The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes historical session logs which contain untrusted data from previous user interactions. Malicious content within these logs could influence the subagents' actions during the audit and adaptation phases. Ingestion points: Historical session JSONL files are read from ~/.claude/projects/ and ~/.pi/agent/sessions/ (SKILL.md, Step 2). Boundary markers: The system does not appear to use explicit safety delimiters or 'ignore' warnings when feeding excerpts from these logs into the analyst or adapter prompts. Capability inventory: The waste-adapter subagent possesses Edit, Write, and Bash tools, allowing for the modification of agent definitions, skills, tools, and global rules (agents/adapter.md). Sanitization: No specific prompt injection filtering is performed on the historical log content before it is processed by the LLM subagents.
[DYNAMIC_EXECUTION]: The skill implements an autonomous self-modification loop where the waste-adapter subagent generates and applies changes to the agent's own instruction sets, skills, and tools at runtime. (Evidence: SKILL.md Phase 2, agents/adapter.md)
[PRIVILEGE_ESCALATION]: The waste-adapter subagent is granted the authority to modify high-impact configuration files, including global behavioral rules (~~/AGENTS.md) and agent definitions (~~/.claude/agents/), which effectively controls the agent's security constraints and operational capabilities. (Evidence: agents/adapter.md Step 3, Step 7)
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute complex shell pipelines for identifying and processing session files. While used for auditing, the execution of shell scripts and Python tools on historical data presents a surface for potential misuse. (Evidence: SKILL.md Step 1, Step 2, Step 5b)

token-waste