Versioned security assessment

Report ID: SA-6E6D5F11

6/28/2026, 9:47:21 PM

self-improving-agent security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
self-improving-agent
Version
v2
Maintainer
charon-fan
Source
github.com/charon-fan/agent-playbook/tree/main/skills/self-improving-agent/
Coverage
10 Files scanned · 1,037 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis produced many alerts, but most blocker-level items are false positives from markdown examples, diagrams, and research links. The confirmed risk is high because this community skill requests broad file-editing and Bash capabilities, teaches self-modification of skills, and documents hooks that can log tool input and command output.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 1,037 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 3 evidence locations

Capability review items (2)
Medium
README.md:22-27README.md:41-42SKILL.md:321-365
Home Directory Configuration Changes
The documentation instructs users to create a symlink under ~/.claude and edit Claude Code settings. This is a legitimate installation pattern, but it changes global agent behavior for the user account.
The filesystem paths and symlink command are explicit. The risk is contextual because users may expect installation steps to touch Claude configuration.
Low
README.md:41-42README.md:54-65SKILL.md:325-363
Shell Command Findings Are Mostly Documentation
Most external command detections are markdown examples, diagrams, or hook configuration snippets. I did not find unquoted command construction or instructions to execute untrusted input through a shell.
The cited command patterns are visible in markdown and JSON examples. The remaining concern is operational exposure when users wire those hooks into their environment.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:3-4SKILL.md:33-39SKILL.md:231-269
Broad Self-Modifying Agent Permissions
The community skill requests Bash, Write, Edit, and WebSearch access while instructing the agent to update skill files, memory files, and related guidance after skill events. This is powerful automation, but it can change repository behavior beyond the immediate user task.
The requested tools and self-update workflow are explicit in the skill metadata and process description. The intent appears productivity-focused, but the modification scope is broad.
RISK-002 High
README.md:54-65SKILL.md:323-356
Hook Configuration Can Log Sensitive Tool Data
The hook examples pass tool input and Bash output into local shell commands for logging. Tool input and output can include secrets, paths, or proprietary data, so this pattern needs explicit user approval and log handling controls.
The hook command arguments are shown directly in the documentation. I did not find evidence of network exfiltration, but sensitive local logging remains a real risk.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
SKILL.md:47-50SKILL.md:404-408references/appendix.md:127-131
Network Findings Are Research Links, Not Exfiltration
The hardcoded URLs point to research references and articles. I did not find evidence that the skill sends local data to those URLs.
The URLs are presented as citations and reference links. No code path or instruction was found that posts user data to them.
Low
SKILL.md:54-76SKILL.md:404-408references/appendix.md:127-131memory/semantic-patterns.json:253-270
Weak Crypto, C2, and Credential Alerts Appear False Positive
The weak cryptography, C2 keyword, Windows SAM, and reconnaissance alerts match prose, diagrams, markdown paths, or article titles. No evidence found of credential theft, cryptographic downgrade, C2 behavior, or system reconnaissance logic.
Manual review found documentation and example content at these locations, not executable malicious behavior. The alerts are explainable by keywords in benign text.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable