The Agent Skills Directory

[DATA_EXFILTRATION]: The skill captures and stores all tool inputs, outputs, and session prompts in project-specific log files (observations.jsonl). While a regex-based secret scrubber is included to redact common credentials like API keys and tokens, the accumulated logs represent a significant repository of sensitive interaction data stored on the local filesystem.
[PROMPT_INJECTION]: The skill features an indirect prompt injection surface due to its core design: a background process (observer-loop.sh) automatically feeds recent session observations into an LLM (Claude Haiku) to generate new instructions. Ingestion points: untrusted tool outputs and user prompts stored in observations.jsonl. Boundary markers: Specific YAML delimiters and rigid formatting instructions in the observer's system prompt. Capability inventory: The observer agent has Read and Write tool permissions and is invoked via the claude CLI; administrative scripts use subprocess.run and file I/O. Sanitization: Secret scrubbing is implemented, but the content is not sanitized to prevent malicious instructions from influencing the pattern detection logic.
[EXTERNAL_DOWNLOADS]: The instinct-cli.py tool includes an import command that allows users to fetch instinct files from remote URLs via urllib.request. While this action is user-initiated, it serves as a vector for importing external, potentially malicious instructions into the agent's knowledge base.
[COMMAND_EXECUTION]: The skill's management scripts and background loops utilize several shell commands (including git, python, du, and find) to detect project context, manage process locks, and monitor resource usage. These are used strictly for administrative and contextual purposes.

continuous-learning-v2