skill-knowledge-work
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a 'Cross-Task Learnings' system that persists data across sessions and re-injects it into the prompt.
- Ingestion points: The skill instructs the agent to read JSON files from the
.claude-octopus/learnings/directory at the start of a session (SKILL.md). - Boundary markers: There are no instructions or delimiters specified to ensure the agent treats the injected learning content as low-trust data or ignores embedded instructions within the 'lesson' fields.
- Capability inventory: The skill is integrated with various workflows (
octo research,octo build,octo review) and agents (codex,strategy-analyst), providing multiple avenues where malicious instructions in a learning file could influence system behavior. - Sanitization: No sanitization or validation logic is defined for the content of the learning files before they are interpolated into the agent's token budget.
Audit Metadata