My Self Improving

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:05 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent memory tool, but it persistently changes future agent behavior and workspace steering in ways users should review before installing.

Install only if you want the agent to keep cross-session local memory and change workspace steering files so that memory is loaded and updated during future work. Before enabling it, review proposed AGENTS.md, SOUL.md, and HEARTBEAT.md diffs, avoid storing sensitive personal or credential information, and decline or separately audit the optional proactivity skill unless its publisher and version are pinned.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:53
• Finding: Unvalidated User Instructions Can Poison Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:53-77`, `SKILL.md:167-178`, `setup.md:79-86`, `setup.md:153-160` **Vulnerability Type**: Persistent storage of user-controlled behavioral instructions **Risk Level**: High ### Vulnerable Code From `SKILL.md:53-77`: ```markdown ## Learning Signals Log automatically when you notice these patterns: **Corrections** → add to `corrections.md`, evaluate for `memory.md`: - "No, that's not right..." - "Actually, it should be..." - "You're wrong about..." - "I prefer X, not Y" - "Remember that I always..." - "I told you before..." - "Stop doing X" - "Why do you keep..." **Preference signals** → add to `memory.md` if explicit: - "I like when you..." - "Always do X for me" - "Never do Y" - "My style is..." - "For [project], use..." **Pattern candidates** → track, promote after 3x: - Same instruction repeated 3+ times - Workflow that works well repeatedly - User praises specific approach ``` From `SKILL.md:167-178`: ```markdown ### 2. Tiered Storage | Tier | Location | Size Limit | Behavior | |------|----------|------------|----------| | HOT | memory.md | ≤100 lines | Always loaded | | WARM | projects/, domains/ | ≤200 lines each | Load on context match | | COLD | archive/ | Unlimited | Load on explicit query | ### 3. Automatic Promotion/Demotion - Pattern used 3x in 7 days → promote to HOT - Pattern unused 30 days → demote to WARM - Pattern unused 90 days → archive to COLD - Never delete without asking ``` From `setup.md:79-86`: ```markdown ```markdown **Self-Improving** Compounding execution quality is part of the job. Before non-trivial work, load `~/self-improving/memory.md` and only the smallest relevant domain or project files. After corrections, failed attempts, or reusable lessons, write one concise entry to the correct self-improving file immediately. Prefer learned rules when relevant, but keep self-inferred rules revisable. Do not skip retrieval just because the task feels familiar. ``` `` ...[truncated 2139 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace free-form executable memory entries with a structured schema containing: - Preference type. - Allowed scope. - Source identity. - Creation and expiration timestamps. - Confirmation status. - A non-executable value. 2. Reject persistent entries concerning: - Safety policies or instruction hierarchy. - Tool permissions or filesystem scope. - Authentication information or secrets. - External communication. - Software installation or command execution. - Requests to suppress confirmation or auditing. 3. Treat all loaded memory as untrusted data subordinate to system, developer, and current authorized user instructions. 4. Require explicit workspace-owner approval before creating global or cross-session rules. 5. Do not promote a rule based only on repetition; perform a security-policy check before promotion. 6. Escape or quote stored text and clearly delimit it as data rather than Agent instructions. 7. Record provenance and prevent instructions from one user, project, or shared channel from affecting another. 8. Provide a review queue where proposed persistent rules can be approved, edited, rejected, or scoped before activation. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:62
• Finding: Setup Persistently Modifies Workspace Steering Beyond the Declared Storage Scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:213-227`, `setup.md:62-87`, `setup.md:108-160`, `setup.md:183-196` **Vulnerability Type**: Persistent modification of Agent steering files and inaccurate scope declaration **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:213-227`: ```markdown ## Scope This skill ONLY: - Learns from user corrections and self-reflection - Stores preferences in local files (`~/self-improving/`) - Maintains heartbeat state in `~/self-improving/heartbeat-state.md` when the workspace integrates heartbeat - Reads its own memory files on activation This skill NEVER: - Accesses calendar, email, or contacts - Makes network requests - Reads files outside `~/self-improving/` - Infers preferences from silence or observation - Deletes or blindly rewrites self-improving memory during heartbeat cleanup - Modifies its own SKILL.md ``` From `setup.md:62-87`: ```markdown Add to your AGENTS.md or workspace config: ```markdown ## Self-Improving Mode Current mode: Passive Available modes: - Passive: Only learn from explicit corrections - Active: Suggest patterns after 3x repetition - Strict: Require confirmation for every entry ``` ### 4. Add SOUL.md Steering Add this section to your `SOUL.md`: ```markdown **Self-Improving** Compounding execution quality is part of the job. Before non-trivial work, load `~/self-improving/memory.md` and only the smallest relevant domain or project files. After corrections, failed attempts, or reusable lessons, write one concise entry to the correct self-improving file immediately. Prefer learned rules when relevant, but keep self-inferred rules revisable. Do not skip retrieval just because the task feels familiar. ``` ``` From `setup.md:183-196`: ```markdown ### 7. Add HEARTBEAT.md Steering Add this section to your `HEARTBEAT.md`: ```markdown ## Self-Improving Check - Read `./skills/self-improving/heartbeat-rules.md` - Use `~/self-improving/heartbeat-state.md` for last-run marke ...[truncated 2320 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Correct `SKILL.md` to disclose that setup reads and modifies workspace `AGENTS.md`, `SOUL.md`, and `HEARTBEAT.md`. 2. Request explicit, separate consent before changing each steering file. 3. Display the exact proposed diff before writing it. 4. Create backups and provide a deterministic uninstall or rollback procedure. 5. Prefer an opt-in Skill activation mechanism that does not modify global or workspace steering. 6. Avoid placing automatic memory writes in `SOUL.md`; keep them inside the explicitly invoked Skill workflow. 7. Make heartbeat integration separately optional and disabled by default. 8. Validate installed Skill paths and ensure heartbeat instructions cannot resolve to attacker-controlled files. 9. Limit setup changes to a clearly delimited managed block so later removal does not damage unrelated workspace instructions. ]]>

