self-improve
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from past session transcripts to extract durable lessons.
- Ingestion points: Reads conversation history from .jsonl files in ~/.claude/projects/ (via references/transcript-miner.md).
- Boundary markers: The skill relies on subagents to filter data but does not employ formal sanitization or isolation for instructions potentially embedded in processed transcripts.
- Capability inventory: The skill can create new skills (/create-skill), update project configuration files (CLAUDE.md, AGENTS.md), and modify the project's auto-memory.
- Sanitization: No explicit escaping or filtering of extracted transcript text is performed before proposing updates.
- [DYNAMIC_EXECUTION]: The skill executes embedded Python and Bash scripts to parse local transcript files.
- Execution method: Scripts are passed to interpreters (e.g., python3 -) using heredocs within the references/transcript-miner.md reference file.
- Purpose: This execution is used for mining and formatting conversation data from session logs.
- [DATA_EXFILTRATION]: Accesses session transcripts on the local filesystem.
- Sensitive paths: Reads .jsonl files in ~/.claude/projects/ or the directory defined by CLAUDE_CONFIG_DIR.
- Content: These files contain full conversation histories.
- Context: This access is central to the skill's purpose of extracting insights from previous interactions.
Audit Metadata