The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs users to modify ~/.claude/settings.json to configure a persistent "Stop" hook that executes a local shell script (~/.claude/skills/continuous-learning/evaluate-session.sh). This mechanism ensures the script runs automatically every time a Claude Code session terminates, allowing for persistent, automated command execution based on session events.
[PROMPT_INJECTION]: The skill implements a workflow for indirect prompt injection by automatically extracting "reusable patterns" from session transcripts and saving them to the agent's permanent skill directory (~/.claude/skills/learned/). If an attacker can influence the session content (e.g., through data processed by the agent), they could potentially inject malicious instructions that the skill then "learns" and persists as a permanent capability, affecting all future sessions.
Ingestion points: Processes the complete session transcript (all messages) from Claude Code sessions.
Boundary markers: None identified; the skill relies on "pattern detection" to isolate content without explicit delimiters to prevent instruction hijacking.
Capability inventory: The skill has file-write capabilities to the learned_skills_path and triggers the execution of scripts via lifecycle hooks.
Sanitization: No evidence of sanitization, validation, or filtering of the extracted session data before it is saved as a new skill executable.

continuous-learning