Self Improving 1.2.10

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:14 AM UTC
• Version: 1.0.0

Overview

The skill is coherent as a local self-improvement memory tool, but it asks for durable agent-wide steering and automatic persistent memory writes that need careful review.

Install only if you want an agent to keep local cross-session behavioral memory. Review the proposed AGENTS.md, SOUL.md, and HEARTBEAT.md changes first, avoid storing sensitive or proprietary details, prefer strict confirmation mode, and check filesystem permissions on ~/self-improving/.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: setup.md:50

Finding

Persistent Modification of Agent Steering and Maintenance Files

Content

View full analysis

.md` - Do not read unrelated domains "just in case" If inferring a new rule, keep it tentative until human validation. ``` ```markdown ## Optional: Heartbeat Integration Add to `HEARTBEAT.md` for automatic maintenance: ```markdown ## Self-Improving Check - [ ] Review corrections.md for patterns ready to graduate - [ ] Check memory.md line count (should be ≤100) - [ ] Archive patterns unused >90 days ``` ``` ### Technical Analysis The setup procedure instructs the installer to modify `AGENTS.md`, `SOUL.m ...[truncated 1985 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: operations.md:18

Finding

Persistent Memory Poisoning Through Unvalidated Behavioral Rules

Content

View full analysis

= 3: ask to confirm as rule 5. Determine namespace (global, domain, project) 6. Write to appropriate file 7. Update index.md line counts ``` ### On Pattern Match When applying learned pattern: ``` 1. Find pattern source (file:line) 2. Apply pattern 3. Cite source: "Using X (from memory.md:15)" 4. Log usage for decay tracking ``` ``` ```markdown - Explicit user correction → append to `~/self-improving/corrections.md` immediately - Reusable global rule or preference → append to `~/self-improving/memory.md` - Domain-specific lesson → append to `~/self-improving/domains/.md` - Project-only override → append to `~/self-improving/projects/.md` - Keep entries short, concrete, and one lesson per bullet; if scope is ambiguous, default to domain rather than global - After a correction or strong reusable lesson, write it before the final response ``` ### Technical Analysis The Skill acce ...[truncated 2145 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: boundaries.md:53

Finding

Cross-Session Retention Without Consistent Explicit Consent

Content

View full analysis

= 3: ask to confirm as rule 5. Determine namespace (global, domain, project) 6. Write to appropriate file 7. Update index.md line counts ``` ``` ```markdown - Explicit user correction → append to `~/self-improving/corrections.md` immediately - Reusable global rule or preference → append to `~/self-improving/memory.md` - Domain-specific lesson → append to `~/self-improving/domains/.md` - Project-only override → append to `~/self-improving/projects/.md` - Keep entries short, concrete, and one lesson per bullet; if scope is ambiguous, default to domain rather than global - After a correction or strong reusable lesson, write it before the final response ``` ### Technical Analysis The consent table requires explicit opt-in for cross-session patterns, but the operational procedure immediately appends corrections and lessons to persistent files. A correction to the current response does not necessarily constitute consent to retain the correction across future sessions. The system also stores self-generated “strong reusable lessons,” even though those entries are not direct user statements. As written, the persis ...[truncated 974 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-template.md:20

Finding

Persistent Memory Created Without Explicit Restrictive Filesystem Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:206

