meta-self-evolution-metrics

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

This skill is openly about self-evolution, but it asks the agent to keep cross-session memory and modify its own instructions without clear user control.

Review before installing. This does not show exfiltration or destructive code, but it is designed to remember usage and preferences across sessions and to evolve agent behavior. Only use it where persistent local memory and possible instruction changes are acceptable, and prefer disabling or manually reviewing any SKILL.md updates.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents persistent writes to local state files such as learned_patterns.json and also suggests writing back to SKILL.md, but the manifest declares no permissions. This creates a transparency and control gap: a caller may invoke what appears to be a read/evaluate skill while it performs state-changing filesystem operations, increasing the risk of unauthorized persistence or tampering.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The manifest frames the skill as a metrics/evaluation meta-skill, but the body adds persistent logging of invocation history and preferences. That mismatch is dangerous because users and orchestrators may grant trust or invoke it in contexts appropriate for analysis only, while it silently accumulates durable state that can expose user data or alter future behavior.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill instructs that accumulated errors should cause experience to be written back into SKILL.md, which is a form of self-modification extending beyond metrics collection. Self-modifying instructions can let untrusted runtime inputs influence future behavior persistently, causing prompt injection persistence, policy drift, or corruption of the skill definition.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill persists user preferences and usage history in learned_patterns.json despite presenting itself as a metrics-focused capability. Collecting and retaining cross-session user data without strong necessity expands the privacy attack surface and can leak sensitive workflow details to later tasks or other components.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The text states that the learning module automatically records usage outcomes and preferences, but it does not provide a clear user warning or consent mechanism for persistent retention. Silent retention is risky because users may unknowingly provide sensitive preferences or task metadata that remain available across sessions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly promotes persistent collection and reuse of user preferences and operational history across sessions. In context, this is more dangerous because the skill is a meta-skill intended for orchestration and repeated use, so retained state can accumulate sensitive behavioral data and influence unrelated future tasks.

Self-Modification

High

• Category: Rogue Agent

Content

- 显性工作流步骤（3 步）：
  1. **加载（load）**：读取 meta-evolver 的 evolver_patterns.json（封闭/已知缺口/历史动作）。
  2. **度量（evaluate）**：算覆盖度、停滞、漂移，给出推荐动作。
  3. **建议（recommend）**：饱和→selfpatch 扩展矩阵；停滞→聚焦 Top 缺口；健康→继续。

## 增强点（超越教师）
1. **可靠自验证**：每步产出后用 `reason-verify` 做命题一致性/事实锚定校验，reliability<0.8 即回退重做。

• Confidence: 90% confidence
• Finding: The workflow references 'selfpatch' and the document elsewhere describes writing learned experience back into SKILL.md, indicating a pathway for self-modification. In a skill that also consumes history and reflections, this creates a persistence channel where bad inputs, prompt-injection artifacts, or faulty heuristics can become durable behavior changes, amplifying compromise over time.

Static analysis

No suspicious patterns detected.