The Agent Skills Directory

[COMMAND_EXECUTION]: The evaluate-session.sh script executes local shell commands (grep, jq, mkdir, sed) to validate session length and manage storage directories for learned skills.
[PROMPT_INJECTION]: The skill directs the agent to analyze session transcripts (conversation history) to extract reusable patterns and create new skills. This creates a surface for indirect prompt injection where malicious instructions embedded in a previous conversation could influence the agent's behavior during the 'learning' process.
Ingestion points: The agent reads conversation transcripts containing untrusted user-supplied data from previous interactions.
Boundary markers: Absent; the skill instructions do not provide delimiters or specific warnings to the agent to ignore instructions found within the transcript data.
Capability inventory: The agent utilizes file system tools (read_file, write_file) to analyze transcripts and save new skill files to ~/.claude/skills/learned/.
Sanitization: Absent; there is no mechanism provided to sanitize or filter the transcript content before the agent processes it for 'learning'.
[DATA_EXFILTRATION]: The skill programmatically accesses session transcripts located in ~/.claude/transcripts/. These files contain the complete history of user sessions, which may include sensitive data, credentials, or private information disclosed during interactions.

continuous-learning