auto-improvement
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a self-improvement cycle that ingests external data and persists it into long-term memory files, which are then used to influence future agent logic.
- Ingestion points: The skill explicitly tracks 'user corrections', 'project context' from files like package.json, and 'environmental triggers' from specific file types.
- Boundary markers: There are no instructions for sanitizing or delimiting data before it is written to the memory files (
memory/learned-patterns.md,memory/user-preferences.md, etc.). - Capability inventory: The skill performs repeated file-write operations to the local file system to store learned patterns and guardrails.
- Sanitization: The skill lacks validation or filtering for the 'user corrections' or 'learned patterns', allowing potentially malicious instructions to be persisted into the agent's long-term operational memory.
- [PROMPT_INJECTION]: The instructions use assertive language to override the agent's operational autonomy and safety constraints regarding skill activation.
- Override markers: The skill states, 'This skill is ALWAYS active. It runs automatically on every session and cannot be disabled,' and 'Do NOT skip error logging. Do NOT skip metric collection. These are mandatory.' These are directives intended to bypass the agent's ability to ignore or disable the skill's logic.
Audit Metadata