self-improving-agent
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill captures user-supplied messages, tool inputs, and error responses to enable long-term learning. As described in the
SKILL.md(Section 3: Session Start Review), these logs are re-presented to the agent in subsequent sessions. This creates an attack surface where malicious instructions embedded in a processed file or a 'correction' could persist and influence the agent's behavior in future sessions. - Ingestion points: The scripts
capability-tracker.js,correction-detector.js, andenhanced-failure-logger.jsingestuser_message,assistant_response, andtool_inputvia standard input hooks. - Boundary markers: There are no explicit delimiters or 'ignore embedded instructions' warnings mentioned for the re-injection phase at session start.
- Capability inventory: The skill performs file writes to the
~/.claude/logs/directory and is intended to be invoked via shell hooks. - Sanitization: The scripts use
JSON.stringifyfor logging and perform basic string truncation, but they do not sanitize the content for prompt injection markers or control tokens before re-injection into the agent's prompt context.
Audit Metadata