Generating New Skills
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill establishes a process for the agent to ingest user-provided methodology and codify it into new, persistent instructions. This presents an indirect prompt injection risk.
- Ingestion points: The skill monitors user requests, workflow explanations (2+ occurrences), and explicit commands like 'remember this'.
- Boundary markers: The skill provides no instructions or delimiters to distinguish between safe workflows and potentially malicious instructions within the learned content.
- Capability inventory: The skill allows the agent to write new markdown files to the
.claude/skills/directory, which are then treated as authoritative instructions for future tasks. - Sanitization: There is no evidence of logic to sanitize, validate, or filter user input before it is transformed into a stored skill.
- [COMMAND_EXECUTION]: The skill documentation explicitly instructs the agent to use shell commands to manage its state.
- Evidence: The skill includes code blocks suggesting the execution of
npm run learn:trackandnpm run learn:recordto persist learned patterns.
Audit Metadata