skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/continuous-learning-construction/Gen Agent Trust Hub
continuous-learning-construction
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a continuous learning pipeline that extracts patterns and solutions from session logs (
session_loginSKILL.md). - Ingestion points: The agent context absorbs session logs and user-provided inputs as defined in
instructions.mdand theConstructionLearningPipelineclass. - Boundary markers: While the
_validate_patternmethod inSKILL.mdchecks for confidence scores and code validity, it does not include explicit delimiters or instructions to ignore embedded malicious prompts within the session data. - Capability inventory: The skill possesses
filesystemandnetworkpermissions (claw.json), allowing it to persist learned patterns to a local knowledge base and interact with external project management APIs. - Sanitization: The skill performs basic structure validation and code snippet checking but lacks comprehensive sanitization for natural language instructions that could be re-injected into future sessions.
- [COMMAND_EXECUTION]: The skill includes operational commands such as
/learn,/add-pattern, and/export-kb(SKILL.md), which trigger the execution of file system and data processing logic. - [DATA_EXFILTRATION]: The skill includes functionality to export its internal knowledge base (
/export-kb) and provides patterns for integrating with external APIs like Procore (SKILL.md). These operations handle project-specific data, though they align with the skill's stated purpose of knowledge preservation.
Audit Metadata