continuous-learning-v2

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most are ordinary Git remote URLs (not direct executables) hosted on GitHub or a placeholder domain, but the generic/placeholder usernames (test, user, example.com) and—critically—the embedded credential form "ghp_xxxx@github.com" are red flags (exposed token/credentials and unknown accounts) so treat these as moderately high risk until the repo owners and token usage are verified.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code intentionally sends local session observations to an external LLM (via the claude CLI) and grants that LLM Read/Write tool access to create instinct files under project/global directories—this is a deliberate data-exfiltration and remote-write pattern (combined with lazy/background observer startup and only heuristic secret-scrubbing) that could leak sensitive data and allow remote-generated content to create persistent files/backdoors if abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). At runtime, the observer background agent (agents/observer-loop.sh → claude --model haiku ... < "$prompt_file") reads analysis_file created from tail -n ... "$OBSERVATIONS_FILE"; OBSERVATIONS_FILE is populated by hooks/observe.sh from Claude Code hook JSON that includes tool input/output strings, which can contain outsider-authored free text (e.g., tool outputs from external sources) and is then ingested into the LLM via the generated prompt.