continuous-learning-v2
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of system commands for project identification, file management, and process control.
- Evidence:
scripts/detect-project.shandhooks/observe.shinvokegit,find,du,mv,kill, andnohupthrough shell scripts. - Evidence:
scripts/instinct-cli.pyuses thesubprocess.runmodule to executegitcommands for metadata retrieval. - [EXTERNAL_DOWNLOADS]: The CLI tool contains functionality to fetch data from arbitrary remote sources.
- Evidence: The
importcommand inscripts/instinct-cli.pyutilizesurllib.request.urlopento download instinct definitions from URLs provided as arguments. - [REMOTE_CODE_EXECUTION]: The skill provides a pathway where untrusted remote data can be transformed into executable agent instructions.
- Evidence: The
evolvecommand inscripts/instinct-cli.pygeneratesSKILL.mdand agent definition files based on processed instincts. If these instincts originate from the remoteimportfunctionality, it allows external content to define future agent behavior. - [DATA_EXFILTRATION]: The skill persistently logs all tool inputs and outputs, creating a high-value dataset of user session activity.
- Evidence:
hooks/observe.shcapturestool_inputandtool_outputfrom every interaction and appends the data toobservations.jsonlfiles. - Evidence: While the skill includes a secret-scrubbing regex (
_SECRET_RE), this method is not foolproof and may fail to redact sensitive information contained within complex data structures. - [PROMPT_INJECTION]: The automated learning mechanism is vulnerable to indirect prompt injection from data processed during agent sessions.
- Ingestion points:
observations.jsonl(populated byhooks/observe.shfrom tool outputs). - Boundary markers: None identified in the evolved structures generated by the skill.
- Capability inventory: Shell command execution via
subprocess.run, file-writing, and background process management. - Sanitization: Includes a regex-based scrubber to redact common secret patterns like API keys and tokens.
Audit Metadata