T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:386- Finding
Persistent Modification of Agent Identity and Behavioral Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
auto-evolving-agent(智能体自主进化)
Security checks for vulnerabilities and agentic risk
Overview
The skill is transparent about helping an agent rewrite and extend itself, but it grants broad persistent self-modification, memory reuse, and module-installation authority that users should review carefully.
Install only if you intentionally want an agent-development skill that may propose persistent changes to its own instructions, memory, workflows, SOUL.md, and installed capabilities. Keep it in proposal-only or tightly supervised use, review exact diffs and module metadata before approving changes, and avoid enabling automatic evolution until file scope, rollback, memory hygiene, and supply-chain checks are clearly enforced.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:235- Finding
Persistent Prompt Injection Through the Gene Pool and Tiered Memory
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:374- Finding
Unverified Discovery and Installation of Third-Party Capability Modules
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The skill explicitly advertises self-evolution and self-optimization through natural-language triggers like 'Self-evolve' and 'Optimize myself,' and elsewhere states that its scope includes modifying its own configuration, creating new skills, updating workflow prompts, and changing 'SOUL.md'. Even with claimed safeguards, a skill centered on self-modification materially raises the risk of prompt drift, persistence of unsafe changes, and recursive capability expansion if invoked improperly or combined with broad triggers.
- Content
md - "探索新方法"、"优化现有方案" 英文触发词： - "Help me evolve", "Self-evolve", "Optimize myself" - "Generate 3 improvement ideas", "Evolve my capabilities" - "Explore new approaches", "Optimize existing solutions"
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
This skill is explicitly designed for self-evolution and self-modification, including updating SKILL.md, SOUL.md, workflows, memory, and capability modules. Even though the document mentions confirmation, the combination of self-modification, broad triggers, auto-reflection, and optional periodic evolution makes the capability dangerous because it normalizes agent-directed alteration of its own behavior and installed components.
- Content
md - "生成3个改进方案"、"进化我的能力" - "探索新方法"、"优化现有方案" - "Help me evolve", "Self-evolve", "Optimize myself" - "Generate 3 improvement ideas", "Evolve my capabilities" - "Explore new approaches", "Optimize existing solutions"
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad, generic, and overlap with normal user requests such as asking for optimization or improvement ideas. This increases the chance of accidental invocation of a self-modifying skill, which can cause the agent to enter an unsafe capability-changing workflow without the user explicitly intending to modify the agent itself.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad, natural-language requests such as 'optimize myself' and 'help me evolve' that can be invoked during ordinary conversation without a narrowly scoped consent flow. In this skill, those triggers can lead into self-modification, workflow changes, or creation/installation of new skills, so accidental activation increases the chance of unintended autonomous changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The automatic trigger conditions include vague events like 'after completing complex tasks,' 'when user feedback is satisfied/unsatisfied,' and periodic auto-evolution, which are insufficiently bounded and can cause the skill to initiate self-directed changes without a precise user request. Because the skill explicitly supports modifying its own configuration, workflows, memory, Soul, and installing or replacing modules, ambiguous auto-triggers materially increase the risk of unauthorized or poorly scoped changes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown template is written entirely in Chinese and provides no indication that language selection is optional or configurable. Under the policy, a skill artifact that effectively enforces a specific language without user opt-in can constitute a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The document is primarily written in Chinese with secondary English glosses, which may impose a language preference without stating that the user can choose their preferred language. Under the language/locale policy, a skill should explicitly offer language choice unless the constraint is justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The description and headings are consistently bilingual Chinese/English, but the document does not state that language choice depends on user preference or allow opting into one language. This can be a locale/language policy concern if the skill defaults to a fixed presentation style without user selection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown template presents all user-facing headings and fields in Chinese, which effectively forces a specific language for use of the skill artifact. The file does not indicate that the language is optional, configurable, or limited to a justified region-specific context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown template presents all user-facing content in Chinese and does not offer any language or locale choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.
- Content