Self-Improving Agent (With Self-Reflection)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:03 AM UTC
• Version: 1.2.9

Overview

The skill is a disclosed local memory tool, but it asks to modify persistent agent steering files and enable broad cross-session behavior that users should review carefully before installing.

Install only if you want a cross-session local memory system and are comfortable reviewing the setup edits yourself. Avoid adding the SOUL.md core-drive text or HEARTBEAT automation unless you specifically want always-on self-improvement behavior, and periodically inspect or delete ~/self-improving/ contents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: setup.md:48

Finding

Persistent Modification of Core Agent Steering and Memory-Routing Instructions

Content

View full analysis

Vulnerability Details

File Location: setup.md:48-110
Vulnerability Type: Persistent instruction modification and memory poisoning
Risk Level: High

Vulnerable Code

markdown

### 3. Choose Operating Mode

Add to your AGENTS.md or workspace config:

```markdown
## Self-Improving Mode

Current mode: Passive

Available modes:
- Passive: Only learn from explicit corrections
- Active: Suggest patterns after 3x repetition
- Strict: Require confirmation for every entry

text

```markdown
### 4. Add SOUL.md Steering

Add this section to your `SOUL.md`:

```markdown
**Self-Improving**
Relentless compounding is your core drive: before work and after every response, ground yourself in the `self-improving` skill and `~/self-improving/`, then capture explicit feedback and high-signal inferences that can improve the next execution.
Infer proactively, but treat human validation as final authority and keep every learned rule revisable.

text

```markdown
### 5. Refine AGENTS.md Memory Section (Non-Destructive)

Update `AGENTS.md` by complementing the existing `## Memory` section. Do not replace the whole section and do not remove existing lines.

If your `## Memory` block differs from the default template, insert the same additions in equivalent places so existing information is preserved.

Add this line in the continuity list (next to Daily notes and Long-term):

```markdown
- **Self-improving:** `~/self-improving/` (via `self-improving` skill) — execution-improvement memory (preferences, workflows, style patterns, what improved/worsened outcomes)

Right after the sentence "Capture what matters...", add:

markdown

Use `memory/YYYY-MM-DD.md` and `MEMORY.md` for factual continuity (events, context, decisions).
Use `~/self-improving/` for compounding execution quality across tasks.
For compounding quality, capture clear execution-improvement signals in `~/self-improving/`
...[truncated 3656 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that modify SOUL.md, AGENTS.md, TOOLS.md, or general workspace configuration.
2. Do not describe the Skill as an Agent “core drive” or require it to run before and after every response.
3. Restrict all Skill state to ~/self-improving/.
4. Require explicit user opt-in before enabling cross-session storage.
5. Store only explicit user corrections and confirmed preferences; do not proactively infer durable rules.
6. Never promote memory entries into core Agent instruction files.
7. Treat content extracted from files, websites, tool results, and third-party messages as untrusted data that cannot define persistent rules.
8. Present proposed memory entries to the user for review before writing them.
9. Provide a clearly scoped, reversible activation mechanism that applies only when the user explicitly invokes the Skill.

T06 · System Persistence

Warning

• Location: setup.md:133

Finding

Persistent Automatic Maintenance Through Heartbeat or Scheduled Processing

Content

View full analysis

Vulnerability Details

File Location: setup.md:133-143; operations.md:47-54
Vulnerability Type: Cross-session maintenance hook
Risk Level: Medium

Vulnerable Code

From setup.md:

markdown

## Optional: Heartbeat Integration

Add to `HEARTBEAT.md` for automatic maintenance:

```markdown
## Self-Improving Check

- [ ] Review corrections.md for patterns ready to graduate
- [ ] Check memory.md line count (should be ≤100)
- [ ] Archive patterns unused >90 days

