self-improving-agent
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill requires the execution of
@codeharbor/agent-playbookviapnpm dlx, which downloads and runs external code from a non-trusted repository.- [DYNAMIC_EXECUTION]: The behavior validation process uses JSON artifacts that specify shell commands to be executed locally. These commands are not sandboxed and run with the current user's full privileges.- [COMMAND_EXECUTION]: The skill uses theBashtool and a custom CLI to manage a learning lifecycle, providing the agent with broad system interaction capabilities.- [PERSISTENCE]: Instructions for enabling failure hooks through theinit --hookscommand allow the agent to persistently monitor and react to tool failures across different sessions.- [DATA_EXFILTRATION]: The skill writes learning data to the hidden home directory path~/.agent-playbook/and supports exporting this data to arbitrary filesystem locations.- [INDIRECT_PROMPT_INJECTION]: The skill ingests tool failure outputs to generate behavior rules, creating a vulnerability surface where malicious inputs could influence future agent actions. - Ingestion points: Captures
PostToolUseFailureevents and manual evidence labels. - Boundary markers: Mentions redaction of tool payloads, but the agent still evaluates the semantic summary.
- Capability inventory: Possesses
Write,Edit, andBashcapabilities for modifying guidance and executing verification commands. - Sanitization: Relies on redaction and manual review, but lacks automated validation of the integrity of learned rules beyond the executable artifacts.
Recommendations
- AI detected serious security threats
Audit Metadata