Versioned security assessment

Report ID: SA-DD4A3EF9

7/6/2026, 5:31:24 AM

self-improving-agent security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
self-improving-agent
Version
v4
Maintainer
charon-fan
Source
github.com/charon-fan/agent-playbook/tree/main/skills/self-improving-agent/
Coverage
10 Files scanned · 1,037 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static external command and network alerts are false positives from Markdown examples, diagrams, and research links. Confirmed risks remain because the community skill uses hidden Claude configuration paths, symlink installation, optional Bash hooks, and broad self-modifying workflows that can persist sensitive session context.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 1,037 Lines analyzed

13 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 10 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 37 evidence locations

Capability review items (10)
High
README.md:23
Hidden file in home directory
~/.claude/memory/
The README documents persistent storage under ~/.claude/memory. Hidden account-level memory can retain session details and should be treated as user-data persistence.
High
README.md:42
Hidden file in home directory
ln -s ~/path/to/agent-playbook/skills/self-improving-agent ~/.claude/skills/self-improving-agent
The installation command creates a skill entry under ~/.claude/skills. That changes account-level agent behavior for the user environment.
High
README.md:42
Symlink creation
ln -s ~/path/to/agent-playbook/skills/self-improving-agent ~/.claude/skills/self-improving-agent
The README instructs users to create a symlink into ~/.claude/skills. A community skill installed this way can affect future agent sessions globally.
High
references/appendix.md:31
Hidden file in home directory
~/.claude/memory/
The appendix documents a persistent ~/.claude/memory directory. This is a hidden home-directory store that may retain task context.
High
SKILL.md:323
Hidden file in home directory
Add to Claude Code settings (`~/.claude/settings.json`):
The skill instructs users to edit ~/.claude/settings.json. That account-level hidden configuration can enable hooks for future agent sessions.
Medium
README.md:23
Hidden file access
~/.claude/memory/
The documented ~/.claude/memory path is hidden home-directory storage. It is legitimate for Claude configuration, but it can persist sensitive learning data.
Medium
README.md:42
Hidden file access
ln -s ~/path/to/agent-playbook/skills/self-improving-agent ~/.claude/skills/self-improving-agent
The symlink targets the hidden ~/.claude/skills directory. This is a real configuration change outside the project workspace.
Medium
references/appendix.md:31
Hidden file access
~/.claude/memory/
The referenced ~/.claude/memory path is a hidden home-directory path. It is expected configuration, but still a real filesystem persistence concern.
Medium
SKILL.md:325-363
Ruby/shell backtick execution
```json
The hook configuration block invokes local bash scripts for PreToolUse, PostToolUse, and Stop events. It also passes tool input and Bash output into those scripts when users install the hooks.
Medium
SKILL.md:323
Hidden file access
Add to Claude Code settings (`~/.claude/settings.json`):
The ~/.claude/settings.json path is a hidden home-directory configuration file. Editing it is a real local configuration risk.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
SKILL.md:3-4SKILL.md:33-39SKILL.md:231-269
Broad Self-Modifying Agent Permissions
The community skill requests Bash, Write, Edit, and WebSearch access while instructing the agent to update skills, memory files, and related guidance after skill events. This can change repository behavior beyond the immediate user task.
The requested tools and self-update workflow are explicit in the metadata and process description. The intent is productivity-focused, but the modification scope is broad.
RISK-002 High
README.md:54-65SKILL.md:323-356
Hook Configuration Can Log Sensitive Tool Data
The hook examples pass tool input and Bash output into local shell commands for logging. Tool input and output can include secrets, paths, or proprietary data, so this requires explicit user approval and redaction controls.
The hook command arguments are shown directly in the documentation. I did not find evidence of network exfiltration, but sensitive local logging remains a real risk.
RISK-003 Medium
README.md:20-27SKILL.md:167-198SKILL.md:267-269
Persistent Memory May Retain Sensitive Session Context
The skill records working memory, errors, session outcomes, user feedback, and reusable lessons. Without redaction and retention limits, this can store sensitive task context under a persistent home-directory memory path.
The documented memory structures and extraction fields show persistent session and error context. I did not find a redaction or retention policy in the cited documentation.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Broad self-modifying workflow
    Require explicit user approval before changing any skill, memory, or repository file, and limit write scope to a project-local directory by default.
  2. FIX-002
    High
    Hook logging of tool input and command output
    Disable hook logging by default or redact secrets, environment values, file paths, and command output before writing logs.
  3. FIX-003
    Medium
    Persistent hidden home-directory memory
    Document retention behavior, support a project-local memory path, and add guidance for clearing or redacting stored session data.
  4. FIX-004
    Medium
    Global Claude configuration changes
    Avoid automatic symlink or settings changes. Present these as manual steps with clear rollback instructions.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
dd4a3ef9f20ddf38830950b4bb713df96b431fd6
Content hash
e49d9c21e1a033ae3a45b57e87dd0e7e2464cfb9a6932cc91789102a7e8cbba0
Tree hash
2716646c306863fc4464ec53e32b6c2151175e7d6ff7dce650eb25af548d5295
Skill path
skills/charon-fan/self-improving-agent
Audit payload hash
844718435c966e2fb36b69a39e2d9346

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable