skill-optimizer-lawvable
Warn
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection (LOW): The skill is designed to modify instructions in
SKILL.mdbased on conversation history, creating a vector where malicious inputs could be permanently integrated into the agent's behavior. \n - Ingestion points: User feedback signals detected in the current conversation (SKILL.md, Step 2). \n
- Boundary markers: Absent. The skill scans the entire chat for keywords like "No" or "Always do X". \n
- Capability inventory: Writing updates to
SKILL.md,CHANGELOG.md, andOBSERVATIONS.md. \n - Sanitization: Lacks automated sanitization; relies on manual user approval and natural language quality criteria.\n- Command Execution (MEDIUM): The skill uses the
self-improve onandself-improve offtriggers to directly executermandtouchshell commands for state management. While limited to the skill directory, this demonstrates a capability for unconstrained local file operations.\n- Persistence (MEDIUM): The documentation encourages users to modify their global.claude/settings.local.jsonto include astophook pointing toself-improve-hook.sh. This establishes a persistent execution mechanism where the skill's analysis logic runs automatically at the end of every agent session.
Audit Metadata