Max-Self-Improvement

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.1

Overview

This skill is for persistent agent memory, but it can save broad conversation, project, and error details across sessions without clear opt-in or deletion controls.

Review this carefully before installing. Use it only if you want the agent to maintain persistent local memory, and avoid letting it store secrets, raw command output, private project details, or sensitive user information. Periodically inspect and delete the generated memory and .learnings files, and be cautious with the packaging script.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:213
• Finding: Persistent Memory Can Store and Reapply Attacker-Controlled Behavioral Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:213-216`, `SKILL.md:235-242`; `references/architecture.md:35-38`, `references/architecture.md:57-61`; `references/memory_templates.md:145-154` **Vulnerability Type**: Persistent memory poisoning **Risk Level**: Medium ### Vulnerable Code and Instructions `SKILL.md:213-216`: ```markdown | Learning Type | Promote To | |---------------|-----------| | Behavioral patterns | `/memories/user_preferences.md` | | Workflow improvements | `/memories/workflow_library.md` | | Tool tips | `/memories/domain_knowledge.md` | | Project facts/conventions | `/memories/project/[slug]/context.md` | ``` `SKILL.md:235-242`: ```markdown ## Common Mistakes to Avoid 1. **session_notes stack appending** — Update in-place, keep file lean 2. **Not reading memory before work** — Must read session_notes + user_preferences first 3. **Logging everything to memory** — Only write reusable content, avoid noise 4. **No confidence tags on memory** — Knowledge without confidence is blindly adopted 5. **Not saving before restart** — Must write all in-progress state before restart ``` `references/architecture.md:35-38`: ```markdown │ /memories/user_preferences.md ─ 用户偏好 [永不删除] │ │ /memories/domain_knowledge.md ─ 领域知识 │ │ /memories/workflow_library.md ─ 工作流程库 │ │ /memories/project/[slug]/ ─ 项目级记忆 │ ``` `references/memory_templates.md:145-154`: ```markdown ## Self-Improvement Directives ### 当前活跃指令 1. **[优先级-High]**: [指令内容] 2. **[优先级-Medium]**: [指令内容] ### 已完成指令 - [指令]: 已于 YYYY-MM-DD 完成 ### 待验证指令 - [指令]: 等待验证 ``` ### Technical Analysis The Skill promotes information derived from conversations, user feedback, observed behavior, and task content into persistent memory files. It then explicitly requires the Agent to read some of those files before performing subsequent work. The same architecture permits generated “Self-Improvement Directives” t ...[truncated 2106 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every memory entry as untrusted data, not executable Agent instruction. 2. Store memories in a strict schema with separate fields for facts, preferences, provenance, scope, confidence, and authorization. 3. Reject or quarantine entries containing imperative instructions, tool commands, policy changes, requests to ignore constraints, or attempts to redefine memory-processing rules. 4. Explicitly prohibit persistent memories from overriding system instructions, safety policies, authorization checks, or tool restrictions. 5. Require explicit user confirmation before promoting conversational content into cross-session behavioral preferences. 6. Scope memories by authenticated user, project, and task; do not automatically apply project-specific memories elsewhere. 7. Record the exact source and creation context for each entry and display that provenance when the entry is applied. 8. Add expiration, revocation, review, and deletion mechanisms instead of treating user preferences as permanently retained. 9. Render free-form memory fields as quoted reference material and never concatenate them into privileged instruction contexts. 10. Require a safety review before activating generated “Self-Improvement Directives.” ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/error-detector.sh:11
• Finding: Error Logger Persists Arbitrary Tool Output Without Secret Redaction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/error-detector.sh:11-12`, `scripts/error-detector.sh:43-62` **Vulnerability Type**: Plaintext storage of potentially sensitive error output **Risk Level**: Medium ### Vulnerable Code `scripts/error-detector.sh:11-12`: ```bash EXIT_CODE=${1:-$?} TOOL_OUTPUT=${2:-""} ``` `scripts/error-detector.sh:43-62`: ```bash # Append error entry TIMESTAMP=$(date -Iseconds) cat >> "$ERRORS_FILE" << EOF ## [$ERROR_ID] bash_command **Logged**: $TIMESTAMP **Priority**: high **Status**: pending **Area**: config ### Summary Command exited with non-zero status or unexpected output ### Error \`\`\` Exit code: $EXIT_CODE Output: ${TOOL_OUTPUT:-(no output captured)} \`\`\` ``` ### Technical Analysis The script accepts arbitrary output through its second positional argument and writes that output verbatim to `.learnings/ERRORS.md`. Error output may contain access tokens, API keys, authorization headers, database connection strings, environment variables, private filesystem paths, personal data, or command-line arguments. The implementation applies no secret redaction, output-length restriction, data classification, retention policy, or consent check. It also does not establish restrictive permissions before creating `.learnings` and `ERRORS.md`, so access depends on the invoking process’s current `umask`. The supplied value is expanded as heredoc content rather than evaluated as a shell command, so the shown code does not establish shell-command injection. However, an attacker can inject arbitrary Markdown into the log, and sensitive data can remain in plaintext for later access or accidental distribution. ### Attack Path 1. A command or tool fails and its diagnostic output contains a credential or other sensitive value. 