The Agent Skills Directory

[PERSISTENCE]: The skill installs a nightly cron job using the schedule command, which ensures the self-improvement engine runs automatically at a specified time (default 3:17 AM). This allows for periodic, automated execution without user oversight.
[DATA_EXFILTRATION]: The skill reads sensitive local files including ~/.claude/history.jsonl and session logs within ~/.claude/projects/. These files contain the full history of user interactions and agent outputs. The skill 'harvests' this data and, depending on the configured backend (e.g., Claude or Codex), may transmit distilled versions of this history to external model providers.
[COMMAND_EXECUTION]: The skill relies on shell scripts and Python modules to perform its operations, invoking sleep.sh for status, dry-runs, and execution, as well as python -m skillopt_sleep.experiments.run_experiment for validation.
[DYNAMIC_EXECUTION]: The skill is designed to automatically generate and stage modifications to the agent's core instruction and memory files (SKILL.md and CLAUDE.md). While it includes a staging and review process, the existence of an --auto-adopt flag allows for these instructions to be overwritten without manual verification.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection. It ingests untrusted past session transcripts which could contain malicious instructions. These are then used to 'reflect' and generate new agent instructions. Evidence chain:
Ingestion points: ~/.claude/history.jsonl and project session files (SKILL.md).
Boundary markers: No explicit boundary markers or security-focused sanitization is mentioned for the harvested transcript content.
Capability inventory: The skill can execute shell scripts, install persistence (cron), and modify its own instructions (SKILL.md/CLAUDE.md).
Sanitization: The 'held-out validation gate' is described as an accuracy check, not a security filter for malicious instruction content.
[METADATA_POISONING]: The skill documentation references official Microsoft documentation for 'SkillOpt' and 'Claude Dreams'. While this may be for context, the skill is provided by an independent author, which could lead users to misattribute the safety and provenance of the tool to a trusted organization.

skillopt-sleep