self-improving-agent-extract
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands including
grep,sed, andpwdto programmatically access and search Claude's internal project memory storage located at$HOME/.claude/projects/. This behavior is central to the skill's purpose of extracting patterns from previous work but involves reading sensitive internal metadata files. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingest untrusted data from two sources:
- User-provided pattern descriptions
- Historical project memory entries found via
grepsearches - Capability Inventory: The skill creates new files, spawns sub-agents (
skill-extractor), and interacts with theclawhubpublishing tool. - Boundary Markers: There are no explicit instructions or delimiters defined to prevent the agent from obeying malicious instructions embedded within the memory entries it is processing.
- Sanitization: No sanitization or validation of the source text is performed before it is used to generate the new SKILL.md files.
Audit Metadata