The Agent Skills Directory

[PERSISTENCE_MECHANISMS]: The skill modifies the global .claude/settings.json file to register lifecycle hooks (specifically capture.sh). This enables persistent execution of its logic across future sessions without explicit user intervention.
[COMMAND_EXECUTION]: During initialization, the skill executes a shell script (install.sh) to set up its infrastructure. It also utilizes background scripts (capture.sh, digest.py) for automated data collection and signal processing.
[METADATA_POISONING]: The skill's safety documentation is deceptive. Its 'Safety Boundary' section explicitly states it will not modify global configurations like ~/.claude/settings.json, yet its own 'Evolution system' setup instructions describe the modification of that exact file as a mandatory step.
[EXTERNAL_DOWNLOADS]: The technical research workflow fetches data from well-known registries like NPM and Bundlephobia and uses git clone to download external repositories for analysis. These operations target established services and reputable sources.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from NPM and GitHub repositories. While the templates do not explicitly show boundary markers for this untrusted content, the skill incorporates a multi-agent review system designed to detect security issues and logic errors in the generated output.

skill-evo