Security audit
Security checks for vulnerabilities and agentic risk
This skill is meant to keep local long-term agent memory, but it needs Review because it can turn corrections into persistent cross-session steering and optionally activates an unpinned companion skill.
Install only if you intentionally want local cross-session agent memory. Use Strict mode for sensitive work, review ~/self-improving/ regularly, avoid storing secrets or personal data, and skip the optional Proactivity install unless you have reviewed the exact package/version being installed.
learning.md:5Persistent Memory Can Promote Unvalidated Instructions into Cross-Session Agent Steering
setup.md:91Unpinned Third-Party Skill Is Installed and Immediately Activated
The skill instructs automatic persistence of user corrections, preferences, and repeated statements into local memory files, but it does not require a clear upfront notice and consent flow before storage begins. Even if the storage is local-only, users may reveal personal, proprietary, or sensitive information in normal conversation that gets retained beyond the current session unexpectedly.
Natural-language corrections and preference statements can easily contain sensitive data such as names, work details, confidential project information, or account-related context, and the skill's automatic logging increases the chance that such data is retained unintentionally. The stated boundary against storing credentials and certain categories is too narrow and lacks a filtering or redaction mechanism for the broader set of sensitive content users may casually provide.
A plain-language 'Export memory' path that zips all stored files can disclose previously accumulated user data in bulk without adequate scoping, minimization, or re-authentication. If triggered in the wrong context, it could expose unrelated historical preferences, project notes, or sensitive corrections that were collected over time.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking
### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |
The template explicitly instructs creation of persistent files and directories under the user's home directory (~/self-improving/...) without any notice, consent flow, retention policy, or privacy warning. In the context of a self-improving agent, these files are likely to accumulate user preferences, corrections, and behavioral history, which increases privacy and data persistence risk beyond a transient task artifact.
The skill behavior explicitly states that it will load and update a persistent memory file in the user's home directory, but the skill description does not warn users that session-derived preferences and patterns may be stored across sessions and auto-compacted. This creates a transparency and consent problem: users may unknowingly have personal, project, or behavioral data retained on disk beyond the current interaction.
The file implements a persistent user-memory subsystem with commands to search, display, export, delete, and archive stored user data, which materially exceeds a narrow 'self-reflection/self-criticism' capability. That scope expansion is security-relevant because it creates long-lived storage and retrieval of user data without clearly defined consent, minimization, retention, or access-control boundaries.
The workflow automatically loads, writes, and updates persistent memory files on session start and upon corrections, but provides no explicit user notice or consent mechanism for ongoing persistence and modification. This can cause silent accumulation of user preferences, project details, and behavioral patterns, creating privacy risk and unexpected state changes that the user may not realize are happening.
The weekly maintenance process performs background archival, tier movement, and compaction of stored data without explicit warning or approval, which can silently change where and how long user data is retained. Automated background data movement makes auditing, deletion assurance, and user expectations harder to maintain, especially for sensitive or project-scoped information.
Export and archival features increase the blast radius of any stored memory by making data easier to exfiltrate, duplicate, or retain beyond its original purpose. In a skill presented as self-improvement, these capabilities are not obviously necessary and therefore represent unnecessary data-handling risk unless tightly justified and controlled.
No suspicious patterns detected.