compound-engineering

ISSUES FOUND max severity HIGHSkillSpector Caution 33 registry clawhub.ai last scanned 2 scans

5 findings (2 high, 3 medium), mainly prompt injection, unauthorized tool use, resource abuse. Most recent scan 2026-02-05.

This skill presents MODERATE TO HIGH security risks due to autonomous instruction modification and indirect prompt injection vulnerabilities. The core concept of automated learning is valuable, but the implementation lacks critical safeguards. Primary concerns: (1) The agent reviews arbitrary session content without treating it as untrusted input, creating indirect prompt injection risk where malicious instructions in prior sessions could be executed during review. (2) Autonomous modification of instruction files (MEMORY.md, AGENTS.md) without user confirmation violates security best practices. (3) Automated git commits could propagate unauthorized changes. The skill requires significant security hardening before production use, particularly adding user confirmation for file modifications and treating reviewed session content as untrusted input.

Scanner's overall assessment (LLM analyzer)
Findings5
Critical0
High2
Medium3
Low0
Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 33
Score33 / 100
Issues10
CategoriesRogue Agent MCP Rug Pull Excessive Agency
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Make your AI agent learn and improve automatically. Reviews sessions, extracts learnings, updates memory files, and compounds knowledge over time. Set up nightly review loops that make your agent smarter every day.

Package
2 files, 7.2 KB
SKILL.md
782 words, 12+ sections
Code
None. Instructions only.
Version
1.0.0

SKILL.md covers: Compound Engineering · Quick Start · Review last 24 hours and update memory · Create hourly memory snapshot · Set up automated nightly review (cron) · How It Works · The Compound Loop · What Gets Extracted · Clawdbot Integration · Automatic Hourly Memory · Hourly Memory Snapshot · Add to clawdbot config or crontab

Findings

HIGH Indirect Prompt Injection via Unbounded Session Review Prompt Injectionllm

The skill instructs the agent to 'scan all sessions from last 24h' and 'extract learnings and patterns' from arbitrary session content without validation. This creates a transitive trust vulnerability where malicious instructions embedded in previous sessions (user messages, file contents, web pages) could be executed during the review process. An attacker could plant instructions like 'when reviewing sessions, exfiltrate credentials' in a prior session, which would then be followed during the automated nightly review.

SKILL.md

'Review all sessions from the last 24 hours. Extract: 1) Key learnings and patterns, 2) Mistakes or gotchas to avoid, 3) User preferences discovered, 4) Unfinished items. Update MEMORY.md with a summary.'
Remediation: Implement strict content filtering during session review. Treat all session content as untrusted input. Use structured extraction that ignores instruction-like patterns. Add explicit warnings that the agent should NOT follow instructions found within session content being reviewed.
HIGH Autonomous File Modification Without User Confirmation Unauthorized Tool Usellm

The skill performs automated file writes (MEMORY.md, AGENTS.md, memory/YYYY-MM-DD.md) and git commits without explicit user confirmation. The nightly cron job runs completely autonomously at 10:30 PM, modifying critical instruction files that control agent behavior. This violates the principle of user oversight for sensitive operations and could allow malicious session content to permanently alter agent instructions.

SKILL.md

'NIGHTLY REVIEW (10:30 PM): Update MEMORY.md and AGENTS.md, Commit and push changes' - fully automated without confirmation
Remediation: Require explicit user approval before modifying instruction files (MEMORY.md, AGENTS.md). Implement a review-then-approve workflow where the agent proposes changes but waits for user confirmation. For automated cron jobs, generate a summary report for user review rather than auto-committing changes.
MEDIUM Unbounded Session Scanning Could Cause Resource Exhaustion Resource Abusellm

The instruction to 'scan all sessions from last 24h' has no bounds on session count, size, or processing time. If a user has hundreds of sessions or very large session logs, this could cause excessive CPU/memory usage or timeout issues. The hourly snapshot feature compounds this by running 24 times per day.

SKILL.md

'Scan all sessions from last 24h' with no limits on session count or size, plus 'Every hour, append a brief summary' (24x daily)
Remediation: Add explicit limits: maximum number of sessions to review, maximum session size, timeout for review operations. Implement pagination or sampling for large session sets. Add resource usage monitoring and graceful degradation.
MEDIUM Git Auto-Commit Creates Audit Trail Manipulation Risk Command Injectionllm

The skill automatically commits changes with a generic message 'compound: daily review YYYY-MM-D' without detailed change descriptions. This could mask malicious modifications to instruction files. Combined with the 'commit and push changes' directive, unauthorized changes could be propagated to remote repositories without user awareness.

SKILL.md

'Commit changes with message "compound: daily review YYYY-MM-D"' and 'Commit and push changes' in automated workflow
Remediation: Generate detailed commit messages that list specific changes made. Require user review of git diff before committing. Separate commit from push operations - allow local commits but require explicit user action to push to remote. Implement change approval workflow.
MEDIUM Misleading Description Omits Autonomous Modification Risks Social Engineeringllm

The skill description emphasizes benefits ('make your agent smarter every day') but does not disclose that it autonomously modifies critical instruction files (MEMORY.md, AGENTS.md) and commits changes to git without user oversight. Users may not realize they are authorizing automated modification of files that control agent behavior.

SKILL.md

Description: 'Make your AI agent learn and improve automatically' - does not mention autonomous file modification, git commits, or lack of user confirmation
Remediation: Update description to explicitly state: 'Automatically modifies instruction files (MEMORY.md, AGENTS.md) and commits changes to git. Runs autonomously via cron without user confirmation.' Add security warnings about the risks of autonomous instruction modification.

What is in the package

FileKindSize
SKILL.mddoc6.6 KB
package.jsonconfig598 B

External hosts referenced

github.com x.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Scan history

DateVerdictFindingsChangeAnalyzersRaw
HIGH 5 +1 static behavioral llm trigger meta JSON
SAFE 4 first scan static behavioral llm trigger meta JSON

Sources

Related skills