skill-self-improve

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:45 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it needs Review because it can bulk-modify other installed skills and persist user-derived notes/preferences without clear confirmation, limits, or cleanup controls.

Install only if you are comfortable with a tool that can alter multiple existing skills under ~/.workbuddy/skills. Before running the injector, review the hard-coded target list, back up affected skill directories, and avoid recording secrets, personal data, customer data, filenames, or sensitive troubleshooting details in learned_patterns.json. Prefer running it on one explicit target at a time and add a deletion/redaction process for stored preferences and notes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

shutil.copyfile(LEARNER_SRC, os.path.join(scripts, "learner.py"))
    # 3) 初始化 learned_patterns.json
    import subprocess
    r = subprocess.run([PY, os.path.join(scripts, "learner.py"), "init", d],
                       capture_output=True, text=True)
    # 4) 追加章节
    section = open(SECTION_SRC, encoding="utf-8").read()

• Confidence: 78% confidence
• Finding: The script launches a Python subprocess to execute a just-copied learner.py inside each target skill directory. Even though the arguments are passed safely as a list, this still expands the injector from simple file modification into code execution, which is riskier because any compromise or unexpected behavior in learner.py will run automatically across many skills.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The injector performs active code execution on every target skill, although its stated purpose is bulk injection of files and documentation. This mismatch is dangerous because it gives the tool hidden operational capability beyond simple copying, increasing the chance of unintended side effects or abuse if learner.py is modified or replaced.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are broad terms like self-improvement, reflection, and learning system, which can match ordinary user conversation rather than an explicit request to modify skills. In this skill’s context, accidental activation is risky because the skill is designed to write files, inject content into other skills, and initialize persistent memory, potentially causing unintended repository changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The description emphasizes one-click injection into other skills and appending to SKILL.md, but it does not clearly warn users that this performs repository-changing write operations. That omission increases the chance that users or agents invoke it without understanding that it modifies multiple files and persists changes across skills.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: Executing a subprocess across each target skill without an explicit warning is more dangerous than ordinary file writes because it causes immediate code execution during installation. In this skill context, which mass-modifies many existing skills under ~/.workbuddy/skills, silent execution increases the blast radius if the invoked script behaves unexpectedly or is tampered with.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs persistent storage of operation counts, capability usage, error patterns, user preferences, and improvement suggestions in a local JSON file without any notice, consent, retention limit, or guidance to avoid sensitive data. This creates a privacy and profiling risk because routine usage and failure notes can easily capture personal or confidential information that will be reused across sessions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions say important user preferences should be written for automatic reuse in future runs, but they do not warn that this creates persistent behavioral changes that may outlast the user's intent or context. Automatic reuse of saved preferences can lead to silent personalization, surprise outputs, and inappropriate carryover of prior decisions into unrelated tasks.

Natural-Language Policy Violations

Medium

• Confidence: 85% confidence
• Finding: The example preference command persists '输出语言=中文' as a default for future runs, which encourages saving a language preference without any opt-in or indication that alternatives should be offered. While presented as an example, in this skill context it normalizes forcing a persistent language choice that may not match future users or sessions.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly promotes remembering user preferences and recording usage outcomes over time, creating persistent storage of user-derived data across sessions. Because the design is generic and free-form, agents may store sensitive or unnecessary personal data in natural language without consent boundaries, retention limits, or minimization controls.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The usage examples instruct recording free-form error notes and arbitrary preference values into a memory file, which strongly encourages storing sensitive user input verbatim. In practice, notes like upload issues, filenames, content snippets, or workflow preferences can easily contain personal, confidential, or proprietary information that then persists beyond the immediate session.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The memory schema explicitly persists preferences, recent operations, and last error notes, enabling long-term retention of user-derived behavioral and contextual data. Without access controls, encryption, expiry, or sensitivity restrictions, this store can accumulate data that reveals user habits, internal workflows, or sensitive troubleshooting context.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The section directs long-term storage of preferences, usage frequency, error history, and notes, but provides no minimization boundaries on what may be recorded. In practice, operators may store verbose failure notes, file characteristics, or user-specific context, causing unnecessary accumulation of sensitive operational and behavioral data.

Static analysis

No suspicious patterns detected.