continuous-learning-v2

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This code autonomously sends truncated session observations to a remote LLM (via the claude CLI) and explicitly instructs that LLM to create or update files on disk without asking the user, which enables covert data leakage of session contents and remote-driven file injection (a backdoor-like capability) even if not obviously intended as malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's import command (scripts/instinct-cli.py cmd_import) explicitly fetches arbitrary HTTP(S) URLs via urllib.request.urlopen and parses/writes the fetched content into local "instinct" files (and these instincts can be used by /evolve, /promote and other workflows to generate skills/commands/agents), so untrusted third‑party webpages can be ingested and materially influence agent behavior.