continuous-learning-v2
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The background observer system (documented in 'agents/observer.md' and launched via 'agents/start-observer.sh') analyzes session logs stored in 'observations.jsonl'. These logs contain 'tool_output' fields which may capture untrusted data from external sources such as web content or file reads during a session. The observer agent processes this data without boundary markers or explicit instructions to ignore embedded commands, creating an attack surface where malicious content can influence the 'instincts' the system learns.\n
- Evidence Chain:\n
- Ingestion points: 'observations.jsonl' (recorded by 'hooks/observe.sh' from 'tool_input' and 'tool_output').\n
- Boundary markers: None used in the 'claude' CLI prompt in 'start-observer.sh' when passing the log file to the model for analysis.\n
- Capability inventory: The system can write '.yaml' and '.md' files to the local filesystem (under '~/.claude/homunculus/'), including definitions for new agents, skills, and commands.\n
- Sanitization: 'hooks/observe.sh' truncates tool inputs and outputs to 5000 characters, but no prompt-level escaping or validation is performed on the content before it is processed by the AI.\n- [DYNAMIC_EXECUTION]: The skill dynamically generates new AI agent, skill, and command definitions (markdown files with YAML frontmatter) in the 'evolved/' directory based on learned patterns. These generated files contain instructions and tool configurations (e.g., 'Read', 'Grep', 'Glob') that are subsequently processed and executed by the AI platform, effectively creating new executable capabilities from analyzed logs.\n- [EXTERNAL_DOWNLOADS]: The 'scripts/instinct-cli.py' utility includes an 'import' command that uses 'urllib.request.urlopen' to fetch 'instinct' definitions from arbitrary user-provided URLs. While this is a user-initiated action, it involves downloading and storing external YAML/Markdown content that directly influences the agent's behavior and local configuration.\n- [COMMAND_EXECUTION]: The system relies on background shell processes and executes various CLI tools ('git', 'claude') to perform project detection and manage the observation loop. The background execution of an AI agent ('haiku') to analyze untrusted logs without user oversight increases the risk of the system being manipulated into performing unintended file operations.
Audit Metadata