Security audit

GitLab Agent Self Improvement

Security checks for vulnerabilities and agentic risk

Overview

The scanners report a skill advertised for personal growth that can publish findings to a GitLab project and close older merge requests, so the verdict is suspicious because those actions may not match the request or have clear approval safeguards.

Before installing, consider whether you want a personal-growth skill to publish to GitLab or close merge requests. Check the target project and what information could be shared, and avoid providing credentials or relying on it for project changes unless those actions are explicitly authorized.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

The activation description is too broad to distinguish personal-growth requests from GitLab project maintenance.

Medium

Category: Trigger Abuse
Confidence: 93% confidence
Finding: The description presents a general personal-growth skill but omits its actual GitLab publishing and maintenance behavior. If skill selection relies on this description, an unrelated reflection request could activate a workflow that publishes information or changes project state. The danger comes from this mismatch combined with the operational instructions, not from a broad description alone.
Content: No source excerpt is available for this finding.

The personal-growth skill directs changes to remote GitLab merge requests, including closing older requests.

Medium

Category: Excessive Agency
Confidence: 96% confidence
Finding: A skill advertised for personal growth directs authenticated changes to a hard-coded GitLab project, including closing older merge requests. These externally visible actions are not necessarily authorized by a personal-improvement request, and inactivity alone does not establish that a merge request should be closed. The declared GitLab token dependency makes these instructions actionable when suitable credentials are available.
Content: No source excerpt is available for this finding.

The workflow requires publishing findings and closing older merge requests without privacy or project-impact warnings.

Medium

Category: Output Handling
Confidence: 94% confidence
Finding: The workflow requires publishing findings to a remote project without checking whether they contain private information or are appropriate for that project's audience. It also instructs closure of older merge requests without an explicit approval gate, potentially disrupting ongoing work. The reference to another skill provides no demonstrated privacy or authorization safeguards in the supplied content.
Content: No source excerpt is available for this finding.