Self Improving Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

This skill is for persistent self-improvement logs, but it gives agents broad permission to save conversation/error details and promote them into future instruction files without clear approval or sanitization safeguards.

Install only if you are comfortable with an agent maintaining persistent project memory. Before use, require confirmation before any write to .learnings or agent instruction files, redact secrets and raw command output, keep .learnings out of version control unless reviewed, and do not enable the documented hooks unless the exact scripts are present and independently reviewed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:277

Finding

Untrusted Learning Content Can Be Promoted into Persistent Agent Instructions

Content

View full analysis

" .learnings/LEARNINGS.md` 4. If found: - Increment `Recurrence-Count` - Update `Last-Seen` - Add `See Also` links to related entries/tasks 5. If not found: - Create a new `LRN-...` entry - Set `Source: simplify-and-harden` - Set `Pattern-Key`, `Recurrence-Count: 1`, and `First-Seen`/`Last-Seen` ### Promotion Rule (System Prompt Feedback) Promote recurring patterns into agent context/system prompt files when all are true: - `Recurrence-Count >= 3` - Seen across at least 2 distinct tasks - Occurred within a 30-day window Promotion targets: - `CLAUDE.md` - `AGENTS.md` - `.github/copilot-instructions.md` ``` The promotion guidance is further weakened by the following instruction at line 392: ```markdown 7. **Promote aggressively** - if in doubt, add to CLAUDE.md or .github/copilot-instructions.md ``` ### Technical Analysis The skill accepts learning candidates derived from conversations and task summaries, persists them in `.learnings/LEARNINGS.md`, and subsequently promotes their distilled content into files that control future agent behavior. The promotion process relies primarily on recurrence metadata. It does not require: - Explicit user approval before changing an agent instruction file. - Validation that the source is trusted. - Review of the proposed instruction for commands, URLs, role directives, or attempts to weaken safety controls. - Separation between untrusted observations and trusted behavioral ...[truncated 2242 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:413

Finding

Documented Hook and Extraction Commands Reference Missing Executable Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The metadata claims that risk code and external dependencies were removed, but the skill still instructs users to wire executable shell hook scripts and run an extraction helper. That mismatch can mislead operators into trusting and enabling code-execution paths they may not scrutinize, increasing the chance of unsafe deployment of unreviewed scripts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed trigger keywords include very generic terms such as "enable", "self", "agent", "errors", and "corrections", which can appear in many normal conversations unrelated to this skill. The file does not provide exclusion conditions or tighter activation constraints, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The learning-entry format encourages storing full context, what happened, what was wrong, and related file paths in persistent local markdown. That can easily capture sensitive user content, proprietary data, secrets, or confidential operational details in plain text, especially because the skill is explicitly designed to retain conversational learnings.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The error logging template explicitly tells the agent to save raw error messages, command inputs, parameters, and environment details. Those fields commonly contain API keys, tokens, passwords, connection strings, internal URLs, stack traces, and customer data, making this a strong secret-retention and data-leak risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The automatic logging and detection rules are broad enough to capture many ordinary user interactions, corrections, and operational events without a sensitivity gate. In a memory/persistence skill, that creates a realistic risk of over-collection and unintended retention of sensitive conversation or environment data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The automatic detection triggers tell the agent to log corrections, user-provided information, knowledge gaps, and errors whenever noticed. Because this is automatic and conversation-derived, it increases the likelihood that sensitive content will be persisted without deliberate review, especially in long-running agent workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The extraction workflow promotes turning accumulated learnings into reusable skills and provides a helper to generate persistent artifacts. In context, this increases session-to-session persistence of potentially sensitive information and can spread retained content into new sharable skill files if the source learnings were not sanitized.

Content

Scanner excerpt · SKILL.md (reported line 486)May include surrounding context.

Extraction Workflow

1. Identify candidate: Learning meets extraction criteria
2. Run helper (or create manually):

   bash

   ./skills/self-improvement/scripts/extract-skill.sh skill-name --dry-run
   ./skills/self-improvement/scripts/extract-skill.sh skill-name
   

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description and several later sections present core instructions in Chinese while other parts are in English, but the file does not state a user-selectable language preference or justify the locale choice. This can effectively impose a language/locale assumption on users without opt-in.

Content

No source excerpt is available for this finding.

Ssd 3

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The feature-request format asks for user context and requested capability details without any minimization guidance. While less severe than raw error logging, it still encourages persistent retention of user-provided information that may contain sensitive business or personal context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documentation presents the skill as Markdown-based with no extra API keys or external dependencies unless explicitly marked, reinforcing a self-contained impression. But the manual extraction section tells users to follow an external web specification link, which contradicts the earlier claim that external dependency references were cleaned up and that the skill is essentially self-contained.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.