skill-evolution
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill instructions direct users to modify their global agent settings (~/.claude/settings.json) to include hooks that run shell scripts (pre-tool.sh, post-bash.sh, post-tool.sh, session-end.sh) for every tool invocation and session termination, maintaining a persistent presence in the agent's workflow.
- [DYNAMIC_EXECUTION]: The session-end.sh script uses an inline Python block to trigger subprocess.run on a computed project-relative path (skills/skill-creator/scripts/skill_lint.py). This behavior occurs automatically based on project root detection (searching for .git or package.json), allowing for the execution of arbitrary code if a malicious file exists at that location.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests raw data from tool outputs and error messages ($TOOL_OUTPUT) through post-bash.sh and post-tool.sh. These ingestion points lack boundary markers. The data is stored in project-local JSONL logs and aggregated into markdown files (evolution-candidates.md), which the agent is instructed to read to propose skill patches, potentially allowing untrusted external content to influence agent recommendations.
- [COMMAND_EXECUTION]: The skill's operation depends on multiple shell scripts that execute commands to detect project structure, manage session identifiers in local files, and invoke python3 for data processing and aggregation within the runs/evolution directory.
Audit Metadata