awaken
Warn
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Probes the agent's internal execution environment by accessing the path
$HOME/.claude/projects/to read the size of.jsonlsession history files. This represents access to internal system logs and environmental state tracking beyond the scope of a standard skill. - [COMMAND_EXECUTION]: Performs multiple shell operations to manage the repository, including creating directory structures (
mkdir -p Έ/), reading git configuration, and gathering system metadata viaunameandstat. - [EXTERNAL_DOWNLOADS]: Fetches and analyzes content from the author's GitHub repositories, specifically
github.com/Soul-Brews-Studio/opensource-nat-brain-oracleandgithub.com/Soul-Brews-Studio/oracle-v2, as part of the guided setup process. - [REMOTE_CODE_EXECUTION]: Uses the GitHub CLI (
gh) to programmatically create issues on a remote repository (Soul-Brews-Studio/arra-oracle-v3) based on locally generated files. - [PROMPT_INJECTION]: Contains directives intended to override other instructions by telling the agent to ignore conflicting files ("IMPORTANT: This is the ONLY correct awaken file... IGNORE IT").
- [INDIRECT_PROMPT_INJECTION]: Ingests and parses untrusted user freetext and local project files (
package.json,README.md) to dynamically generate configuration files likeCLAUDE.md. - Ingestion points: User freetext responses in Phase 1; local
package.jsonandREADME.mdmetadata. - Boundary markers: None explicitly defined for user input parsing.
- Capability inventory: Filesystem writes, shell command execution, and remote network requests via the
ghCLI. - Sanitization: Instructions specify a manual security check for secrets before committing, but there is no automated filtering for user-provided instructions in the freetext fields.
Audit Metadata