Security audit

Self Improvement

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but should be reviewed because it can persist conversation details, command errors, and project context into long-lived files without clear redaction or approval rules.

Install only if you are comfortable with agents keeping durable local notes. Before using it, decide whether .learnings should be gitignored, require manual approval before writing or promoting entries, and redact tokens, credentials, personal data, customer details, internal URLs, raw prompts, and sensitive stack traces. Do not enable the optional hooks unless you can inspect the referenced scripts and confirm they only create sanitized summaries.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The skill instructs automatic logging based on ambiguous semantic conditions like corrections, knowledge gaps, and feature requests. In practice this can cause the agent to persist user conversation content without clear consent or necessity, increasing the chance that sensitive disclosures, proprietary details, or operational context are written to local files.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill description tells the agent to log corrections, failures, and missing capabilities, but provides no warning to avoid storing secrets, personal data, or confidential user context. Because the skill is specifically designed to capture conversational learnings, the lack of privacy guardrails makes accidental retention of sensitive data reasonably likely.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The error logging template explicitly asks for actual error output, inputs, parameters, and environment details, all of which commonly contain API keys, access tokens, filesystem paths, customer data, or internal infrastructure information. Persisting those details in markdown files creates a durable leak surface that may later be committed, indexed, or exposed to other tools and agents.

Ssd 3

Medium

Confidence: 94% confidence
Finding: This skill broadly directs the agent to retain user-provided corrections, failures, and other interaction details in persistent files. That creates a natural-language data retention risk because users may reveal sensitive information during troubleshooting or clarification, and the skill does not impose meaningful minimization or retention limits.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The learning-entry format asks for full context about what happened, what was wrong, and what is correct, which naturally encourages copying conversational details into persistent storage. In a coding-assistant context, that may capture proprietary source details, internal architecture, customer data, or personal disclosures in plain text.

Ssd 3

High

Confidence: 98% confidence
Finding: The error-entry format instructs the agent to store actual error messages, command context, inputs, parameters, and environment details. Those fields frequently contain secrets, internal URLs, stack traces, tokens, or customer data, so the template materially increases the chance of sensitive data being written to disk and later shared unintentionally.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The feature-request format captures what the user wanted and why they needed it, which can reveal roadmap intent, business priorities, security objectives, or personal workflow details. Persisting that context without minimization or consent creates unnecessary retention of sensitive conversational information.

Ssd 3

Medium

Confidence: 93% confidence
Finding: Automatic logging on user prompts, corrections, and knowledge-gap signals creates a standing instruction to capture conversation content whenever users provide new information. In context, this makes the skill more dangerous because it normalizes passive retention rather than deliberate, reviewed logging, increasing privacy and confidentiality risk across ordinary interactions.

Static analysis

No suspicious patterns detected.