continuous-learning-v2

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This package is intentionally designed to capture full session/tool inputs and outputs via hooks and to send those observations to an external model (via the "claude" CLI) for analysis, creating a persistent background agent that writes/archives local files and can import/export/promote learned "instincts" — this creates a clear risk of unauthorized data exfiltration of potentially sensitive code/inputs and increased attack surface (persistent process, write/delete of local files), though I found no obvious obfuscated backdoor or direct remote shell/exec payloads.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's import flow (scripts/instinct-cli.py cmd_import) explicitly fetches arbitrary HTTP/HTTPS URLs via urllib.request.urlopen and parses them into instinct YAMLs which can be saved, promoted to global scope, and injected into sessions (session-start/evolved agents), meaning untrusted third‑party content from arbitrary web URLs can directly alter agent behavior.