recovery-metrics
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and evaluate content from untrusted codebases.
- Ingestion points: System discovery phases read package manifests, core data structures, and clinical integration points from the codebase (SKILL.md).
- Boundary markers: The instructions do not define delimiters or specific 'ignore' markers to prevent the agent from following instructions embedded within the analyzed code.
- Capability inventory: The skill has the ability to read arbitrary files in the codebase and write findings to both the 'docs/' directory and a hidden telemetry path.
- Sanitization: No sanitization or validation logic is specified for the data ingested during the discovery and evaluation phases.
- [DATA_EXFILTRATION]: The 'Self-Evolution Telemetry' section instructs the agent to access and append metadata to '~/.claude/projects/skill-telemetry.md'. Accessing hidden directories within the user's home folder that are outside the immediate project workspace is a sensitive operation that can lead to the exposure of local system configuration or project history.
Audit Metadata