The Agent Skills Directory

[PROMPT_INJECTION]: The background observer agent is explicitly instructed in agents/observer-loop.sh to bypass user confirmation when performing file operations. Instructions such as "Do NOT ask for permission to write files" and "write or update the instinct file in this run instead of asking for confirmation" are concealment patterns that reduce user oversight and override standard safety protocols for autonomous tool use.\n- [REMOTE_CODE_EXECUTION]: The skill's architecture involves an autonomous background loop that generates and writes files to the local filesystem (instincts/personal/) based on session history. The input data used for this generation (observations.jsonl) contains raw output from various tools. This creates an indirect prompt injection attack surface where malicious tool outputs could manipulate the background agent into writing dangerous content or configuration files.\n- [EXTERNAL_DOWNLOADS]: The management utility scripts/instinct-cli.py includes a command to import instincts from arbitrary remote URLs using urllib.request.urlopen. This allows the ingestion of un-vetted external content into the agent's behavioral library without integrity checks.\n- [DATA_EXFILTRATION]: The skill records extensive logs of tool inputs and outputs, which may contain sensitive information. While a regex-based secret scrubber is used to protect credentials, these logs are subsequently transmitted to an external LLM provider for analysis. This creates a risk of sensitive data exposure if the scrubbing logic is bypassed by non-standard credential formats.\n- [COMMAND_EXECUTION]: The skill relies on several shell scripts (observe.sh, start-observer.sh, observer-loop.sh) to manage its background state and invoke the claude CLI. These scripts handle file paths and environment variables derived from the local environment and project metadata, which could lead to unexpected command execution if project names or directory structures are maliciously crafted.

continuous-learning-v2