self-improve
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/self_improve.pyto index sessions, render transcripts, and generate improvement proposals. - [DATA_EXFILTRATION]: The skill accesses sensitive local interaction data, including an SQLite database (
~/.codex/state_5.sqlite) and JSONL rollout files (~/.codex/sessions/) that contain the full history of user and agent messages. - [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by ingesting and processing untrusted text from previous chat sessions to derive new behavior rules for the agent.
- Ingestion points: Session transcripts are read from local JSONL files by the
self_improve.pyscript. - Boundary markers: There are no robust delimiters separating historical session data from the agent's current instructional context during the "dream" or "audit" phases.
- Capability inventory: The skill has the capability to propose durable edits to the agent's core instruction files (
AGENTS.mdandSKILL.md). - Sanitization: The script applies basic text normalization but lacks advanced filtering to prevent adversarial instructions embedded in past chat logs from being adopted as new persistent rules.
Audit Metadata