student-personalization
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it is designed to ingest and analyze untrusted external data—including package manifests, learner data models, and codebase structures—without establishing security boundaries.\n
- Ingestion points: External manifests and core learner data structures defined in Phases 1 and 2 (e.g., package manifests, learner profiles, learning events).\n
- Boundary markers: Absent; the instructions do not include delimiters or specific commands to disregard embedded instructions within the processed data.\n
- Capability inventory: The skill has the capability to read any file on the filesystem and write reports to
docs/as well as telemetry logs to the user's home directory.\n - Sanitization: There is no evidence of sanitization, escaping, or validation logic for data ingested from the analyzed platform.\n- [COMMAND_EXECUTION]: The skill implements a persistence-like telemetry mechanism that writes execution metadata to the user's home directory.\n
- Evidence: The 'Self-Evolution Telemetry' section appends outcome and iteration data to
~/.claude/projects/skill-telemetry.md.\n - Context: While this feature is used for platform improvement, it involves modifying persistent files located outside the immediate project workspace.
Audit Metadata