended export and deletion of stored data, disrupting service and potentially exposing data during the export step.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill explicitly instructs the agent to log corrections immediately, promote repeated patterns, and write project-scoped preferences, which implies persistent collection of user behavior and preferences. Even though the content excludes some sensitive categories, it provides no user-facing notice, consent flow, retention limit, or deletion mechanism, creating privacy and profiling risk if these records are stored or reused beyond the current interaction.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The template explicitly instructs creation of directories and files under the user's home directory, which causes local filesystem modification when followed. Although the actions are simple and not inherently destructive, they still cross the boundary from documentation into persistent local state changes without any warning, confirmation step, or explanation of side effects.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The file states that the agent will automatically load and modify a persistent memory file on every session, but it does not include any user warning, consent mechanism, or guidance about what kinds of data may be retained. This creates a real privacy and integrity risk because personal or sensitive information could be persistently stored, reused across sessions, or altered without the user's informed awareness.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes automatically persisting user corrections, preferences, and project patterns across multiple files without any explicit notice, consent, or retention controls at the point of collection. This can cause unintended storage of personal, sensitive, or confidential project information and may surprise users who did not realize their inputs were being indexed and reused later.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The skill automatically loads prior memory and project context at session start without warning the user that previously stored personal or project data will be read and influence responses. While this is less severe than silent writes, it still creates privacy and transparency risks, especially in shared, regulated, or sensitive environments.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: An empty matcher causes the hook to trigger on every prompt, creating an unnecessarily broad execution surface. While this is presented as intended functionality, it increases the frequency of automatic script execution and can amplify the effect of a buggy, changed, or malicious script.

Vague Triggers

High

Confidence: 95% confidence
Finding: Using an empty matcher in a user-level global configuration causes the script to execute across all sessions and projects, greatly broadening blast radius. If the referenced script is modified, compromised, or unsuitable for some repositories, every prompt becomes a trigger point.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The minimal setup still uses an unconstrained matcher, so the script runs on every prompt despite being positioned as a lower-overhead option. This reduces overhead only in number of hooks, not in trigger scope, and still creates broad automatic execution.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The Codex CLI example also uses an empty matcher, making the command hook fire on any prompt. This broad trigger is risky because it normalizes automatic execution of local shell scripts without contextual constraints.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guidance explicitly recommends 'aggressive learning' with 'minimal confirmation' for power users, which can cause the agent to infer, store, or update user preferences without clear notice or consent. In a memory-management skill, this is more dangerous because the surrounding content operationalizes long-term storage, indexing, recovery, and cross-namespace propagation of user data, increasing the chance of over-collection or persistent retention of sensitive preferences.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The setup instructs the agent to make repeated persistent writes to workspace and home-directory memory files, including doing so immediately after corrections and even before the final response, without requiring explicit per-write consent or clearly warning that user/workspace data will be modified and retained. This creates a real risk of silent state changes, accidental data retention, and contamination of future agent behavior from unreviewed natural-language entries.

Ssd 3

High

Confidence: 98% confidence
Finding: The Working Buffer protocol requires logging every user message after a context threshold, which will inevitably capture sensitive content, secrets, personal data, and confidential instructions. Because the rule is broad and mandatory, it overrides data minimization and creates persistent storage of information that may never need to be retained.

Ssd 3

High

Confidence: 98% confidence
Finding: The WAL protocol mandates persisting corrections, names, preferences, decisions, edits, IDs, dates, and URLs before responding. This is broad personal/contextual data collection by default and can create a durable record of sensitive user information far beyond what is needed for the immediate task.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The Growth Loop instructs the agent to ask probing questions to learn more about the user and store the results in USER.md. That is a standing data-harvesting mechanism that can accumulate personal preferences and contextual information without clear necessity, scope limits, or consent controls.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill explicitly directs the agent to persist corrections, reusable lessons, preferences, and workflow/style choices into long-term natural-language memory files. Because these entries may contain sensitive user information, proprietary project context, or security-relevant details, this creates a durable retention and later disclosure risk across tasks and sessions.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The AGENTS.md refinements broaden the capture policy so that user statements such as 'remember this,' factual context, events, decisions, corrections, preferences, and performance lessons are routed into persistent memory stores. This is especially risky because the guidance is generic and non-specific, making over-collection likely and increasing the chance that sensitive context is written to durable files without careful review.

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Content: --- ## Part 30: Reverse Prompting（合并自 proactive-agent v3.1.0） > 主动询问用户需要什么，而不是等待被告知。
Confidence: 84% confidence
Finding: Reverse Prompt

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.