Self-Improving Agent (CEO Edition)

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 1.2.10

Overview

The skill is not overtly malicious, but it persistently changes how the agent remembers and applies learned rules across future tasks, so users should review it carefully before installing.

Install only if you want a persistent local memory system that can influence future agent behavior. Use strict confirmation, review ~/self-improving regularly, avoid storing sensitive or third-party information, and do not add the AGENTS.md, SOUL.md, or HEARTBEAT.md integrations unless you explicitly want cross-session steering and maintenance.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:58

Finding

Persistent Modification of Agent-Control Files

Content

View full analysis

.md` - Do not read unrelated domains "just in case" ``` ```markdown ## Optional: Heartbeat Integration Add to `HEARTBEAT.md` for automatic maintenance: ```markdown ## Self-Improving Check - [ ] Review corrections.md for patterns ready to graduate - [ ] Check memory.md line count (should be ≤100) - [ ] Archive patterns unused >90 days ``` ``` ### Technical Analysis The Skill's declared scope states that it stores preferences under `~/self-improving/` and reads its own memory files on activation. The setup process expands that scope by directing modifications to persistent agent-control files, including `S ...[truncated 1768 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.md:120

Finding

Persisted Corrections Are Not Validated Against Instruction Injection

Content

View full analysis

.md` - Project-only override → append to `~/self-improving/projects/.md` - Keep entries short, concrete, and one lesson per bullet; if scope is ambiguous, default to domain rather than global - After a correction or strong reusable lesson, write it before the final response ``` ```markdown ### On Session Start 1. Load memory.md (HOT tier) 2. Check index.md for context hints 3. If project detected → preload relevant namespace ### On Correction Received ``` 1. Parse correction type (preference, pattern, override) 2. Check if duplicate (exists in any tier) 3. If new: - Add to corrections.md with timestamp - Increment correction counter 4. If duplicate: - Bump counter, update timestamp - If counter >= 3: ask to confirm as rule 5. Determine namespace (global, domain, project) 6. Write to appropriate file 7. Update index.md line counts ``` ### On Pattern Match When applying learned pattern: ``` 1. Find pattern source (file:line) 2. Apply pattern 3. Cite source: "Using X (from memory.md:15)" 4. Log usage for decay tracking ``` ``` ### Technical Analysis Corrections, preferences, workflow choices, and self-generated lessons are written to persistent Markdown files and subsequently loaded and applied as behavioral patterns. The workflow does not require validat ...[truncated 1841 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: learning.md:24

Finding

Third-Party Personal Information Is Retained Despite a Prohibition

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says to 'Use before starting work and after responding to the user,' which is extremely broad and overlaps with almost every interaction. For a markdown skill description, this lacks clear scope constraints and could lead to unintended invocation in routine conversations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Phrases like 'significant work,' 'something in your own output that could be better,' and 'Knowledge should compound over time' are subjective and do not clearly define when the skill activates versus when it should stay inactive. This ambiguity increases the chance of inconsistent or excessive triggering.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill allows autonomous promotion, demotion, and archival of learned patterns based on internal heuristics without user confirmation. That can permanently reshape future agent behavior from repeated conversational inputs, enabling persistence of bad instructions, prompt-injected preferences, or misclassified sensitive/user-specific data even though deletion requires approval.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · boundaries.md (reported line 11)May include surrounding context.

md

| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The kill-switch phrase "forget everything" is ambiguous and lacks scope constraints, making it vulnerable to accidental activation, prompt injection, or misuse in quoted/indirect speech. In a self-improving memory-bearing agent, an overbroad deletion trigger can cause denial of service, loss of user state, or unauthorized erasure of records the user did not clearly intend to remove.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents persistent cross-session memory capabilities such as showing, forgetting, exporting, and querying stored memory, which go beyond the stated self-reflection purpose of evaluating its own work before and after responding. That scope expansion increases the chance of retaining user data, preferences, and project details without clear necessity or tight purpose limitation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Providing an 'Export memory' operation creates a bulk exfiltration path for all stored memory, including preferences, project history, and corrections, without a clear link to the skill's self-reflection function. Even if intended for user convenience, archive export materially increases the blast radius of any misuse or unauthorized invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The automatic operations repeatedly read, write, reorganize, and retain memory files, but the skill text provides no explicit user-facing warning or consent flow for ongoing persistence and modification. In context, this is more dangerous because the skill presents itself as self-reflection, which may lead users to underestimate that durable profile-like storage and background maintenance are occurring.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The weekly cron maintenance introduces autonomous background processing that continues scanning, moving, archiving, and compacting stored data outside the immediate user interaction model described by the skill. This increases persistence, data handling complexity, and the possibility of unseen modification or retention of user-derived information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section explicitly defines persistent memory indexing, tiered storage (HOT/WARM/COLD), namespaced files, and scheduled compaction, which goes beyond transient self-reflection and creates a durable user profiling/memory subsystem. In the context of a self-improving agent, this is more dangerous because it normalizes broad retention and retrieval of user- or project-specific data without clear minimization, consent boundaries, or purpose limitation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The user-type adaptation table authorizes different learning and privacy behaviors such as 'aggressive learning' for power users and category-based consent for privacy-focused users, without establishing a trustworthy basis for classification or consistent safeguards. This is risky because the agent may infer user category incorrectly and collect or retain more information than expected, especially in a skill already designed to self-modify and preserve memory over time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These instructions modify broader agent steering files such as AGENTS.md, SOUL.md, and optionally HEARTBEAT.md, which expands the skill from local self-reflection setup into persistent behavioral reconfiguration. That creates a supply-chain style risk: once installed, the skill can influence future task handling, memory access, and write behavior across unrelated contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "When someone says 'remember this'" is overly broad and common in normal conversation, so it can cause unintended persistence of information without meaningful confirmation. In a skill that writes to durable memory and updates future behavior, ambiguous everyday triggers increase the chance of accidental data capture or instruction poisoning.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation example "what do you know about me?" is phrased as a general conversational question rather than a narrowly scoped command. In a markdown skill boundary document, this can create ambiguity about when a full data export should be triggered versus when the user is asking casually about remembered context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs creation of persistent files and directories under the user's home directory on first activation, but provides no warning, consent step, or explanation of the filesystem side effects. Even though the commands are simple, silently writing persistent state can violate user expectations, create privacy concerns, and normalize unsafe agent behavior around local file modification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs durable logging of corrections, preferences, workflows, and reusable lessons to disk, creating cross-task memory that persists beyond the immediate conversation. While aligned with the skill's stated purpose, this persistence can accumulate sensitive or over-broad user data and alter future agent behavior in ways users may not expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.