Self Improving Agent 1.0.2

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:25 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent self-improvement purpose, but it should be reviewed because it persistently records conversation/tool details, can modify future agent instructions, and documents cross-session communication without clear consent or redaction rules.

Install only in trusted workspaces where you are comfortable with an agent writing persistent learning files and possibly editing future-agent instruction files. Prefer project-level setup, avoid global always-on hooks, require explicit approval before promotion to CLAUDE.md/AGENTS.md/Copilot/SOUL/TOOLS or new skills, and redact secrets, personal data, raw transcripts, command outputs, tokens, and environment details before anything is logged or shared across sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill’s scope expands from simple local logging into modifying higher-trust project memory files such as CLAUDE.md, AGENTS.md, and copilot instructions. That broadens persistence and influence far beyond ephemeral notes, allowing unvetted or incorrect content from transient interactions to become durable behavioral guidance for future agents.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill introduces inter-agent session discovery, transcript access, and messaging even though its stated purpose is self-improvement logging. Those capabilities can expose unrelated session data and enable cross-session propagation of sensitive information or instructions, creating confidentiality and lateral-influence risks that are disproportionate to the skill’s purpose.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill instructs agents to create new reusable skills from logged learnings, which turns passive note-taking into capability generation. This increases the risk that unreviewed or adversarially influenced observations get converted into executable workflow guidance that persists and spreads across future tasks.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The activation description is very broad and encourages use across many common situations, increasing the chance that the skill runs on routine conversations and task flows. In context, that matters because the skill writes persistent records and can promote content into higher-trust memory, so over-triggering amplifies data retention and prompt-influence risks.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The automatic trigger phrases are common conversational patterns that can easily appear in ordinary dialogue, causing involuntary logging of user input and agent behavior. Because the skill stores persistent notes and may later promote them, generic triggers materially increase the likelihood of accidental capture and retention of sensitive or misleading content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs agents to record user corrections, feature requests, command details, and error outputs to files without any privacy, minimization, or redaction guidance. Those records can easily include credentials, personal information, proprietary prompts, file paths, or operational details, creating avoidable persistence of sensitive data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly documents cross-session transcript access and messaging features, including reading another session's history and pushing messages into other sessions, but provides no privacy, authorization, or data-handling warnings. In a prompt-injection-based workspace model, these capabilities can expose sensitive prompts, secrets, or user data across sessions and make it easier to spread poisoned instructions or confidential information laterally.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The empty matcher causes the hook to run for every prompt, which broadens execution beyond the specific failure or learning-capture scenarios described by the skill. Because hook commands execute automatically with the agent's permissions, this increases attack surface, unnecessary data exposure, and the chance of unintended invocation across unrelated sessions or prompts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The user-level configuration recommends global activation in ~/.claude/settings.json, which can enable this hook in all sessions regardless of project sensitivity or relevance. That broad scope increases the likelihood of accidental execution, cross-project data leakage into the hook context, and propagation of behavior into environments where it was not intended.

Exfiltration Commands

High

• Category: Prompt Injection

Content

Clawdbot supports session-based communication:
- **sessions_list** - See active/recent sessions
- **sessions_history** - Read transcript from another session
- **sessions_send** - Send message to another session

### Hybrid Setup (Claude Code + Clawdbot)

• Confidence: 98% confidence
• Finding: Send message to

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.