self-improving-agent

Fail

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill requires the execution of @codeharbor/agent-playbook via pnpm dlx, which downloads and runs external code from a non-trusted repository.- [DYNAMIC_EXECUTION]: The behavior validation process uses JSON artifacts that specify shell commands to be executed locally. These commands are not sandboxed and run with the current user's full privileges.- [COMMAND_EXECUTION]: The skill uses the Bash tool and a custom CLI to manage a learning lifecycle, providing the agent with broad system interaction capabilities.- [PERSISTENCE]: Instructions for enabling failure hooks through the init --hooks command allow the agent to persistently monitor and react to tool failures across different sessions.- [DATA_EXFILTRATION]: The skill writes learning data to the hidden home directory path ~/.agent-playbook/ and supports exporting this data to arbitrary filesystem locations.- [INDIRECT_PROMPT_INJECTION]: The skill ingests tool failure outputs to generate behavior rules, creating a vulnerability surface where malicious inputs could influence future agent actions.
  • Ingestion points: Captures PostToolUseFailure events and manual evidence labels.
  • Boundary markers: Mentions redaction of tool payloads, but the agent still evaluates the semantic summary.
  • Capability inventory: Possesses Write, Edit, and Bash capabilities for modifying guidance and executing verification commands.
  • Sanitization: Relies on redaction and manual review, but lacks automated validation of the integrity of learned rules beyond the executable artifacts.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 15, 2026, 02:43 PM