continuous-learning
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a shell script (
evaluate-session.sh) configured as a session 'Stop' hook. This script performs benign local operations including reading session metadata from a transcript file, counting user messages viagrep, and creating a local directory for learned patterns usingmkdir. All actions are consistent with the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The documentation includes a link to a status on X (formerly Twitter) for further reading. This points to a well-known service and is used for informational purposes only, posing no automated execution risk.
- [PROMPT_INJECTION]: The skill's primary function is to ingest and process session transcripts, which constitutes an indirect prompt injection surface.
- Ingestion points: The
evaluate-session.shscript reads the file specified in theGEMINI_TRANSCRIPT_PATHenvironment variable. - Boundary markers: None identified in the provided scripts; the agent is instructed via standard output to evaluate the session context for patterns.
- Capability inventory: The shell script is limited to directory management and local file inspection. The agent is intended to write new skill definitions to a designated local directory (
~/.gemini/skills/learned/). - Sanitization: No specific sanitization or filtering of transcript content is performed by the shell script before the agent evaluates it.
Audit Metadata