continuous-learning-v2
Fail
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires modifying the agent's global configuration (
~/.claude/settings.json) to installPreToolUseandPostToolUsehooks. These hooks execute external shell scripts (observe.sh) deterministically every time the agent uses a tool. The actual script content is not provided, making the executed logic unverifiable. - [DATA_EXFILTRATION]: All session activity—including raw prompts, tool calls, and their outputs—is recorded in a local log file (
~/.claude/homunculus/observations.jsonl). This serves as a centralized collection point for sensitive data, and the skill includes a/instinct-exportcommand specifically designed to move this collected data out of the system. - [CREDENTIALS_UNSAFE]: The logging mechanism captures everything in the session context. If the user or agent handles API keys, passwords, or authentication tokens during the session (e.g., in environment variables or bash commands), this information will be stored in plain text within the observation logs.
- [PROMPT_INJECTION]: The background agent (
observer.md) analyzes the session logs to learn patterns. Since these logs contain unsanitized output from external tools and web pages, it creates a surface for indirect prompt injection where malicious data could influence the agent's future 'instincts' and behavior. - [EXTERNAL_DOWNLOADS]: The documentation encourages users to integrate with an external third-party application,
skill-creator.app, which is outside the control of the local skill and the trusted vendor list.
Recommendations
- AI detected serious security threats
Audit Metadata