Finding

Unpinned Third-Party Skill Installation Recommendations

Content

View full analysis

` if user confirms: - `memory` — Long-term memory patterns for agents - `learning` — Adaptive teaching and explanation - `decide` — Auto-learn decision patterns - `escalate` — Know when to ask vs act autonomously ``` ### Technical Analysis The recommendations install third-party Skills by mutable slug. They do not pin a version, package digest, publisher identity, or expected capability manifest. User confirmation prevents silent installation but does not guarantee that the package fetched later is the same package that was reviewed when this Skill was published. No evidence was found that this project automatically runs the installation command. The risk arises if the user follows the recommendation and the package registry entry, publisher account, or resolution process has been compromised. ### Attack Path 1. An attacker compromises a recommended package, publisher account, or mutable slug. 2. A user accepts the recommendation and executes `clawhub install `. 3. The package resolver retrieves the current compromised package. 4. The newly installed Skill receives whatever capabilities its host grants. 5. Malicious behavior occurs outside the code reviewed in this audit. ### Impact Assessment Impact depends on the permissions granted to the installed third-party Skill. A compromised dependency could potentially access Agent tools, local files, or persistent state available in the host environment. This project itself does not fetch or execute a remote payload, and the recommendation requires user confirmation. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is explicitly designed to run 'before starting work and after responding,' plus in many routine feedback situations, which creates very broad activation conditions. In context, that increases the chance the agent will repeatedly read and write persistent memory around ordinary conversations, potentially over-collecting user preferences or corrections and expanding the blast radius of prompt-injection or privacy mistakes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill authorizes autonomous promotion, demotion, and archival of stored patterns based on internal heuristics and time windows, without requiring user approval except for deletion. In this context, that means the agent can materially change persistent memory state on its own, which can entrench incorrect inferences, preserve injected instructions longer, or silently alter future behavior across sessions.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

- Pattern used 3x in 7 days → promote to HOT
- Pattern unused 30 days → demote to WARM
- Pattern unused 90 days → archive to COLD
- Never delete without asking

### 4. Namespace Isolation
- Project patterns stay in `projects/{name}.md`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · boundaries.md (reported line 11)May include surrounding context.

md

| Financial | Card numbers, bank accounts, crypto seeds | Fraud risk |
| Medical | Diagnoses, medications, conditions | Privacy, HIPAA |
| Biometric | Voice patterns, behavioral fingerprints | Identity theft |
| Third parties | Info about other people | No consent obtained |
| Location patterns | Home/work addresses, routines | Physical safety |
| Access patterns | What systems user has access to | Privilege escalation |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The kill switch is triggered by a plain-language phrase, "forget everything," which can easily appear in ordinary conversation, quoted text, or third-party content. In a self-improving memory-bearing skill, that ambiguity creates a realistic risk of unintended memory deletion or adversarial prompt injection that wipes state without the user's deliberate intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The template explicitly establishes persistent, self-organizing storage in ~/self-improving/memory.md and says it is loaded every session and updated based on agent-observed usage patterns. That goes beyond transient self-reflection and creates durable state that can accumulate user preferences or behavioral patterns without clear scope limits, review, or consent, increasing privacy and prompt-persistence risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states that the agent will add entries automatically, demote entries over time, and compact the file, but provides no requirement for user warning, confirmation, or auditability. Automatic mutation of a user-associated memory file can silently persist incorrect, sensitive, or attacker-influenced content across sessions, making later agent behavior harder to predict or correct.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill performs automatic loading and modification of persistent memory files at session start and on corrections without requiring explicit user awareness or consent at the time of access. In a self-improving agent, this creates a real privacy and integrity risk because the agent may silently retain, alter, and reuse user data across sessions in ways the user does not expect.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The design logs user-provided corrections and later supports commands to display or export memory contents, which can expose sensitive preferences, project details, or prior conversations if shown to the wrong user or context. Persistent natural-language storage increases leakage risk because sensitive information may be captured verbatim and later recalled broadly.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example memory contents explicitly retain user preferences, conversational corrections, and project history for later reuse, which can reveal private behavioral patterns or project metadata during recall. Because this skill is specifically designed for proactive self-reflection and permanent learning, the context makes the retention-and-reuse risk more pronounced rather than incidental.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to read and write persistent self-improvement memory as part of normal task execution, but it does not require any explicit user notice or consent before storing corrections, preferences, or workflow lessons. This creates a privacy and integrity risk because user/task-derived data may be retained across sessions and influence future behavior without the user's awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly require appending corrections and reusable lessons immediately and before the final response, which normalizes silent persistence of potentially sensitive user information and model inferences. Because these writes happen automatically and pre-response, the user may not realize data has already been stored or that future outputs could be shaped by unreviewed memory entries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.