continuous-learning-v2

Warn

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of system commands for project identification, file management, and process control.
  • Evidence: scripts/detect-project.sh and hooks/observe.sh invoke git, find, du, mv, kill, and nohup through shell scripts.
  • Evidence: scripts/instinct-cli.py uses the subprocess.run module to execute git commands for metadata retrieval.
  • [EXTERNAL_DOWNLOADS]: The CLI tool contains functionality to fetch data from arbitrary remote sources.
  • Evidence: The import command in scripts/instinct-cli.py utilizes urllib.request.urlopen to download instinct definitions from URLs provided as arguments.
  • [REMOTE_CODE_EXECUTION]: The skill provides a pathway where untrusted remote data can be transformed into executable agent instructions.
  • Evidence: The evolve command in scripts/instinct-cli.py generates SKILL.md and agent definition files based on processed instincts. If these instincts originate from the remote import functionality, it allows external content to define future agent behavior.
  • [DATA_EXFILTRATION]: The skill persistently logs all tool inputs and outputs, creating a high-value dataset of user session activity.
  • Evidence: hooks/observe.sh captures tool_input and tool_output from every interaction and appends the data to observations.jsonl files.
  • Evidence: While the skill includes a secret-scrubbing regex (_SECRET_RE), this method is not foolproof and may fail to redact sensitive information contained within complex data structures.
  • [PROMPT_INJECTION]: The automated learning mechanism is vulnerable to indirect prompt injection from data processed during agent sessions.
  • Ingestion points: observations.jsonl (populated by hooks/observe.sh from tool outputs).
  • Boundary markers: None identified in the evolved structures generated by the skill.
  • Capability inventory: Shell command execution via subprocess.run, file-writing, and background process management.
  • Sanitization: Includes a regex-based scrubber to redact common secret patterns like API keys and tokens.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 23, 2026, 03:50 AM