self-awareness
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill enables the agent to execute SQLite queries against its internal metadata database using the host.query() function within the repl tool environment.
- [REMOTE_CODE_EXECUTION]: The documentation includes SDK functions that trigger host-side actions, such as host.llm for model completions and host.delegate for initiating sub-agent processes.
- [PROMPT_INJECTION]: The skill identifies ingestion points for historical session data, which can serve as a surface for indirect prompt injection if the agent processes previous instructions or code outputs as current directives. 1. Ingestion points: Access to conversation history (frames table) and execution records (execution_log table) via SQL queries in SKILL.md. 2. Boundary markers: No delimiters or boundary markers are defined to isolate historical data from the current execution context. 3. Capability inventory: The agent has access to powerful tools including python, bash, and sub-agent delegation. 4. Sanitization: There is no mention of sanitization or filtering for data retrieved from the internal database.
Audit Metadata