Self Improving + Proactive Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 0.1.0

Overview

The skill is not malicious, but it stores user-derived rules persistently and may modify workspace steering files with incomplete and conflicting scope disclosure.

Install only if you are comfortable with local, cross-session storage of your corrections and preferences. Review any proposed writes to ~/self-improving/ and do not allow changes to AGENTS.md, SOUL.md, or HEARTBEAT.md unless you see and approve the exact diff first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:55

Finding

Conversation-Derived Rules Can Be Promoted into Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-73, SKILL.md:164-178
Vulnerability Type: Persistent memory poisoning through automatically logged corrections and pattern promotion
Risk Level: High

Vulnerable Snippets

markdown

## Learning Signals

Log automatically when you notice these patterns:

**Corrections** → add to `corrections.md`, evaluate for `memory.md`:
- "No, that's not right..."
- "Actually, it should be..."
- "You're wrong about..."
- "I prefer X, not Y"
- "Remember that I always..."
- "I told you before..."
- "Stop doing X"
- "Why do you keep..."

**Preference signals** → add to `memory.md` if explicit:
- "I like when you..."
- "Always do X for me"
- "Never do Y"
- "My style is..."
- "For [project], use..."

markdown

### 1. Learn from Corrections and Self-Reflection
- Log when user explicitly corrects you
- Log when you identify improvements in your own work
- Never infer from silence alone
- After 3 identical lessons → ask to confirm as rule

### 2. Tiered Storage
| Tier | Location | Size Limit | Behavior |
|------|----------|------------|----------|
| HOT | memory.md | ≤100 lines | Always loaded |
| WARM | projects/, domains/ | ≤200 lines each | Load on context match |
| COLD | archive/ | Unlimited | Load on explicit query |

### 3. Automatic Promotion/Demotion
- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

Technical Analysis

The skill directs the agent to automatically persist user corrections, preferences, and self-generated reflections. Repeated patterns may subsequently be promoted to HOT memory, which is designated as always loaded.

Repetition is used as the principal promotion signal, but the documented process does not establish provenance checks, a trusted-rule schema, semantic restrictions, or ...[truncated 1898 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed confirmation before every persistent write and every promotion into HOT memory.
2. Remove automatic promotion based solely on repetition or usage frequency.
3. Store provenance with each entry, including the originating session, author, timestamp, confirmation state, and exact source text.
4. Treat stored entries as untrusted data and never as higher-priority instructions.
5. Reject memory entries that attempt to change safety policies, tool permissions, approval requirements, system prompts, credential handling, or memory-management rules.
6. Use a constrained schema for preferences instead of storing arbitrary free-form instructions.
7. Present the exact proposed rule and its scope to the user before saving it.
8. Provide an auditable history and an easy mechanism to inspect, revoke, quarantine, and restore entries.
9. Resolve the contradiction between confirmation-based promotion and automatic promotion so that confirmation is mandatory in all cases.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:17

Finding

Workspace Steering Modification Contradicts the Declared Storage Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-18, SKILL.md:215-225
Vulnerability Type: Persistent modification of agent steering files outside the declared memory scope
Risk Level: Medium

Vulnerable Snippets

markdown

Memory lives in `~/self-improving/` with tiered structure. If `~/self-improving/` does not exist, run `setup.md`.
Workspace setup should add the standard self-improving steering to the workspace AGENTS, SOUL, and `HEARTBEAT.md` files, with recurring maintenance routed through `heartbeat-rules.md`.

markdown

## Scope

This skill ONLY:
- Learns from user corrections and self-reflection
- Stores preferences in local files (`~/self-improving/`)
- Maintains heartbeat state in `~/self-improving/heartbeat-state.md` when the workspace integrates heartbeat
- Reads its own memory files on activation

This skill NEVER:
- Accesses calendar, email, or contacts
- Makes network requests
- Reads files outside `~/self-improving/`
- Infers preferences from silence or observation

Technical Analysis

The architecture section instructs workspace setup to add steering content to AGENTS, SOUL, and HEARTBEAT.md. These files are outside ~/self-improving/, yet the Scope section says the skill only stores preferences inside that directory and never reads files outside it.

Modifying workspace steering files can create durable behavioral changes because those files may be loaded by the agent in later sessions. This is more security-sensitive than ordinary preference storage: steering files commonly influence agent goals, operating rules, and recurring heartbeat behavior.

The package contains only SKILL.md. Referenced resources such as setup.md, heartbeat-rules.md, and the workspace heartbeat templates were not included in the audited artifact. Their exact content and installation behavior therefore cannot be verified. The instruction to run a missing setup resource a ...[truncated 1327 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not modify AGENTS, SOUL, HEARTBEAT.md, or other steering files by default.
2. Require explicit user approval immediately before each workspace file modification.
3. Display the target path and a complete proposed diff before writing.
4. Bundle all referenced setup, boundary, template, and heartbeat files in the skill package so reviewers can audit the complete installation flow.
5. Restrict installation to a clearly identified workspace root and reject symlinks or paths escaping that root.
6. Back up existing steering files and provide a deterministic uninstall or rollback procedure.
7. Mark installed sections with stable delimiters so removal does not overwrite unrelated user content.
8. Reconcile the Scope section with actual behavior, explicitly documenting every file that may be read or modified.
9. Ensure installed steering cannot override higher-priority safety policies, authorization checks, or tool restrictions.
10. Route recurring heartbeat behavior through a narrowly scoped, user-approved configuration rather than inserting unrestricted instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states strict file-access boundaries, but elsewhere documents workspace integration involving AGENTS.md, SOUL.md, and HEARTBEAT.md. This mismatch can mislead users and downstream agents about what files may be read or modified, weakening informed consent and creating an integrity risk around workspace configuration files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill automates storage of corrections, preferences, and learned patterns, but the description does not prominently warn users that their inputs may be persisted locally. That reduces transparency and can lead to unintentional retention of sensitive or personal information.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is designed to persist user-provided preferences and corrections across sessions and later reveal them via query commands. Even without obvious malice, cross-session retention of user data creates privacy and disclosure risks if sensitive information is logged or surfaced to the wrong context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The 'This skill NEVER' section directly contradicts earlier instructions about workspace-file integration. Security-relevant contradictions are dangerous because users and agents may rely on the narrower claim while the skill actually encourages broader file interaction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.