The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill implements a persistent feedback loop where data from errors, tool outputs, and user interactions is stored in .learnings/*.md and subsequently reviewed or promoted to system-level instruction files like CLAUDE.md, AGENTS.md, and SOUL.md. This creates a vector for indirect prompt injection if malicious or adversarial content is logged and later influences the agent's behavioral logic.
Ingestion points: The agent is instructed to read .learnings/*.md files and process the CLAUDE_TOOL_OUTPUT environment variable (via error-detector.sh).
Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are defined for the logs or promoted rules.
Capability inventory: The skill possesses the capability to write to the filesystem, execute shell scripts, and utilize OpenClaw tools like sessions_send and sessions_spawn to communicate across sessions.
Sanitization: The skill does not define sanitization or validation logic for data before it is logged or promoted to instruction files.
[COMMAND_EXECUTION]: The skill provides and instructs the setup of several shell scripts (activator.sh, error-detector.sh, extract-skill.sh) to be used as lifecycle hooks. These scripts perform filesystem operations (mkdir, cat) and read environment variables. While currently focused on benign utility tasks, they represent executable surface area that runs within the agent's execution context.

self-improvement