use-self-improving@1.0.1
VERIFIED· install onlyPublisher claims: "从本机已经整理好的项目、文件、知识和经验中查找旧信息，用户无需点名；收到目标和对象明确的任务时，会先按任务对象或领域、目标或动作、关键问题轻查可借鉴的相关经验。回答或开始工作可能受项目位置、文件总结、历史决定、稳定规则或相似故障经验影响时会自动只读查询；准备通过外部工具执行发送、发布、修改、删除、部署、授权、审批等操作，或外部工具结果异常、准备重试时，也会按工具、动作和关键对象轻查相关经验。适用于明确任务、“这个项目在哪、负责什么”“为什么以前这么做”“类似故障怎么处理”等自然问题及有外部影响的工具操作；会先用导航缩小候选，再核对原始文件或当前现场。找不到、证据不足或存在多个对象时会用普通话说明；全程只查不写，不新增、修改或删除知识库内容。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
No findings across 89 lines in 2 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.