learn
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted conversation history to extract "lessons learned" and writes them to persistent configuration files (e.g., CLAUDE.md, .cursorrules) or new skill files. This creates a surface where malicious instructions in a conversation could be promoted to permanent system instructions for future sessions.
- Ingestion points: Conversation history and user-supplied focus filters ($ARGUMENTS) in SKILL.md.
- Boundary markers: The skill lacks technical delimiters for the ingested conversation data, relying instead on the agent's analysis logic.
- Capability inventory: The skill possesses extensive file system capabilities across all its referenced scripts, including finding files (find, grep), reading configurations, and writing/creating Markdown, MDC, and JSON files.
- Sanitization: The skill implements a human-in-the-loop confirmation step (Step 6) and a rule audit process (Step 5) to minimize the risk of malicious or low-quality content being persisted.
Audit Metadata