Sharpagent Self Evolving

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:16 AM UTC
• Version: 1.0.0

Overview

This skill is a self-improvement loop, but it asks to automatically retain task-derived lessons and change future agent behavior without clear user control.

Install only if you are comfortable with an agent retaining lessons from your tasks and using them to change future behavior. Prefer using it with explicit review before any LearningEntry, template write, monitor update, lifecycle update, or preference-profile change, especially on sensitive or client work.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:228

Finding

Automatic Propagation of Task-Derived Lessons into Persistent Agent State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 228–243
Vulnerability Type: Persistent memory and configuration poisoning
Risk Level: High

Vulnerable Code

markdown

**Category Tags:**

| Category | Meaning | Action |
|----------|---------|--------|
| `coding-pattern` | Code pattern improvement | Auto-apply on next coding task |
| `info-source` | Information source improvement | Update monitor source priority |
| `workflow` | Workflow optimization | Update engineering lifecycle gates |
| `tool-usage` | Tool usage skill | Efficiency sequence |
| `domain-knowledge` | Domain knowledge accumulation | Long-term memory |

**Auto-Propagation:**
- If `coding-pattern` → write to `~/.agent-templates/`
- If `info-source` → update monitor config
- If `workflow` → check if engineering lifecycle needs update
- If lesson verified ≥3 times → promote to `verified-best-practice`

Related propagation behavior also appears at SKILL.md, lines 296–301:

markdown

### Engineering Lifecycle
- Phase 2 hypothesis = engineering **improvement proposal**
- Phase 3 experiment = **verification phase**
- Successful experiments auto-update lifecycle best practices

Technical Analysis

The skill instructs the agent to transform task-derived observations into persistent templates, monitoring configuration, long-term memory, and lifecycle best practices. These changes are explicitly intended to be applied automatically to future tasks.

Task outputs and logs may contain untrusted user content, incorrect conclusions, prompt-injection material, or adversarial examples. The documented workflow does not establish a trust boundary between this input and persistent agent policy. It also does not require human approval, semantic sanitization, per-project isolation, provenance-based access controls, or rollback before propagation.

Repeating or manipulating an experiment may cause an attacker-influence ...[truncated 1648 chars]

Remediation

View remediation

Remediation Suggestions

1. Place all generated lessons in a non-executable, isolated review queue rather than directly modifying templates or configuration.
2. Require explicit, informed user or administrator approval for every cross-session state change.
3. Never treat task-derived free-form text as agent policy, executable instructions, or trusted configuration.
4. Enforce a strict schema with field length limits, allowed-value lists, canonicalization, and rejection of embedded instructions.
5. Attach immutable provenance to each lesson, including the originating task, input trust level, experiment data, reviewer, and approval time.
6. Scope approved lessons to the originating project by default; prohibit writes to global home-directory templates unless separately authorized.
7. Replace automatic promotion with independent review and reproducible validation against trusted test data.
8. Add expiration, versioning, audit logs, conflict detection, and one-step rollback for every persisted lesson.
9. Separate descriptive learning records from configuration capable of changing agent behavior.
10. Apply least-privilege controls so the skill cannot directly write monitor or lifecycle configuration.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:278

Finding

Mandatory Reflection and Forced Archival Override Task-Local Control

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89–92 and 278–289
Vulnerability Type: Mandatory instruction control with persistent recording despite user opt-out
Risk Level: High

Vulnerable Code

At SKILL.md, lines 89–92:

markdown

**When:**
- Every task completion (mandatory)
- Major errors mid-task (force deep mode)
- Daily summary (optional, merge multiple reflections)

At SKILL.md, lines 278–289:

markdown

| Situation | Action |
|-----------|--------|
| Task execution failed | Force deep reflection mode, focus on root cause |
| 3 consecutive experiment failures | Question hypothesis itself, check experiment design |
| Tiny task (rename variable) | Skip loop, but log if recurring error pattern |
| Multiple reflections same day | Merge into daily evolution summary |
| Hypothesis too abstract | Break into verifiable sub-hypotheses |
| User says "no reflection needed" | Skip but log to preference profile |

