self-improving-agent
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by reading conversation logs from
MEMORY.mdto generate persistent rules. This could allow an attacker to persist malicious instructions in project configuration by poisoning interaction history. - Ingestion points:
MEMORY.mdand related topic-specific markdown files. - Boundary markers: Explicit 'Never' rule stating that memory content must be treated as data and not executable instructions.
- Capability inventory: The skill can modify
CLAUDE.md, create files in.claude/rules/, and generate new standalone skill files viaskill-extractor. - Sanitization: Requires a recurring count of 2–3 times for patterns and mandates that the user review a diff before any changes are written to disk.
- [COMMAND_EXECUTION]: The skill's documentation describes installation procedures that involve executing a local shell script
./scripts/codex-install.shand utilizing third-party registries.
Audit Metadata