Auto Evolution

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:51 AM UTC
• Version: 2.0.1

Overview

The skill is purpose-aligned but should go to Review because it is designed to silently record user corrections and persist them for later rule or skill changes.

Install only if you want automatic feedback monitoring. Configure explicit opt-in before recording, review and redact .claude/feedback regularly, set retention/deletion rules, and keep all CLAUDE.md or skill-file changes behind visible user confirmation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description promises a much broader autonomous evolution pipeline: silently capturing feedback, persisting it, graduating repeated feedback into rules, optimizing low-performing skills, and proposing new skills. The supplied code does not implement those capabilities. It only detects whether a single text string contains feedback-like phrases and returns a JSON result with a note suggesting a downstream feedback observer should be dispatched. That detection function is at best a small supporting component of the declared system, but by itself it materially underdelivers on the stated primary purpose. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description claims an active self-evolving system that silently captures feedback, graduates rules, improves skills, and proposes new skills. The supplied code only implements the proposal-generation portion: it scans an existing feedback directory, analyzes thresholds, and prints JSON suggestions. The script explicitly states it never edits rule files, and there is no code for collecting feedback, persisting system evolution, or applying optimizations. While part of the declared functionality is represented at the suggestion level, the overall description overstates the implemented behavior and automation level.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are extremely broad and include ordinary correction language such as 'that's not right' and 'not like this', which can cause the skill to activate in many unrelated conversations. In this skill's context, over-triggering is dangerous because activation leads to silent feedback capture and storage, increasing privacy and data retention risk without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly allows silent capture and storage of user feedback without a user-facing warning or consent step. That creates a privacy vulnerability because users may disclose sensitive operational details, credentials, or personal information while correcting the agent, and those details can be persistently stored in local feedback files.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow explicitly instructs the agent to record user feedback context 'silently' after detecting correction language, without requiring the user to ask for recording. This is particularly dangerous because corrective messages often include exact mistakes, pasted commands, file paths, customer data, or other sensitive context, all of which may be captured and retained without awareness.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

- 新 Skill：创建独立 Skill 目录，生成 `SKILL.md`、示例和必要脚本

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example explicitly describes silently archiving user correction text into local files under .claude/feedback/ without notice, consent, minimization, or any retention/access controls. Even if the content seems operational, user feedback can contain sensitive project details, personal data, or secrets, and silent persistence increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly promotes silently capturing corrective user feedback and storing it for later processing, but it does not pair that behavior with notice, consent, minimization, retention limits, or handling guidance. In a skill that monitors user conversations, covert collection of natural-language feedback can expose sensitive personal, business, or authentication-related content and creates a privacy/security risk even if the feature is framed as product improvement.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Silent capture and aggregation of user corrections creates a data retention surface containing free-form natural language, which often includes secrets, internal project details, or personal data. Because the skill is designed to accumulate repeated feedback over time, compromise or misuse of the stored corpus could leak sensitive contextual information well beyond the original interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs integrators to run per-message detection hooks and monitor user messages automatically without any corresponding user warning or consent flow. Hook-based observation of every message materially increases surveillance scope and can capture sensitive conversation content beyond the narrow purpose of correcting model behavior.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction to quietly dispatch a feedback observer after detecting corrective messages describes covert post-message collection behavior. In context, this makes the skill more dangerous because it is specifically designed to observe conversational patterns without surfacing the action to the user, reducing transparency and increasing the chance of collecting sensitive data unexpectedly.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Directing users to store structured feedback in a hidden local directory encourages persistence of conversation-derived data without stating safeguards, permissions, retention limits, or sanitization requirements. Hidden local storage can create a false sense of safety while still exposing sensitive data to other local processes, backups, sync tools, or later exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly promotes silent capture and storage of user correction feedback, but it does not provide any privacy notice, consent model, retention limits, or guidance on handling potentially sensitive content. Even if intended for product improvement, silently persisting user messages can create privacy, compliance, and data-governance risk because users may unknowingly disclose personal or confidential information in corrections.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly promotes 'silent' feedback capture ('无感记录' / '静默派发记录动作') after user interactions, but does not require clear notice, consent, or data minimization before recording and storing potentially sensitive user corrections. In a self-evolving system, this creates a real privacy and trust risk because users may unknowingly have their inputs and context persisted for later analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The architecture recommends storing structured feedback in .claude/feedback/ and defines metadata fields, but omits a privacy warning, retention policy, access controls, and guidance against storing sensitive context. This can lead to accumulation of confidential user data in local files without informed consent or safeguards, increasing exposure if the workspace is shared, synced, or later processed by other tools.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · REFERENCE_ARCHITECTURE.md (reported line 149)May include surrounding context.

md

|---|---|---|
| `hooks/detect-feedback-signal.sh` | 识别用户修正信号 | `scripts/detect_feedback_signal.py` |
| `agents/feedback-observer.md` | 静默记录反馈 | `SKILL.md` 的第一、二步 |
| `skills/feedback-writer/SKILL.md` | 结构化写 feedback | 模板和字段规范 |
| `agents/evolution-runner.md` | 启动扫描器 | `SKILL.md` 的第三步 |
| `skills/evolution-engine/SKILL.md` | 生成进化建议 | `scripts/evolution_runner.py` |
| `EVOLUTION.md` | 四层概念框架 | 本参考文档整体 |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · REFERENCE_ARCHITECTURE.md (reported line 151)May include surrounding context.

md

| `agents/feedback-observer.md` | 静默记录反馈 | `SKILL.md` 的第一、二步 |
| `skills/feedback-writer/SKILL.md` | 结构化写 feedback | 模板和字段规范 |
| `agents/evolution-runner.md` | 启动扫描器 | `SKILL.md` 的第三步 |
| `skills/evolution-engine/SKILL.md` | 生成进化建议 | `scripts/evolution_runner.py` |
| `EVOLUTION.md` | 四层概念框架 | 本参考文档整体 |

## 建议输出格式

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Default logging of natural-language feedback into a repository-like store creates durable records that may later be exposed through backups, version control, workspace sharing, or unrelated tooling. Even if intended for improvement, this retention enlarges the attack surface by preserving free-form user text that may contain secrets or confidential business context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The detector is limited to a fixed set of Chinese and English phrases, which embeds a language constraint directly into the skill behavior. There is no natural-language documentation or user opt-in indicating that detection only supports these locales, so the skill implicitly privileges specific languages without explaining the limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code explicitly instructs downstream handling to record detected feedback into .claude/feedback/, but it provides no notice, consent check, minimization guidance, or safeguards around persisting user text. In the context of a self-evolving skill that silently captures feedback, this creates a real privacy and data-governance risk because corrective messages may contain sensitive user content and are being routed toward storage without transparency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits natural-language output strings in Chinese for proposal reasons, which forces a specific language/locale on downstream users. The file does not provide any opt-in, localization setting, or documented justification for restricting output to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated suggestion text is natural-language output and is fixed to Chinese. Because there is no user choice or locale negotiation, this violates the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This output string forces Chinese in a user-visible proposal field. The code does not expose any mechanism for selecting another language or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The warning message returned when the feedback directory is missing is user-visible natural language and is fixed to Chinese. Without a documented locale constraint or user choice, this is a language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions in the template are written in Chinese and prescribe the content format without indicating that other languages are allowed. This can violate language/locale policy when the skill does not offer opt-in or explain a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.