Security audit

Cognitive Self Training

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local memory and daily review helper, with expected but real privacy and scheduling considerations.

Install only if you want this bot to keep project-local training memory. Before enabling daily automation, confirm the schedule scope, where files will be written, and how to pause or remove the scheduler. Do not use it with sensitive conversations unless you are comfortable with redacted summaries being retained locally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The skill directs the agent to configure a recurring schedule and create host automation, which establishes persistence beyond the current session. While it does ask the user for a time first, this still increases risk because the skill can install recurring behavior that continues to process prior context and write files automatically, especially if platform automation semantics are unclear.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
What time should this bot run its daily dream review and cognitive consolidation? Please include timezone if different from the current environment.

text
If the user declines, install the skill but mark dream automation as `manual`. If they answer, write the schedule with: ```bash bash cognitive-self-training/scripts/configure_dream_schedule.sh . "23:30" "Asia/Shanghai"

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to log corrections, preferences, teachings, recurring problems, and other interaction-derived data into persistent stores, creating a direct natural-language data retention channel. Even though the file says not to record secrets and sensitive data, the collection criteria are broad and rely on imperfect agent judgment, so private or regulated information can still be captured, retained, and reused later.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The capture triggers include very broad conditions like when a user 'teaches' a preference or asks the bot to 'remember, review, train, practice, improve, or prepare for tomorrow', which risks retaining routine conversation as persistent memory without clear boundaries. Because this skill is specifically designed to distill and store user interactions, ambiguous triggers materially increase unauthorized data retention risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The dream-review activation phrases are broad enough to match ordinary conversational language such as 'sleep on it' or 'research today's lessons', which can trigger unintended reflective workflows and storage actions without sufficiently explicit user consent. In this skill, that matters more because activation can lead to reading prior memory, generating persistent artifacts, and running scheduled-style review behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The output format requires the agent to "Write one novel-like concluding paragraph in Chinese". This imposes a specific language on users regardless of their preferred locale, and the file does not offer opt-in, fallback, or a documented region-specific reason for the constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The protocol mandates that the Summary Narrative be written in Chinese regardless of the user's language preference or explicit consent. This can reduce transparency and user comprehension, making it harder for users to review what was stored or detect errors in a persisted record, especially when combined with the automatic file-writing behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The protocol instructs the agent to write a file to .cognitive-training/dreams/YYYY-MM-DD.md but does not require any user-facing disclosure, consent, or confirmation before persisting content. In an agent setting, silent file writes can create privacy, integrity, and surprise risks, especially because the content may include synthesized reasoning, mistakes, and inferred hypotheses derived from prior user interactions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Line L169 instructs the model to produce the summary in Chinese ('用不超过300个中文字符') as a fixed requirement. This is a natural-language locale policy issue because it forces a specific language without user opt-in or any stated region-specific justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code creates directories and writes numerous files under the provided root path, but aside from a final success message it provides no prior disclosure, prompt, or comment warning that it will modify the filesystem. For a code file, bulk file creation is a safety-relevant operation and the lack of an upfront warning makes the side effect easy to miss.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.