continuous-learning-v2

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most links are GitHub-hosted (generally low-risk when from reputable, well-reviewed repos), but there are high-risk indicators among these: an embedded "ghp_xxxx@github.com" URL (exposes/uses a token and is suspicious), several bare .git remotes for unknown accounts (can distribute unreviewed binaries), and a non-GitHub example.com .git host — so the set as a whole is potentially unsafe without verification of each repo/source.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The observer intentionally sends local session observations to an external LLM (claude/haiku) and grants it autonomous Read/Write tool access (including a prompt that orders it to write files without confirmation), creating clear data-exfiltration and remote-file-write/backdoor risks.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via hooks/observe.sh → agents/observer-loop.sh where tool input/output from Claude Code sessions are written to observations.jsonl and then the observer reads the recent JSONL lines and embeds them into the Haiku prompt (tail ... "$OBSERVATIONS_FILE" > "$analysis_file" and Read ${analysis_file} ...), and those tool I/O may include arbitrary user/third-party text (e.g., messages/comments or scraped content) that the operating user did not author.