2. The caller passes that output as the second argument to `error-detector.sh`. 3. The script interpolates the complete value into its heredoc. 4. The sensitive value is stored in plaintext i ...[truncated 956 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Redact common secret formats before logging, including bearer tokens, API keys, passwords, cookies, private keys, and credential-bearing URLs. 2. Prefer metadata-only logging by default, such as the exit code, command identifier, timestamp, and a sanitized error category. 3. Enforce a strict maximum length for captured output and mark truncation explicitly. 4. Set `umask 077` before creating the directory or file, and explicitly set directory permissions to `0700` and file permissions to `0600`. 5. Require explicit opt-in before storing raw command output. 6. Add a documented retention period and secure deletion mechanism. 7. Escape or neutralize Markdown control syntax if logs may later be consumed by an Agent or rendered as documentation. 8. Exclude `.learnings` from version control, backups intended for distribution, and generated Skill packages. 9. Add automated tests using representative tokens and credentials to verify that redaction cannot be bypassed through multiline output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/package_skill.py:14
• Finding: Skill Packager Can Include Sensitive Files and External Symlink Targets<![CDATA[ ## Vulnerability Details **File Location**: `scripts/package_skill.py:14-18`, `scripts/package_skill.py:50-61`, `scripts/package_skill.py:75-89` **Vulnerability Type**: Unsafe archive construction and insufficient sensitive-file exclusion **Risk Level**: Medium ### Vulnerable Code `scripts/package_skill.py:14-18`: ```python def get_excluded_patterns(): """排除的文件模式""" return { '__pycache__', '.pyc', '.git', '.DS_Store', 'Thumbs.db', '*.log', '.env', 'node_modules' } ``` `scripts/package_skill.py:50-61`: ```python # 创建 zip 包 with zipfile.ZipFile(output_file, 'w', zipfile.ZIP_DEFLATED) as zf: for root, dirs, files in os.walk(skill_path): # 过滤目录 dirs[:] = [d for d in dirs if not should_exclude(Path(d))] for file in files: file_path = Path(root) / file if should_exclude(file_path): continue # 计算相对路径 arcname = file_path.relative_to(skill_path) zf.write(file_path, arcname) ``` `scripts/package_skill.py:75-89`: ```python parser.add_argument( "--path", type=str, default=None, help="Path to skill directory (default: script's parent directory)" ) parser.add_argument( "--output", type=str, default=None, help="Output directory for .skill file (default: current directory)" ) args = parser.parse_args() # 确定路径 if args.path: skill_path = Path(args.path).resolve() ``` ### Technical Analysis The packager accepts an arbitrary source directory and recursively adds nearly every discovered file to the archive. Its denylist excludes only a small set of names and patterns. Notable weaknesses include: - `.env` is excluded only by exact name; variants such as `.env.production`, `.env.local`, and `.env.backup` remain eligible. - Credential files, private ...[truncated 2084 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the denylist with an explicit allowlist of expected Skill files and directories, such as `SKILL.md`, `_meta.json`, selected assets, references, and reviewed scripts. 2. Reject all symbolic links using `Path.is_symlink()` before adding files. 3. Resolve every candidate path and verify that it remains below the resolved source directory, for example with `resolved_file.is_relative_to(resolved_root)` on supported Python versions. 4. Fail closed if a candidate cannot be resolved, changes during packaging, or is not a regular file. 5. Explicitly exclude `.learnings`, memory directories, `.env*`, private keys, certificates, credential files, backup files, editor state, and generated archives. 6. Generate a proposed manifest before archive creation and require confirmation when unexpected files are present. 7. Prevent the output archive from being created inside the input tree, or explicitly exclude the selected output path. 8. Add tests covering file symlinks, directory symlinks, `.env` variants, private-key names, nested sensitive directories, and source paths supplied through `--path`. 9. Run packaging with the least-privileged account necessary so that unrelated sensitive files are not readable even if validation fails. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Self-Modification

