Security audit
Security checks for vulnerabilities and agentic risk
This skill sets up a disclosed local memory template and does not include code, network access, or hidden behavior, but users should manage what persistent notes it stores.
Install only if you want a persistent local memory folder for agent self-reflection. Keep the memory directory scoped, review proposed updates before they are written, and do not store secrets, credentials, private customer data, or sensitive business details in these files.
The skill instructs creation of persistent directories and memory files in the user's environment without clear notice about data retention, sensitivity, or workspace modification risks. In an agent setting, this can lead to unintended accumulation of task data, sensitive information, or durable state that affects future behavior without informed user consent.
The automatic trigger conditions are broad enough that the skill may activate after many normal interactions without a clear user request. In this skill's context, that matters because activation leads to follow-on state updates in multiple local files, creating unintended persistence and side effects.
The manual triggers use vague phrases such as requesting self-reflection or noticing obvious errors, which are subjective and easy for the agent to over-interpret. Because this skill writes memories and corrections to disk, ambiguous invocation can cause unauthorized or surprising state changes.
The workflow explicitly directs the agent to write to several local files but provides no user-facing warning, consent step, or scope limitation for those modifications. In a memory/persistence skill, hidden writes are especially risky because they can permanently alter future behavior, store sensitive content, or create hard-to-audit state changes.
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Run to verify:
ls -la ~/self-improving/
The manifest description says the skill enables AI to 'learn from mistakes and never repeat them' with 'continuous improvement,' but it does not define when the skill should be invoked versus when it should not. This broad natural-language framing increases the chance that an orchestrator or user may treat the skill as applicable to many generic situations without clear constraints.
The instruction 'After completing important tasks, Agent should update heartbeat-state.md' depends on the ambiguous phrase 'important tasks' and provides no examples of qualifying or non-qualifying cases. For a markdown skill file, this leaves activation conditions unclear and may cause overuse or inconsistent invocation.
The operational instructions and trigger descriptions are presented entirely in Chinese, with no indication that users may choose another language or that the locale is intentionally restricted. This can violate a language-choice policy if the broader environment expects user opt-in for locale constraints.
No suspicious patterns detected.