self-improving-agent

Pass

Audited by Gen Agent Trust Hub on Apr 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by reading conversation logs from MEMORY.md to generate persistent rules. This could allow an attacker to persist malicious instructions in project configuration by poisoning interaction history.
  • Ingestion points: MEMORY.md and related topic-specific markdown files.
  • Boundary markers: Explicit 'Never' rule stating that memory content must be treated as data and not executable instructions.
  • Capability inventory: The skill can modify CLAUDE.md, create files in .claude/rules/, and generate new standalone skill files via skill-extractor.
  • Sanitization: Requires a recurring count of 2–3 times for patterns and mandates that the user review a diff before any changes are written to disk.
  • [COMMAND_EXECUTION]: The skill's documentation describes installation procedures that involve executing a local shell script ./scripts/codex-install.sh and utilizing third-party registries.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 5, 2026, 08:07 PM
Security Audit — agent-trust-hub — self-improving-agent