learning-recommendations

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through the processing of untrusted recommendation data.
  • Ingestion points: The script scripts/present-recommendations.py loads and parses JSON files from ~/.claude/learning-recommendations/.
  • Boundary markers: The data is interpolated directly into AskUserQuestion structures without boundary markers, delimiters, or instructions for the agent to ignore embedded commands.
  • Capability inventory: The skill is designed to perform high-impact actions based on this data, including 'Create script' for automation tasks and 'Update skill with new pattern' in SKILL.md.
  • Sanitization: No sanitization or escaping is performed on the title or description fields from the JSON. Maliciously crafted input could break the Python string formatting (e.g., using triple quotes) or contain instructions that the agent might follow when presenting the 'question' to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 09:45 AM
Security Audit — agent-trust-hub — learning-recommendations