continuous-learning-v2
Warn
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The background observer agent processes observations.jsonl, which contains raw output from tool executions. An attacker could potentially inject instructions into these logs (e.g., via malicious file content read by a tool) to manipulate the learning process.\n
- Ingestion points: ~/.claude/homunculus/projects//observations.jsonl (written by hooks/observe.sh).\n
- Boundary markers: Absent. Tool outputs are appended to the JSONL log without delimiters or instructions to ignore embedded commands.\n
- Capability inventory: agents/start-observer.sh spawns a Claude agent with permission to write files to the filesystem (instincts/personal/). instinct-cli.py can create and modify markdown/YAML files.\n
- Sanitization: Absent. Tool inputs and outputs are truncated but not sanitized or escaped before being processed by the background agent.\n- [EXTERNAL_DOWNLOADS]: Remote Behavior Ingestion. The instinct-cli.py script includes an import command that can fetch behavioral instincts from arbitrary URLs (urllib.request.urlopen). These instincts are YAML/Markdown files that directly define the agent's future logic and constraints.\n- [DATA_EXFILTRATION]: Local Sensitive Data Exposure. The hooks/observe.sh script logs the input and output of every tool call to observations.jsonl. This design creates a high risk of capturing sensitive data, such as API keys from .env files or private keys from .ssh directories, in plain text within the local filesystem.\n- [COMMAND_EXECUTION]: Shell Command Execution. Multiple scripts (scripts/conflict-detector.py, scripts/instinct-cli.py, agents/start-observer.sh) use subprocess.run or shell backticks to execute system commands, git operations, and background loops. While some variables are passed via environment variables, the broad use of shell commands for project detection and background processing increases the potential for command injection if environment state or git outputs are manipulated.
Audit Metadata