capture-learnings
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to read and apply instructions from 'learnings.md' at the start of work, creating an indirect prompt injection surface. Malicious data captured as a 'learning' could influence future agent actions.
- Ingestion points: The agent reads 'learnings.md' from the project root.
- Boundary markers: There are no explicit instructions or delimiters to treat the content of the learnings file as untrusted or to ignore embedded commands.
- Capability inventory: The agent uses these learnings to modify its behavior across all future tasks, which could involve any available tools or file operations.
- Sanitization: No sanitization or validation of the input is performed before it is recorded into the learnings file.
- [DATA_EXFILTRATION]: The skill explicitly guides the agent to capture and store personally identifiable information (PII) such as emails, relationships, and personal habits. While no network exfiltration is present in the skill itself, the accumulation of sensitive data in a predictable local file increases the risk of data exposure if the agent or environment is otherwise compromised. The skill correctly identifies that 'learnings.md' should be gitignored to prevent accidental public exposure.
Audit Metadata