The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run in scripts/instinct-cli.py and various shell scripts (detect-project.sh, start-observer.sh, hooks/observe.sh) to execute git, manage local directories, and control the observer agent's lifecycle.
[DATA_EXFILTRATION]: Through hooks/observe.sh, the skill captures detailed logs of all tool inputs and outputs. While stored locally in ~/.claude/homunculus/, these observations are subsequently transmitted to external LLM providers via the claude CLI for automated analysis, posing a potential data exposure risk.
[PROMPT_INJECTION]: The instructions for the background agent in agents/observer-loop.sh include directives to 'Do NOT ask for permission' and 'Do NOT ask for confirmation' when modifying the filesystem. Furthermore, the skill is susceptible to indirect prompt injection where malicious patterns in processed data are recorded and then 'learned' as persistent instructions. 1. Ingestion points: observations.jsonl (populated by session hooks). 2. Boundary markers: None provided for captured session data. 3. Capability inventory: Runtime generation of behavior-modifying 'instinct' files and autonomous file writes. 4. Sanitization: Limited to basic regex-based secret scrubbing without logic to detect or neutralize malicious instructions.
[EXTERNAL_DOWNLOADS]: The import command in scripts/instinct-cli.py uses urllib.request.urlopen to download and parse content from arbitrary remote URLs provided as command arguments.

continuous-learning-v2