16 Self Improving Agent Proactive Self Reflection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:09 AM UTC
• Version: 1.0.0

Overview

This skill is not visibly stealing data, but it persistently changes agent behavior and stores learned instructions, so it needs review before installation.

Install only if you want an agent to keep local, cross-session behavioral memory and are comfortable reviewing the setup edits to AGENTS.md, SOUL.md, and HEARTBEAT.md. Before enabling it, require explicit confirmation for first-use file creation, every new persistent memory entry, exports, and full wipes; treat stored lessons as untrusted notes, not authority to override current instructions or safety rules.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: setup.md:63

Finding

Persistent Agent Steering Can Propagate Untrusted Learned Rules Across Sessions

Content

View full analysis

.md` - Do not read unrelated domains "just in case" If inferring a new rule, keep it tentative until human validation. ``` ```markdown - Explicit user correction → append to `~/self-improving/corrections.md` immediately - Reusable global rule or preference → append to `~/self-improving/memory.md` - Domain-specific lesson → append t ...[truncated 2874 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: boundaries.md:46

Finding

Ambiguous Full-Wipe Command Can Cause Accidental Loss of All Learned Memory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation guidance is broad enough that the skill may activate during many ordinary interactions, including routine task completion or minor self-critique, causing automatic memory reads/writes more often than a user would reasonably expect. In context, this increases the chance of over-collection and persistence of user data or agent-generated reflections without sufficiently specific triggering conditions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill persistently stores user corrections, preferences, and self-reflection data under ~/self-improving/, but the user-facing description and activation guidance do not clearly disclose that local retention occurs. This can lead to users sharing sensitive preferences or correction content without informed consent, increasing privacy and data-minimization risk even though the storage is local-only.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · boundaries.md (reported line 11)May include surrounding context.

md

| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "forget everything" is broad natural language that could be invoked accidentally during ordinary conversation, quoted text, or discussion about memory behavior. In this skill, activation causes destructive state changes, so an ambiguous phrase creates a real risk of unintended memory export and deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The kill-switch workflow performs sensitive side effects—exporting current memory to a file and wiping learned data—without first warning the user or obtaining confirmation for the export. That can expose retained data in a new artifact and cause irreversible loss if the phrase is triggered unintentionally or by prompt injection relayed as user text.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes broad user-facing memory administration commands such as viewing, deleting, exporting, and querying all stored memory, which goes beyond the stated purpose of self-reflection on the agent’s own work. This expands the skill’s authority and attack surface, making it easier to disclose or modify persisted data unrelated to the immediate task or without sufficient scope checks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Full memory export and full-wipe capabilities are highly sensitive operations that are not justified by a self-improvement or reflection function. If triggered improperly, they can cause bulk exfiltration of stored conversation-derived data or irreversible destruction of persistent memory, creating confidentiality and integrity risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes automatic persistence of conversation-derived corrections into memory files without any user-facing disclosure or consent mechanism. Silent long-term storage of user preferences, patterns, and overrides can violate user expectations and create privacy, retention, and data-governance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The weekly automated maintenance routine performs background movement, archival, compaction, and index updates on stored memory without disclosing that data may be modified outside direct user interaction. Undisclosed background changes can affect data availability, traceability, and user trust, especially when records are reorganized or archived automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template explicitly instructs creation of directories and files under the user's home directory on first activation, which is a real filesystem-modifying action. While the behavior is not inherently malicious and appears intended to initialize persistent memory for the skill, it still causes side effects without any warning, consent flow, or scoping controls, making it a genuine safety issue.

Content

No source excerpt is available for this finding.