Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local self-improvement memory system, but it can persistently change future agent behavior and has unclear deletion and consent boundaries.
Install only if you want a persistent local memory system that can influence future agent behavior. Review the setup before adding anything to AGENTS.md, SOUL.md, workspace config, or HEARTBEAT.md, and treat exports and archives as retained copies of your memory. Avoid storing sensitive personal, credential, financial, medical, or third-party information in this skill.
setup.md:48Persistent Modification of Agent Steering Files
SKILL.md:43Free-Form User Instructions Can Be Promoted into Automatically Loaded Memory
boundaries.md:44Complete Deletion Workflow Creates a Retained Export Before Wiping Memory
The overview describes learning from corrections and accumulating knowledge across sessions, but it does not present a clear, prominent user warning that preferences and corrections are persistently stored. In a self-improving memory skill, lack of explicit notice weakens informed consent and increases the chance users disclose information without understanding retention behavior.
The documented 'forget everything' flow contradicts deletion expectations by first exporting all current memory to a file before clearing it. That creates an additional copy of potentially sensitive user-derived data at the exact moment the user is requesting erasure, which can defeat deletion guarantees and increase retention, disclosure, and compliance risk.
The wipe procedure contains a material surprise: memory may be exported before deletion, but that behavior is not surfaced as a clear warning to the user. A deletion control that silently creates another retained copy is especially risky in a memory skill because users reasonably interpret 'forget everything' as immediate, comprehensive erasure.
The documentation says old preferences may be archived 'for reference,' which conflicts with the stated rule that data should not be retained after a user asks to forget. Even outside a full wipe flow, retaining superseded user preference history can preserve personal data longer than necessary and undermine user expectations about memory changes and deletion.
The invocation criteria are broad triggers such as using the skill before starting work, after responding, or whenever output could be better, which can cause the agent to activate memory logging in many routine interactions without a specific user request. In a skill that persistently stores data, ambiguous activation increases the chance of unintentional collection and retention of user preferences and corrections.
The skill repeatedly describes persistent learning and storage in ~/self-improving/, but the top-level description does not clearly warn users that their corrections and preferences may be written to local files automatically. This undermines informed consent and can lead to retention of sensitive preference or behavioral data that users did not realize would be persisted.
The skill authorizes autonomous promotion, demotion, and archival of stored patterns based on internal thresholds, which is a form of state-changing behavior without contemporaneous user approval. Although limited to local memory files and not obviously malicious, it can silently reshape what information is retained or surfaced later, affecting privacy expectations and data integrity.
- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking
### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |
The skill exposes broad persistent memory-management commands such as searching all stored data, showing raw memory contents, deleting records across tiers, and exporting archives, which go beyond the stated purpose of self-reflection on the agent’s own work. This expands the data-handling surface and creates unnecessary risk of retention, disclosure, and misuse of user-related information across sessions.
Export and full-wipe capabilities are powerful data-management functions unrelated to basic self-reflection, and their presence indicates the skill can aggregate and manipulate persistent memory stores. If exposed without strong safeguards, export can leak sensitive accumulated context while wipe operations can destroy auditability or important records.
The automatic workflows implement cross-session loading, writing, archival, compaction, and weekly maintenance of persistent files, which materially exceed a narrowly scoped self-reflection feature. Because these behaviors happen automatically, they can silently accumulate and reorganize user-associated data without the user understanding the extent of storage or lifecycle handling.
Automatically loading memory files at session start means the agent accesses stored personal or contextual data before any contemporaneous notice or consent is presented to the user. In a self-improving agent, this is more dangerous because persistent memory is central to operation, increasing the chance of silent profiling, inappropriate reuse of stale data, or exposure of prior-session information.
The correction-handling flow persistently writes user corrections, timestamps, counters, context, and inferred namespaces without an explicit warning that these interactions will be retained. This can create unanticipated long-term behavioral profiles and store sensitive preferences or project details that users may have intended only for the immediate conversation.
The weekly maintenance routine automatically moves, archives, and compacts stored files in the background without a clear disclosure that user-related data will be modified over time. Even if intended for housekeeping, such undisclosed lifecycle operations can affect discoverability, retention expectations, and integrity of stored memory, especially when users assume their data remains static or ephemeral.
The guidance explicitly recommends "aggressive learning" with "minimal confirmation" for power users, which increases the chance the agent will persist incorrect, sensitive, or unintended user preferences without clear consent. In a self-improving memory skill, this is more dangerous than generic UX advice because the behavior can cause long-lived state changes that affect future responses and may capture data the user did not intend to store.
The instruction uses the broad trigger phrase "remember this" to cause persistent writes, without requiring confirmation, clear scope checks, or distinguishing quoted/example text from an actual save command. In a self-modifying memory skill, everyday phrasing can be induced by untrusted content or normal conversation, causing the agent to store adversarial or irrelevant instructions as long-term memory and influence future behavior.
The file is explicitly a Chinese-language documentation variant, while several embedded examples and fixed phrases are English, but the skill does not state whether output language follows user preference or can be selected. This can create a locale-policy issue if the skill behavior or interaction patterns are implicitly tied to a specific language without opt-in.
No suspicious patterns detected.