continuous-learning-v2

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The instinct-cli.py utility allows users to import instinct definition files from remote URLs using urllib.request. This allows external content to be brought into the agent's learning system.\n- [COMMAND_EXECUTION]: The skill uses multiple shell scripts and Python subprocess calls to manage its lifecycle, including background process management (nohup), project detection via git, and file system maintenance. This involves executing commands like git rev-parse, git remote, and spawning sub-agent loops. The system also dynamically generates and updates markdown files representing learned behaviors (skills, commands, and agents) at runtime based on automated analysis of session history.\n- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface within its background learning loop. The observer agent processes observations.jsonl, which contains raw tool outputs and user prompts. This data is interpolated into a prompt for a sub-agent tasked with creating new instructions.\n
  • Ingestion points: observations.jsonl (captures tool inputs, outputs, and user prompts from active sessions via observe.sh).\n
  • Boundary markers: Not explicitly defined within the observation logs; data is interpolated into the observer's system prompt.\n
  • Capability inventory: The background observer agent has Read and Write permissions to analyze logs and persist new or updated instructions in the instincts/ directory.\n
  • Sanitization: The skill proactively scrubs common secret patterns (API keys, tokens, passwords) from tool I/O using regex before persisting them, but it does not filter the semantic content of observations for malicious injection attempts.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 12:20 AM
Security Audit — agent-trust-hub — continuous-learning-v2