Security audit

Self Improving Local

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local-memory skill that persists user corrections and preferences on disk; it is not malware, but users should understand the retention behavior.

Install only if you want a persistent local memory system. Review ~/self-improving/ regularly, avoid storing secrets or sensitive personal data, use the stricter confirmation mode if privacy matters, and decline the optional Proactivity companion unless you separately trust and want it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill claims it only reads files under ~/self-improving/, but its documented setup and workspace integration reference AGENTS.md, SOUL.md, and HEARTBEAT.md outside that directory. This mismatch can mislead operators about the skill's true file-access scope and weakens trust boundaries, increasing the risk of unintended modification of workspace steering files.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation says optional installation of a related skill may require network access, while later asserting the skill never makes network requests. Contradictory network-scope statements create ambiguity about whether outbound access can occur, which undermines least-privilege review and can hide data exfiltration or unapproved package retrieval behind 'optional' flows.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The scope section states the skill never reads files outside ~/self-improving/, but earlier instructions describe integrating with and updating workspace files such as AGENTS.md, SOUL.md, and HEARTBEAT.md. This contradiction obscures the actual boundary of file-system access and can cause users to enable the skill under false assumptions about what local files it may inspect or alter.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The setup for a self-improving skill unexpectedly instructs the agent to install and activate an additional `Proactivity` skill, which expands behavior and trust boundaries beyond the user’s original requested capability. Even though it asks for explicit user agreement, bundling a second skill into the primary setup creates scope creep and can lead to unreviewed capability escalation if the secondary skill has risky behavior or its setup is followed automatically.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs automatic logging of corrections, preferences, and repeated behavioral signals into persistent local memory without a prominent consent step or strong data-minimization controls. User corrections and preferences can easily contain sensitive personal, organizational, or project-specific information, so silent persistence creates privacy and retention risk even if storage is local.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrase "forget everything" is broad enough that it could be invoked unintentionally during normal conversation, quoted text, testing, or discussion of policy. In a self-improving agent with persistent memory, accidental activation could erase learned state and disrupt operation or cause loss of user-important context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Exporting current memory to a file before deletion creates a new copy of sensitive data and increases exposure risk if the file is stored insecurely, synced, logged, or left behind without the user's awareness. In the context of a memory-bearing agent, this directly undermines the user's expectation that a forget operation reduces retained data.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The template explicitly instructs creating persistent files and directories under the user's home directory on first activation, which modifies local state without any explicit consent, warning, or scoping safeguards. In a self-improving/proactive agent context, automatic persistence is more sensitive because it can accumulate user data over time and normalize filesystem writes as part of routine behavior.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly states it will load a memory file on every session and automatically add, demote, and compact entries, but it does not mention any user notification, consent, or controls around those reads and writes. In a self-improving agent, silent persistence is more dangerous because it can accumulate sensitive user data or behavioral patterns across sessions without the user realizing ongoing storage is occurring.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill specifies automatic loading and writing of memory-related files on session start and upon receiving corrections, but it does not require explicit user consent, visibility, or confirmation before accessing or modifying persisted data. In a self-improving agent, this is more dangerous because normal conversation events can silently trigger durable state changes, creating privacy, integrity, and unexpected data-retention risks.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The weekly maintenance flow automatically moves, archives, and compacts memory data based on age and usage without clear notice, retention policy disclosure, or user approval. This can lead to silent data movement, loss of accessibility, or unintended preservation of sensitive information in archives, which is especially risky in a memory system designed to persist user preferences and corrections over time.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill describes maintaining and modifying persistent memory artifacts such as memory.md, index.md, and archives, but it does not include a clear user-facing notice that information may be stored across sessions. In a self-improving agent context, this increases the risk of retaining user preferences, project details, or other potentially sensitive data without informed consent, especially because the feature is framed as routine operational behavior.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The file directs broad creation and modification of user and workspace files (`~/self-improving/*`, `AGENTS.md`, `SOUL.md`, `HEARTBEAT.md`) without an upfront warning that persistent local state will be changed. In an agent setting, silent persistence and configuration edits are security-relevant because they can alter future behavior, create hidden memory, and surprise users who did not intend durable changes.

Static analysis

No suspicious patterns detected.