自我进化AI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

The skill is not overtly malicious, but it can automatically save conversation-derived material and promote repeated lessons into future agent instruction files without enough safeguards.

Review this carefully before installing. Use it only with explicit approval before every saved learning and every promotion, redact secrets and personal or business-sensitive details, keep .learnings out of version control unless intentional, and require human review for any changes to CLAUDE.md, AGENTS.md, or .github/copilot-instructions.md.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:248

Finding

Conversation-Derived Content Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

= 3` - 跨至少2个不同任务出现 - 在30天窗口内发生 晋升目标: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` ``` Lines 274–289 identify conversation events that should be recorded automatically: ```markdown 自动在以下情况记录: ### 纠正(→ learning,类别=correction) - "不对,那不是..." - "实际上应该是..." - "你错了关于..." - "那个过时了..." ### 特性请求(→ feature request) - "你能不能也..." - "我希望你能..." - "有没有办法..." - "为什么不能..." ### 知识缺口(→ learning,类别=knowledge_gap) - 用户提供了你不知道的信息 - 你引用的文档已过时 - API行为与你的理解不同 ``` Line 390 recommends modifying `AGENTS.md` when hooks are unavailable: ```markdown - **回退**: 如钩子不可用,将自改进指导添加到 `AGENTS.md` ``` Line 439 encourages promotion into `CLAUDE.md` even when uncertain: ```markdown 7. **积极晋升** - 如有疑问,添加到CLAUDE.md ``` ### Technical Analysis The Skill treats user-provided corrections and knowledge claims as material for persistent memory. Recurring entries may subsequently be converted into rules in `CLAUDE.md`, `AGENTS.md`, or `.github/copilot-instructions.md`. These files commonly become trusted context for later agent sessions. The recurrence conditions provide frequency filtering, but they do not establish that the underlying content is trustworthy. An attacker can repeat a crafted correction in multiple tasks within the promotion window. If the agent follows the documented workflow, the attacker-controlled claim can eventually become a persistent instruction. The recommendation to promote uncertain content into `CLAUDE.md` further ...[truncated 1832 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The learning and error templates ask for complete context and used inputs in persistent logs, which strongly encourages capture of raw prompts, file paths, command arguments, stack traces, and environment data. Those fields often contain secrets or sensitive operational context, making persistent storage a meaningful confidentiality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The error-recording guidance tells the agent to store environment details and used inputs, but it does not warn against recording secrets, tokens, credentials, personal data, or confidential prompts. Error outputs and command inputs frequently contain sensitive material, so this creates a substantial risk of secret leakage into persistent files and repositories.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The listed activation keywords include broad phrases such as '持续改进', '错误学习', 'learnings', and 'corrections', which can appear in ordinary project conversations unrelated to invoking this skill. The description does not provide exclusion conditions or negative examples to clarify when these phrases should not activate the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs persistent storage of user corrections, feature requests, and task context into local or project files without any clear retention warning, consent flow, or data minimization rule. This can cause sensitive conversational content to be silently written to disk and potentially committed to a repository, expanding exposure beyond the original session.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions explicitly tell the agent to persist user-provided corrections and other conversation-derived details across sessions. In the context of a memory skill, that behavior increases risk because normal chat content may include private business context, personal data, or confidential project information that users did not expect to be retained.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The feature request template preserves the user's requested capability and rationale by default, which can encode sensitive organizational plans, internal workflows, or personal context. Because the skill treats this as persistent memory, ordinary product discussion may become long-lived stored data without a need-to-know filter.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The automatic detection rules are ambiguous and instruct the agent to record corrections, feature requests, and knowledge gaps whenever similar language appears in normal conversation. In this skill, that ambiguity matters because it feeds directly into persistent logging, creating a realistic risk of retaining user content without clear consent or minimization.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The auto-trigger rules instruct the agent to record user-provided new information or corrections whenever encountered, effectively normalizing blanket retention of user disclosures. This is especially risky in a self-improving memory system because the persistence mechanism is a core feature and may capture sensitive disclosures systematically rather than exceptionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The display name, summary, description, instructions, and examples are all presented in Chinese, which effectively forces a specific language for users of the skill. There is no indication that the skill is region-specific or that users may opt into another language.

Content

No source excerpt is available for this finding.