self-learning
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill's primary function is to capture 'prevention rules'—instructions generated from past errors or user feedback—and inject them into future agent contexts. This creates an indirect prompt injection surface where malicious or erroneous instructions could be persisted in the agent's long-term memory (via the
sage-memoryMCP or local.sage-memory/files) and followed authoritatively in later sessions. - Ingestion points: Data enters the system from user corrections, tool output (error logs), and codebase files (e.g.,
package.json,pnpm-lock.yaml). - Boundary markers: The instructions lack explicit delimiters or sanitization protocols to prevent the agent from mistaking stored 'learnings' for system-level constraints during recall.
- Capability inventory: The skill possesses the ability to write to sensitive files (e.g.,
CLAUDE.md,AGENTS.md) and interact with persistent storage backends. - Sanitization: Although
references/team-sharing.mdincludes guidelines for stripping sensitive data like API keys before export, there are no automated mechanisms provided to validate the safety of the stored instructions.
Audit Metadata