High

• Category: Rogue Agent

Content

---
name: max-self-improvement
description: MiniMax Agent self-evolution system with 5-layer memory architecture and continuous learning. Triggers: "remember this preference", "continue from last time", "improve your response", "analyze failure", "do you remember", "self-evolve", "record this lesson", build personal memory system.
---

# Max-Self-Improvement — Self-Evolution & Memory System

• Confidence: 91% confidence
• Finding: The skill explicitly promotes 'self-evolution' and continuous performance optimization, which is a self-modification pattern. Even if framed as improvement rather than code mutation, it encourages the agent to change durable behavior and memory heuristics based on conversational input, creating a pathway for prompt-driven policy drift, persistence of bad instructions, or adversarial poisoning of future behavior.

Credential Access

High

• Category: Privilege Escalation

Content

"""排除的文件模式"""
    return {
        '__pycache__', '.pyc', '.git', '.DS_Store',
        'Thumbs.db', '*.log', '.env', 'node_modules'
    }

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list in the frontmatter uses broad conversational phrases like 'improve your response', 'do you remember', and 'record this lesson', which can cause the skill to activate in normal discussion rather than from explicit user intent. Because this skill performs persistence and memory actions, accidental activation increases the chance of unintended logging or retention of user and project data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill advertises persistent memory and continuous learning but does not present a clear user warning or consent mechanism for storing conversation-derived information. This is dangerous because users may unknowingly disclose preferences, project details, or sensitive context that the system is instructed to retain across sessions.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill's core purpose is to persist user preferences, session context, and lessons into long-term memory files, which creates a direct data retention and disclosure risk. In context, the danger is elevated because broad activation rules can cause storage of conversation-derived material without precise user intent or minimization.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The feature-request patterns include very generic phrases such as 'Can you also...' and 'Is there a way to...', which appear frequently in ordinary conversation. This makes the skill likely to log routine dialogue as feature requests, creating unnecessary persistent records and possible capture of sensitive user intent or context.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The entry templates instruct the system to log full context, error output, inputs, parameters, environment details, and user context in plain language. These fields are likely to capture secrets, personal data, internal paths, tokens, prompts, or proprietary project information, turning routine logging into a durable disclosure surface.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The promotion rules explicitly move behavioral patterns, workflow improvements, tool tips, and project facts into persistent memory locations, encouraging long-term accumulation of user and project data. This increases the blast radius of any mistaken capture, since ephemeral conversation details can be normalized into durable knowledge stores.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The instruction to always read prior notes and save all in-progress state before restart promotes wholesale retention of session state. In practice, this can preserve sensitive transient details that should remain ephemeral, especially when no minimization, consent, or redaction requirements are defined.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This markdown template instructs authors to define trigger phrases using placeholders like "When user says..." and "When situation..." without emphasizing specificity, scope limits, or exclusion conditions. If reused as-is or followed loosely, it encourages ambiguous activation criteria that overlap with common speech and makes unintended invocation more likely.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The entry point section shows conditions as simply "When...", which provides no guidance on how to distinguish valid activation contexts from invalid ones. For a skill template, this omission can propagate ambiguous invocation logic into downstream skills.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The architecture explicitly defines persistent storage for user preferences marked as never deleted and additional long-term memory files, but it provides no consent, minimization, retention, or privacy controls. In an agent skill, this can lead to silent accumulation of personal or sensitive data across sessions, creating privacy, compliance, and unintended data exposure risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow describes automatically writing successes, failures, lessons, and promoted knowledge into persistent memory without warning users that their task outcomes and interactions may be retained. This is dangerous because task results can contain sensitive prompts, project details, mistakes, or derived personal information that become durable records without transparency or approval.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The file includes a persistent preference entry `Code comments: en-US` and later states that all code comments will automatically use English. This is a natural-language policy concern because it imposes a specific language behavior across sessions rather than offering a language choice or clearly documenting a justified locale constraint.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The note '用户偏好永不自动删除' directs indefinite retention of user preference data across sessions, which creates unnecessary long-term storage of user-provided information. Even if the data seems low sensitivity here, indefinite persistence increases exposure in the event of memory leakage, unauthorized access, over-collection, or future repurposing beyond the user's expectations.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The `user_preferences.md` template includes `Code comments: en-US | zh-CN`, which hard-codes language/locale options for generated code comments. This can create a language/locale policy issue because it frames comment language as a preset constraint without stating that the user must explicitly choose or opt in.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script persists error details to a local markdown log and only prints a generic confirmation message to stdout. This creates a transparency and privacy problem because users may not realize potentially sensitive failure data is being retained on disk for later exposure to other local users, backups, or tooling.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The script writes arbitrary command output directly into a persistent file, and that output may contain secrets such as tokens, API keys, credentials, file contents, or other sensitive data produced during failures. In a skill context that captures command errors automatically, this is more dangerous because failures often include verbose diagnostics and echoed inputs, making accidental secret retention likely.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This Python file contains user-facing natural-language strings and comments in Chinese, including the module docstring and function docstrings, without offering a language choice or explaining that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This Python file contains user-facing natural-language strings and comments in Chinese, including the module docstring and validation descriptions. Under the policy, forcing a specific language without opt-in or a documented locale-specific reason is a language/locale policy violation.

Vague Triggers

Low

• Confidence: 86% confidence
• Finding: The correction-detection phrases are broad enough that ordinary clarification or disagreement could be treated as a structured learning event. While less severe than the main trigger issue, it still creates a risk of unnecessary persistence and inaccurate memory formation.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The example learning entry states 'Code comments should use English' and suggests changing comment language to English by default. This is a natural-language locale/language constraint presented without opt-in, alternatives, or a documented region-specific justification, which fits the policy-violation criteria.

Static analysis

No suspicious patterns detected.