The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses highly sensitive local files containing user conversation history and cached clipboard content at ~/.claude/history.jsonl and ~/.claude/paste-cache. While no network exfiltration was detected in the scripts, this sensitive data is read into the agent's context for processing.
[INDIRECT_PROMPT_INJECTION]: The skill creates an automated feedback loop where untrusted data from historical prompts is used to generate system-level instructions and skills.
Ingestion points: The script scripts/improve-system.py reads user history and pastes from ~/.claude/history.jsonl and ~/.claude/paste-cache.
Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions embedded within the mined history.
Capability inventory: The agent is empowered to modify global system instructions in ~/.claude/CLAUDE.md, local CLAUDE.md files, and create new skill files.
Sanitization: No sanitization or validation of the historical content is performed before it influences instruction generation.
[COMMAND_EXECUTION]: Instructs the agent to execute a bundled Python script and perform shell operations like cp for file backups and configuration modifications.
[DYNAMIC_EXECUTION]: Dynamically generates and applies new agent instructions, rules, and skills based on the analysis of past interactions, which can lead to persistent instruction drift if influenced by malicious historical data.

improve-system