## Quality Gates

| Check | What | Fail action |
|-------|------|-------------|
| Reflection output | At least 1 improvement hypothesis | Reflect again |
| Hypothesis verifiable | Has clear A/B or ablation plan | Require refinement |
| Experiment has data | Numbers not "feelings" | Retest or mark unverifiable |
| Absorb archived | Experiment result saved as LearningEntry | Force archive |

Technical Analysis

The skill declares reflection mandatory after every task and uses quality gates to force the production and archival of an improvement hypothesis. When a user explicitly requests that reflection be skipped, the skill still instructs the agent to modify a persistent preference profile.

This behavior can supersede the immediate task scope and continue processing task material after the requested work has ended. It also weakens user control over retention because an opt-out still results in durable state modification. The instructions do not de ...[truncated 1845 chars]

Remediation

View remediation

Remediation Suggestions

1. Make reflection, experimentation, and archival opt-in rather than mandatory.
2. Honor a user's refusal without writing the refusal or any inferred preference to persistent storage.
3. Request separate, explicit consent before creating a LearningEntry or updating a preference profile.
4. Keep reflection task-local by default and delete temporary reflection data when the task ends.
5. Remove the Reflect again and Force archive directives, replacing them with non-binding recommendations.
6. Exclude secrets, personal information, proprietary content, and untrusted instructions from reflection inputs through sensitivity and trust-boundary checks.
7. Clearly display the exact data proposed for retention, its purpose, scope, and expiration before seeking approval.
8. Provide users with inspection, deletion, export, expiry, and rollback controls for all retained state.
9. Scope preferences to the specific project or invocation unless broader persistence is separately authorized.
10. Ensure task instructions and explicit user choices take precedence over this skill's default workflow.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The declared contract says the skill writes only LearningEntry and ImprovementHypothesis, but later instructions authorize modifying ~/.agent-templates, monitor config, and engineering lifecycle behavior. This mismatch is dangerous because downstream systems or users may trust the narrower contract while the skill performs broader persistent changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documents automatic archival plus file/config updates without clear user-facing warnings or consent for data retention and system changes. Hidden persistence and configuration mutation are especially risky in agent skills because they can affect future behavior across sessions and expose sensitive task-derived information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says the loop runs after every task and 'makes agents smarter with use,' implying very broad automatic activation. In combination with persistent writes, this wide scope increases the chance of the skill engaging on sensitive or irrelevant tasks and amplifies any harmful side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The mandatory trigger 'Every task completion' and mid-task deep reflection conditions are insufficiently constrained, leaving broad discretion for automatic invocation. Because the skill also archives data and may update persistent state, ambiguous triggers can cause over-collection and unintended modifications during routine work.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims to archive learning records, but the documented behavior goes beyond passive recordkeeping into active mutation of external agent state and configuration. Automatic writes to template directories and updates to monitor/lifecycle settings create persistence and behavioral drift that can affect future tasks without explicit user review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The self-reflection purpose does not inherently require changing template directories or operational configs, so these automatic modifications exceed what a reasonable user would expect from a learning loop. Such unjustified side effects can silently alter future agent behavior and create a path for persistence or degraded integrity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

Writing to ~/.agent-templates creates cross-session persistence, allowing outputs from one task to influence future tasks indefinitely. In a self-evolving skill, this is more dangerous because lessons are automatically promoted into reusable behavior, which can propagate mistakes, prompt injection artifacts, or unsafe patterns beyond the original context.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md

| `domain-knowledge` | Domain knowledge accumulation | Long-term memory |

**Auto-Propagation:**
- If `coding-pattern` → write to `~/.agent-templates/`
- If `info-source` → update monitor config
- If `workflow` → check if engineering lifecycle needs update
- If lesson verified ≥3 times → promote to `verified-best-practice`