text

From `operations.md`:

```markdown
### Weekly Maintenance (Cron)

text

1. Scan all files for decay candidates
2. Move unused >30 days to WARM
3. Archive unused >90 days to COLD
4. Run compaction if any file >limit
5. Update index.md
6. Generate weekly digest (optional)

Technical Analysis

The Skill recommends modifying HEARTBEAT.md so memory processing continues automatically across sessions. It also specifies cron-style weekly maintenance that scans, moves, archives, compacts, and indexes stored rules.

No shell command that installs an operating-system cron job was found. Nevertheless, adding the workflow to an Agent heartbeat establishes an application-level persistence mechanism. The hook repeatedly processes stored instructions without requiring invocation for a specific user task.

Automatic promotion and maintenance increase the risk that an incorrect or poisoned memory entry will remain active and influence later sessions. Repeated processing can also obscure the original context by summarizing or moving entries among storage tiers.

Attack Path

1. The user or Agent follows the optional setup instructions.
2. The Skill’s maintenance checklist is added to HEARTBEAT.md.
3. Future heartbeat cycles review persistent corrections and patterns.
4. A malicious, inaccurate, or overly broad stored entry is identified as eligible for promotion.
5. The entry is moved into active memo ...[truncated 653 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instructions to modify HEARTBEAT.md.
2. Remove cron terminology unless a secure, user-controlled scheduler is explicitly part of the declared functionality.
3. Run memory maintenance only when the user explicitly requests it.
4. Display proposed promotions, demotions, archives, and compaction changes before applying them.
5. Require confirmation before promoting any entry into HOT memory.
6. Preserve provenance, original context, and consent status during compaction.
7. Reject entries derived from untrusted external content or third-party instructions.
8. Provide a dry-run mode and an auditable change log for every maintenance operation.

T09 · Insecure Skill Coding Practices

Warning

• Location: learning.md:25

Finding

Third-Party Preference Profiling Contradicts Declared Privacy Boundaries

Content

View full analysis

Vulnerability Details

File Location: learning.md:25-32; scaling.md:32-39
Vulnerability Type: Insecure retention of third-party information
Risk Level: Medium

Vulnerable Code

From learning.md:

markdown

### By Type
| Type | Example | Namespace |
|------|---------|-----------|
| Format | "Use bullets not prose" | global |
| Technical | "SQLite not Postgres" | domain/code |
| Communication | "Shorter messages" | global |
| Project-specific | "This repo uses Tailwind" | projects/{name} |
| Person-specific | "Marcus wants BLUF" | domains/comms |

From scaling.md:

markdown

### Summarize Verbose Patterns

text

BEFORE:
- When writing emails to Marcus, use bullet points, keep under 5 items,
  no jargon, bottom-line first, he prefers morning sends

AFTER:
- Marcus emails: bullets ≤5, no jargon, BLUF, AM preferred

Technical Analysis

The Skill explicitly classifies person-specific preferences as persistent domain memory and provides an example containing an identifiable person’s communication and schedule preferences.

This contradicts the project’s own security boundaries:

• boundaries.md:11 states that third-party information must never be stored because consent has not been obtained.
• boundaries.md:21 limits relationship information to roles without personal details.
• boundaries.md:42 identifies retaining third-party information as a red flag.

The inconsistency makes the effective privacy policy ambiguous. An Agent following learning.md or scaling.md may store information that boundaries.md explicitly prohibits.

Attack Path

1. A user mentions a colleague, client, or other third party during a task.
2. The Skill classifies the statement as a person-specific communication pattern.
3. The pattern is written to domains/comms or another persistent namespace.
4. Maintenance compacts the information into a concise third-part ...[truncated 709 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove person-specific memory categories and all named-person examples.
2. Enforce the prohibition on third-party information consistently across every project document.
3. Store only non-identifying, project-scoped communication requirements where necessary.
4. Replace personal names with role-based descriptions such as “project reviewer,” while avoiding personal schedules or behavioral profiles.
5. Require explicit user confirmation and a legitimate project purpose before storing any third-party-related requirement.
6. Apply automatic expiration when the relevant project ends.
7. Add validation that rejects third-party names, personal schedules, contact details, health information, and inferred behavioral traits.
8. Include third-party records in deletion verification and privacy audits.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level description says to use the skill before starting work and after responding, which encourages near-constant activation during ordinary interactions. Because the skill persistently stores corrections, preferences, and self-reflections to local files, broad invocation increases the chance of over-collection and unintended retention of user data without sufficiently deliberate user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'When to Use' section uses subjective triggers like noticing output could be better or wanting to evaluate significant work, without hard boundaries for when persistence is appropriate. In a memory-writing skill, ambiguous activation can cause routine conversations and transient preferences to be recorded more often than the user expects, expanding privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 79% confidence

Finding

The skill authorizes automatic promotion, demotion, and archival of learned patterns based on usage thresholds without requiring contemporaneous user approval. Although this is limited to the skill's local memory store, autonomous modification of persistent memory can solidify mistaken inferences, retain sensitive context longer than intended, or change agent behavior in ways the user did not explicitly approve.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · boundaries.md (reported line 11)May include surrounding context.

md

| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to log user corrections, repeated behaviors, and project-scoped preferences, but it provides no notice, consent flow, or retention disclosure to the user. This creates a privacy and data-governance risk because users may unknowingly provide behavioral and preference data that is stored and later reused across sessions or contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill says confirmed preferences become permanent and that old patterns are archived with history preserved, yet it does not clearly warn the user that these records may persist indefinitely. Permanent storage of preference history and reversals can expose sensitive behavioral profiles over time, especially in a self-improving agent designed to accumulate long-term memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states it will create and maintain a persistent file in the user's home directory, but does not present any consent, warning, or clear opt-in around local data modification. Even though the content appears to be productivity-related memory, silent persistence can store sensitive preferences or project details and may surprise users or violate expected data-handling boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly auto-loads memory files at session start, including potentially sensitive prior preferences, corrections, and project context, but does not require a contemporaneous user-facing notice or consent step. In a self-improving memory skill, silent retrieval of persisted data increases privacy risk because users may not realize historical personal or project data is being accessed automatically on each session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The correction workflow persistently logs user corrections, timestamps, counters, namespaces, and writes them into files without any explicit warning at the point of collection. This is dangerous because users may provide what seems like transient feedback, while the system turns it into long-term stored behavioral or project metadata that can later influence outputs or expose sensitive context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The weekly maintenance section describes unattended scanning, moving, archiving, compaction, and digest generation across memory files, but gives no user-facing warning that previously stored data will be reprocessed automatically. This matters because archival and scanning operations can propagate or retain sensitive information beyond what a user expects, especially in a skill designed for permanent self-learning and memory organization.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup explicitly directs the agent to persist user preferences, workflow/style choices, corrections, and high-signal inferences in long-term memory files. That creates a durable profiling mechanism and encourages storage of inferred behavioral data beyond the immediate task, increasing privacy risk and the chance that sensitive or incorrect inferences are reused in future interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "remember this" is wired to trigger persistent storage decisions without clear limits on scope, sensitivity, or user consent. In a self-improving memory skill, that broad trigger can cause over-collection of personal data, secrets, or transient context into long-lived files, especially when combined with instructions to infer and retain performance lessons.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description emphasizes self-improvement benefits but does not upfront disclose that it stores user preferences, corrections, and reflections in local files under ~/self-improving/. That omission can undermine informed consent, especially because users may invoke the skill from its description alone without reading deeper sections describing storage behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template explicitly instructs creation of directories and files under the user's home directory on first activation, which is a real filesystem-modifying action. While the paths are scoped to a dedicated folder and the intent appears organizational rather than malicious, the skill encourages persistent local changes without an explicit consent, safety notice, or review step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.