self-improving-agent
Warn
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill explicitly instructs the agent to use an
edittool to dynamically modify its own source file (SKILL.md) and system prompt templates at runtime based on generated "improvement strategies." This self-modifying code pattern is a high-risk capability that can be used to establish persistence for malicious logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted external data and use it to rewrite its core instructions, creating a significant vulnerability surface.\n - Ingestion points: The skill captures "execution logs," "API return values," and "explicit user criticism/feedback" from the
SKILL.mdcontext.\n - Boundary markers: Absent. The instructions do not define delimiters or provide warnings to ignore malicious instructions embedded within the feedback or logs.\n
- Capability inventory: The agent is granted the
edittool for file system writes to its own source code andmcp_callfor updating system prompts.\n - Sanitization: Absent. There are no mentions of validation, sanitization, or safety filtering of the generated "Candidate Policy" before it is applied to the agent's instructions.\n- [EXTERNAL_DOWNLOADS]: The installation section directs users to run
npx clawhub@latest install self-improving-agent, which fetches and executes code from an external registry not included in the trusted vendor list.\n- [COMMAND_EXECUTION]: The skill documentation includes examples of usingmcp_callto modify environment-level system prompts and suggests using theedittool to overwrite configuration files at runtime.
Audit Metadata