continuous-learning-v2
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs users to modify their global agent settings to execute the
hooks/observe.shscript automatically during the PreToolUse and PostToolUse stages of every tool call. - [DATA_EXFILTRATION]: The skill captures the content of all tool inputs and outputs in
~/.claude/homunculus/observations.jsonl. This session history, which can include sensitive data such as API keys or private source code, is subsequently sent to the LLM provider for pattern analysis via theclaudeCLI. - [EXTERNAL_DOWNLOADS]: The
instinct-cli.pyutility includes an import feature that fetches behavioral patterns from arbitrary user-provided URLs using theurllib.requestlibrary. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because the background observer agent processes logs containing potentially untrusted tool outputs. Evidence: 1. Ingestion points:
observations.jsonl(generated byhooks/observe.sh). 2. Boundary markers: Absent. 3. Capability inventory:claudeCLI execution and file writing across all agent scripts. 4. Sanitization: Absent; the system only performs length truncation.
Audit Metadata