continuous-learning-v2

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Several entries are either non-official/placeholder git endpoints or include embedded credentials (ghp_xxxx@github.com/) — the embedded token and unknown personal domains for .git repositories are high-risk indicators for credential exposure or malware distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code intentionally forwards local session observations to an external LLM (the claude CLI), including a prompt that instructs the model to create files, and also fetches and writes remote-imported content — this design creates clear data-exfiltration and remote-write/backdoor risk even if some scrubbing/guards exist.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The observer’s required runtime path reads user/session tool inputs/outputs from local observation files (populated directly from Claude Code hook stdin) and feeds sampled recent lines into an LLM for pattern detection, so outsider-authored text submitted through Claude Code sessions can be ingested without selecting a specific item first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). High-confidence: scripts/instinct-cli.py's import command fetches arbitrary HTTP(S) URLs at runtime (urllib.request.urlopen) and then parses/saves that remote content as "instinct" files which directly control agent behavior (e.g., references to source_repo like "https://github.com/...").