learner
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill defines a workflow to ingest data from untrusted conversation history and persist it to the local filesystem in the form of 'expertise' or 'workflow' files (~/.claude/skills/ or .omc/skills/). This mechanism creates an indirect prompt injection surface.
- [PROMPT_INJECTION]: Mandatory Evidence Chain:
- Ingestion points: Conversation history and user-provided 'insights' (SKILL.md).
- Boundary markers: Absent. There are no markers or instructions used to delimit user data or warn the agent to ignore instructions embedded within the conversation during the extraction process.
- Capability inventory: The skill instructs the agent to write new markdown files to sensitive local directories (SKILL.md, Step 4).
- Sanitization: Absent. There is no evidence of content validation, escaping, or sanitization before the content is written to the filesystem.
Audit Metadata