The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a mechanism to ingest conversation history and store it in persistent configuration files, which could be exploited to inject malicious instructions.
Ingestion points: The skill extracts rules from the conversation history based on user-identified mistakes or corrections.
Boundary markers: The instructions do not specify using delimiters or sanitization when writing rules to instructions files, which could lead to instructions being parsed as system commands or agent prompts.
Capability inventory: The skill has the capability to write to the local file system, specifically targeting instructions files like CLAUDE.md and AGENTS.md.
Sanitization: No sanitization or validation of the 'mistake' content is mentioned before it is codified into a permanent rule.
[PERSISTENCE]: The skill is designed to modify the agent's behavior by appending rules to configuration files that persist across sessions.
Evidence: The skill instructs the agent to write rules to CLAUDE.md and AGENTS.md in the project root and the user's home directory (~/.claude/CLAUDE.md, ~/.codex/AGENTS.md).
[COMMAND_EXECUTION]: The skill uses a shell command to identify the repository root.
Evidence: It executes git rev-parse --show-toplevel to find the target file location.

learning-from-mistakes