learning-recommendations
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through the processing of untrusted recommendation data.
- Ingestion points: The script
scripts/present-recommendations.pyloads and parses JSON files from~/.claude/learning-recommendations/. - Boundary markers: The data is interpolated directly into
AskUserQuestionstructures without boundary markers, delimiters, or instructions for the agent to ignore embedded commands. - Capability inventory: The skill is designed to perform high-impact actions based on this data, including 'Create script' for automation tasks and 'Update skill with new pattern' in
SKILL.md. - Sanitization: No sanitization or escaping is performed on the
titleordescriptionfields from the JSON. Maliciously crafted input could break the Python string formatting (e.g., using triple quotes) or contain instructions that the agent might follow when presenting the 'question' to the user.
Audit Metadata