task-observer
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on multiple Bash snippets and Python scripts (
migrate-log.py,new-observation.sh,validate-skill-bundle.py) to automate log management, ID generation, and skill validation. These scripts are invoked by the agent to maintain the workspace and provide structural enforcement for its data-logging rules. - [EXTERNAL_DOWNLOADS]: The
skill-authoring.mdreference specifies a protocol for 'feedback pre-flight' that usescurlto fetch the 'upstream HEAD' of files from GitHub repositories (e.g., github.com/rebelytics/*) for comparison. This is intended to ensure local changes are verified against the latest official source before submitting contributions. - [PERSISTENCE]: The
weekly-review.mdprocedure includes a process for setting up scheduled review tasks using system-level schedulers such ascronon Unix,launchdon macOS, or WindowsTask Scheduler. This mechanism allows the skill's review logic to persist and run periodically as a background task. - [INDIRECT_PROMPT_INJECTION]: As a meta-skill that analyzes other skills and project metadata (like
CLAUDE.md), it possesses a significant data ingestion surface for external/untrusted content. However, the skill provides clear guidance on using boundary markers (YAML frontmatter) and structural verification steps to mitigate the risk of accidental instruction obedience.
Audit Metadata