T08 · Insecure Dependencies

Warning

• Location: setup.md:90
• Finding: Unpinned Companion Skill Is Installed and Activated from a Mutable Registry<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:90-104` **Vulnerability Type**: Unpinned third-party Skill installation and immediate trust **Risk Level**: Medium ### Vulnerable Code ```markdown ### 5. Add the Proactivity Companion as Part of Setup At the end of setup, briefly tell the user that you are going to add characteristics so the agent is more proactive: - noticing missing next steps - verifying outcomes instead of assuming they landed - recovering context better after long or interrupted threads - keeping the right level of initiative Then say that, for this, you are going to install the `Proactivity` skill. Only install it after the user explicitly agrees. If the user agrees: 1. Run `clawhub install proactivity` 2. Read the installed `proactivity` skill 3. Continue into its setup flow immediately so the skill is active for this workspace ``` ### Technical Analysis The setup installs `proactivity` by mutable registry name without specifying: - An exact version. - A package digest or signature. - An expected publisher identity. - An audited source revision. - A permission manifest. - A post-install security review. The Agent is instructed to read the downloaded Skill and immediately continue its setup flow. This extends trust to whatever package the registry resolves at installation time. The effective companion behavior can therefore change after this package has been audited. User confirmation reduces surprise but does not protect against registry compromise, package ownership changes, malicious updates, or a package whose current behavior differs from the version originally intended by the author. ### Attack Path 1. The registry package named `proactivity` is compromised, transferred, or updated with unsafe instructions. 2. The user approves installation based on the generic description included in this Skill. 3. The Agent executes `clawhub install proactivity`, resolving the current mutable package. 4. The Agent reads t ...[truncated 868 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the companion Skill to an exact audited version. 2. Verify a cryptographic digest or signed package manifest before installation. 3. Validate and display the expected publisher identity and package source. 4. Present the companion's requested permissions and exact setup changes before activation. 5. Audit the installed content before following any of its instructions. 6. Require a second explicit confirmation after the audit and before executing its setup flow. 7. Do not automatically activate newly downloaded instructions in the same trust step as installation. 8. Fail closed if the pinned version, signature, digest, or publisher cannot be verified. 9. Document how to remove the dependency and revert all workspace modifications it performs. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that workspace setup should add steering to AGENTS, SOUL, and HEARTBEAT.md, but it does not prominently warn that activating setup may modify workspace files. Silent or poorly disclosed modification of project instruction files can surprise users, alter agent behavior for future tasks, and create trust and integrity issues in the workspace.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to automatically log user corrections, preferences, and repeated instructions into persistent local files, but it does not require a clear user-facing notice or consent at the moment of collection. This creates a privacy and transparency risk because users may unknowingly provide sensitive preferences or personal data that become durable state across sessions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`

