learn
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to distill lessons from user conversations into a permanent skill library via the
stage_skilltool. This creates a surface where a malicious user could provide input designed to be 'learned' as a new rule or instruction, potentially leading to persistent behavioral manipulation across sessions. - Ingestion points: The entire conversation history is processed to identify reusable lessons (SKILL.md).
- Boundary markers: The instructions do not explicitly mandate sanitization or the use of boundary markers when quoting 'evidence' from the session into the staged skill.
- Capability inventory: The skill uses the
stage_skilltool which can modify the agent's underlying instruction set. - Sanitization: The skill relies on an external 'deterministic promoter' to validate and land changes, which serves as a security control against malicious or improper skill proposals.
Audit Metadata