self-improvement
Pass
Audited by Gen Agent Trust Hub on May 26, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by design. It instructs the agent to capture untrusted data from the user (corrections) or external tools (error messages) and store them in logs that are intended to be 'promoted' to permanent project memory files like CLAUDE.md and AGENTS.md. These files define the agent's operational guidelines, and an attacker could use this loop to inject malicious instructions. \n
- Ingestion points: Captures user feedback ('No, that's wrong...') and external error logs in SKILL.md. \n
- Boundary markers: No explicit boundary markers or safety delimiters are specified for the logged content. \n
- Capability inventory: The skill utilizes file system writes and explicitly plans for these logs to be 'processed into fixes' and promoted to system-level instructions. \n
- Sanitization: There is no mention of sanitizing or validating the ingested content before it is written to the learning logs. \n- [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands such as 'mkdir -p .learnings' for environment setup and various 'grep' commands for reviewing and filtering logs. While these commands are standard for the skill's utility, they constitute intentional command execution triggered by the skill's instructions.
Audit Metadata