Security audit

Self-Learn

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about learning from corrections, but it automatically stores broad task and user-correction history in persistent memory without clear consent or deletion controls.

Review this skill before installing if you do not want an agent to retain corrections or task lessons automatically. It should be used only in an environment where persistent memory is expected, and users should have a clear way to review, edit, and delete stored entries.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:35
Finding: Untrusted User Corrections Are Written to Persistent Agent Memory
Content: View full analysis
→ ` + keywords 4. Recall to verify it stored correctly ``` ```markdown - **No secrets** — never log credentials, personal data, or sensitive info - **Corrections always log** — user corrections are always worth storing (importance ≥ 0.85) ``` ### Technical Analysis The Skill treats correction-like user input as trusted learning material and automatically writes it to two persistent locations: `memory/corrections.md` and the LanceDB-backed memory store. The stored record is assigned a relatively high importance of `0.85` and is immediately recalled for verification. No approval step, trust boundary, normalization process, provenance tracking, session scope, expiration policy, or validation against instruction-like content is specified. Consequently, an attacker can phrase a malicious behavioral directive as a correction, causing attacker-controlled rules to survive beyond the current interaction and potentially influence future sessions when memory is recalled. The unconditional requirement that corrections “always log” also conflicts with the separate prohibition on logging secrets and sensitive data. If a correction contains credentials, personal information, or other confidential content, the instructions do not define w ...[truncated 1722 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is designed to auto-activate on extremely broad triggers, including ordinary correction phrases and after completing any task. That creates a persistent surveillance-like behavior where routine interactions are turned into stored memory without a narrowly scoped user action, increasing the chance of unintended data retention, preference poisoning, and privacy violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill directs automatic writes to both a file and a memory store during self-evaluation, but does not require a visible notice or consent flow before persistence. Even with a 'No secrets' rule, the model may misclassify sensitive content, causing private or contextual user data to be retained unexpectedly across sessions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.