aprende
Warn
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: MEDIUMPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill provides the
/aprende-enable-hookscommand which modifies the agent's global configuration file (~/.claude/settings.json) to installPostToolUseandStophooks. This configuration ensures that the skill's signal collection logic executes automatically after every tool use and at the end of each session. - [INDIRECT_PROMPT_INJECTION]: The skill scans conversation transcripts for specific patterns to generate new instructions and documentation (such as
CLAUDE.mdandAGENTS.md). This creates a vulnerability where malicious or deceptive content in a conversation could be promoted into the agent's permanent knowledge base and influence future sessions. - Ingestion points: Reads the full conversation history and internal signal files to extract learning candidates.
- Boundary markers: None implemented; detection relies on keyword matching within the raw transcript.
- Capability inventory: The skill has permissions to
Write,Edit, and useBashto modify local project files and global agent settings. - Sanitization: The skill relies on human-in-the-loop validation (Pass D) rather than programmatic sanitization to prevent the persistence of malicious data.
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to perform environment management tasks, such as creating project memory directories (mkdir -p), identifying the project path (pwd), and cleaning up session signal files.
Audit Metadata