learn
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to ingest user corrections from an active conversation and incorporate them into persistent repository artifacts such as
SKILL.md,.agents/MEMORY.md, andAGENTS.md. This process creates an inherent surface for indirect prompt injection, as malicious user input could potentially be stored as durable guidance for future agent actions. - Ingestion points: User input is processed via the
learnskill inSKILL.mdto identify corrections or requirements. - Boundary markers: The skill instructions provide a manual sanitization layer by requiring the agent to "Restate the user's correction in neutral, reusable language" and perform a "Generalization test" before editing durable guidance.
- Capability inventory: The skill allows the agent to modify and optimize repository configuration, instruction files, and documentation.
- Sanitization: The agent is explicitly instructed to avoid overfitting to one example and to write rules as reusable behaviors rather than brittle anecdotes, which reduces the effectiveness of simple injection attempts.
Audit Metadata