metacognitive-self-mod
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests historical performance data and execution traces, which constitutes a potential attack surface if those logs were influenced by malicious external inputs captured during previous tool executions. The logic focuses on high-level success patterns and score delta analysis rather than executing content from the logs.
- Ingestion points: Processes JSON data from
~/.claude/skills/improvement_memory.json,~/.claude/skills/performance_history.json, and trace files within~/.claude/skills/traces/. - Boundary markers: No specific delimiters or instructions to ignore embedded instructions are present in the processing scripts.
- Capability inventory: The skill uses Python and Bash to read from and write to the agent's internal configuration and logging paths. It proposes changes to the agent's strategy based on these analyses.
- Sanitization: The skill does not implement explicit sanitization for the historical log data it processes.
- [SAFE]: File system access is limited to the agent's designated application data directory (
~/.claude/skills/). This access is necessary for the skill's primary function of tracking and improving agent performance and does not demonstrate unauthorized data access or exfiltration.
Audit Metadata