Agent self-modifies at runtime

Agent or skill code rewrites its own source, manifest, system prompt, or tool registry at runtime. Self-modification lets an agent escape its declared, reviewed configuration — and is especially dangerous when the written content derives from model output (a prompt-injection path into the agent’s own instructions). This is the SkillSpector rogue-agent self-modification class (RA2).

Phase-1 ships the AST fallback (a write to a self / manifest / system-prompt path) at reduced confidence; the Phase-1.5 TaintFlowDetector upgrades it to flow-confirmed (LLM output → self-config write). Writes to ordinary data / output paths produce no finding. Scoped to agent/skill artefacts.

Writing to an ordinary output path (open("report.json", "w")) produces no finding.