• Confidence: 81% confidence
• Finding: The skill authorizes autonomous promotion, demotion, and archival of learned patterns based on heuristics and time thresholds without requiring user confirmation. Although bounded to the skill's memory store, this still changes persistent agent behavior and retained state automatically, which can reinforce bad inferences or unexpectedly suppress useful context.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The kill switch is triggered by a single broad natural-language phrase, "forget everything," which could be said in normal conversation, quoted, or referenced hypothetically. In a self-improving memory skill, accidental activation could cause unintended export and deletion of learned state, creating integrity and availability issues and potentially exposing memory contents during the export step.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to log user corrections, repeated behaviors, and project-scoped preferences, but it does not disclose retention, storage location, access boundaries, or consent expectations. In a self-improving memory skill, that omission creates a real privacy and transparency risk because users may unknowingly provide persistent behavioral data that can be stored beyond the current session.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The reversal flow says the agent will keep history, log reversals, and attach timestamps, which implies ongoing retention of historical preference records without notifying the user how long that history persists or whether it can be removed. Because this skill is designed for permanent self-learning and memory organization, hidden retention of historical behavioral data is more dangerous here than in a transient workflow.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill presents itself as self-improvement through corrections, but the operations define a broad persistent memory subsystem with search, export, full wipe, namespaces, status reporting, and maintenance behavior. That scope expansion is security-relevant because it increases the amount of user data stored and processed beyond what is necessary for the stated purpose, creating unnecessary privacy and abuse risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill automatically loads memory on session start and writes corrections to persistent files without any explicit user-facing notice or consent at the time of access. Silent persistence is dangerous because users may reveal preferences, work context, or sensitive project details assuming they are transient, when the system is actually storing and reusing them across sessions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Automatic correction logging stores user-provided context, timestamps, and potentially detailed interaction history in persistent memory without evidence of minimization. This creates a risk of collecting more sensitive information than needed, especially when contextual notes may contain project names, behavioral preferences, or other personal/workflow metadata.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The weekly cron maintenance introduces autonomous background processing of stored user data, including movement between tiers, archival, compaction, and digest generation. Even if intended for housekeeping, unattended retention and transformation of personal or project data increases privacy risk and can preserve information longer or in different forms than users expect.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The maintenance section describes automated archival, compaction, and digest generation but does not warn users that their stored data may be moved, summarized, or retained in secondary forms. This is risky because data lifecycle changes can undermine user expectations about deletion, recency, and visibility of previously stored information.

Ssd 3

Medium

• Confidence: 87% confidence
• Finding: Preserving archived preference history for future recall means prior user statements remain available even after the user changes their mind. That can be dangerous because outdated or sensitive preferences may continue to influence behavior, and retained historical statements may reveal user traits or prior contexts that the user expected to be superseded.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The file explicitly instructs creating directories and files under the user's home directory on first activation, which causes persistent local state changes. While the content appears intended for legitimate memory storage, it still modifies the filesystem without any warning, confirmation step, or explanation of side effects, which is a real security and safety concern for an agent skill.

Static analysis

No suspicious patterns detected.