continuous-learning-v2
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
instinct-cli.pyutility allows users to import instinct definition files from remote URLs usingurllib.request. This allows external content to be brought into the agent's learning system.\n- [COMMAND_EXECUTION]: The skill uses multiple shell scripts and Pythonsubprocesscalls to manage its lifecycle, including background process management (nohup), project detection viagit, and file system maintenance. This involves executing commands likegit rev-parse,git remote, and spawning sub-agent loops. The system also dynamically generates and updates markdown files representing learned behaviors (skills, commands, and agents) at runtime based on automated analysis of session history.\n- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface within its background learning loop. The observer agent processesobservations.jsonl, which contains raw tool outputs and user prompts. This data is interpolated into a prompt for a sub-agent tasked with creating new instructions.\n - Ingestion points:
observations.jsonl(captures tool inputs, outputs, and user prompts from active sessions viaobserve.sh).\n - Boundary markers: Not explicitly defined within the observation logs; data is interpolated into the observer's system prompt.\n
- Capability inventory: The background observer agent has
ReadandWritepermissions to analyze logs and persist new or updated instructions in theinstincts/directory.\n - Sanitization: The skill proactively scrubs common secret patterns (API keys, tokens, passwords) from tool I/O using regex before persisting them, but it does not filter the semantic content of observations for malicious injection attempts.
Audit Metadata