The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to capture user input and store it as 'lessons' in Markdown files (e.g., docs/project-reference/lessons.md) that are automatically injected into the agent's prompt during every future task. This creates a persistent surface for indirect prompt injection.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to modify executable JavaScript files in the .claude/hooks/ directory (specifically prompt-injections.cjs) to 'promote' lessons. Appending user-influenced strings to executable scripts allows for arbitrary code execution whenever these hooks are triggered by the platform.
[REMOTE_CODE_EXECUTION]: By modifying local .cjs hook files with unvalidated user content, the skill enables a form of local code injection that functions similarly to remote code execution once the malicious payload is successfully stored and subsequently executed by the agent's runtime environment.
[INDIRECT_PROMPT_INJECTION_SURFACE]: The skill possesses a wide attack surface for indirect injection:
Ingestion points: Captures lessons from any user instruction or conversation triggered by phrases like 'remember this' or 'always do'.
Boundary markers: Absent; lessons are appended to files and later injected into prompts without delimiters or instructions to ignore nested commands.
Capability inventory: The skill utilizes Write, Edit, and Bash tools to modify both documentation and executable script files.
Sanitization: Absent; while a 'Lesson Quality Gate' exists to ensure lessons are generic, there is no validation to prevent malicious instructions or code snippets from being saved.

learn