Security audit

Tmp Self Improving Agent

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate learning logger, but it can persist and share broad session context in ways users should review before installing.

Install only if you want an agent to keep persistent learning notes. Before enabling hooks or cross-session sharing, inspect the scripts, prefer project-scoped setup, require confirmation before writing or promoting entries, and redact secrets, personal data, customer content, raw transcripts, tokens, and proprietary details.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill explicitly encourages reading other session transcripts and sending learnings across sessions, which expands scope from local self-improvement to cross-session data movement. Without authorization, minimization, or privacy boundaries, this creates a direct path for sensitive information from one context to be exposed in another.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The reusable skill-generation workflow exceeds the narrow logging purpose and can create new prompt artifacts on disk that influence future agent behavior. Even if intended as productivity tooling, generating skills from conversational learnings risks codifying mistakes, unsafe rules, or sensitive context into persistent reusable assets.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document states that the scripts 'only output text' and 'don't modify files or run commands,' but the configured hook mechanism explicitly executes shell scripts as commands. This mismatch can mislead users into granting trust or enabling hooks without understanding that arbitrary local code will run under the agent's privileges on prompt and tool events.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation criteria cover many routine situations such as failures, corrections, missing capabilities, and discovering better approaches, making invocation likely during ordinary work. Over-broad triggering increases unintended logging, persistence, and promotion of conversational content, especially when paired with automatic hooks.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The automatic detection phrases are common in normal conversation, so the skill may log or persist content based on ambiguous user language rather than clear intent. In practice this can cause accidental storage of sensitive or irrelevant information and normalize excessive retention.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The logging templates instruct the agent to store detailed error context, inputs, parameters, and user context but provide no warning to exclude credentials, tokens, personal data, or proprietary content. Persistent markdown logs are easy to overlook, copy, sync, or commit, so this creates a substantial data leakage risk.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: An empty matcher causes the hook to fire on every prompt, creating an always-on execution path for the configured script. In a self-improvement skill, this broad trigger increases exposure, normalizes persistent code execution, and raises the chance of unintended data handling or abuse if the script is modified or replaced.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The user-level configuration enables global, persistent execution of a local script across sessions without meaningful scope constraints. That increases blast radius: any future session on the machine may trigger the script, making misuse, accidental overcollection, or compromise of the script path more impactful.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The setup instructions tell users to configure command hooks that run on prompt submission and post-tool events before clearly warning that these are executable shell commands. Users may enable recurring command execution without appreciating that this is code execution tied to sensitive interaction points.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The guide instructs users to enable a hook that will fire automatically on lifecycle and command events, but does not explain the security implications of installing event-driven automation into a prompt-injection-based workspace. In this skill context, automatic hooks can amplify prompt injection, persistence, and unintended data handling because they execute without per-use user confirmation.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill encourages promoting conversation-derived learnings and corrections into persistent shared context files like CLAUDE.md, AGENTS.md, and related memory artifacts. That creates a durable leakage channel where user-provided details, mistakes, or context can be transformed into long-lived prompts consumed by future sessions.

Ssd 3

High

Confidence: 98% confidence
Finding: Allowing transcript reads from other sessions and sending learnings between sessions without privacy scoping or access controls is a clear cross-context data exfiltration risk. Because transcripts often contain user prompts, outputs, and operational details, this can leak sensitive information far beyond the original task boundary.

Ssd 3

High

Confidence: 98% confidence
Finding: The templates explicitly request full context, input or parameters used, and user context, which strongly biases the agent toward storing semantically rich sensitive data in persistent files. This is especially dangerous because the content may later be promoted, shared, indexed, or committed, magnifying exposure.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.