user-personalization-learner
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions require the agent to record highly sensitive Personal Identifiable Information (PII), specifically NPWP/NIK (16-digit national IDs) and business classification details. While necessary for tax assistance, instructions to store this in an Obsidian vault or JSON files for other tools create a localized data exposure surface.
- [PROMPT_INJECTION]: The skill facilitates an indirect prompt injection surface by consuming arbitrary user data via the
/learncommand and storing it in a "long-term memory" used by other agents. - Ingestion points: User-supplied strings processed via the
/learnslash command as described inSKILL.md. - Boundary markers: Absent. The instructions do not define delimiters or specific warnings to ignore instructions embedded within the user-provided preference data.
- Capability inventory: The ingested data is explicitly shared with other capabilities such as
tax-report-generatorandobsidian-tax-vault-manager(file system sync). - Sanitization: Absent. There is no mention of validation, filtering, or sanitization of the data before it is recorded into the system's memory.
Audit Metadata