The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently uses the uv run command to execute internal Python scripts (autolearn.py) for data management, memory updates, and skill creation.
[COMMAND_EXECUTION]: The autolearn.py script programmatically creates symlinks from its persona directories into the ~/.agents/skills/ directory to register newly created skills with the agent platform.
[DATA_EXFILTRATION]: The skill accesses a sensitive local SQLite database (opencode.db) located at ~/.local/share/opencode/opencode.db to read the user's conversation history for its review process.
[DATA_EXFILTRATION]: Includes a synchronization feature (sync push) that uploads the contents of the knowledge store (memories, observations, and configuration) to a remote server. While the data is end-to-end encrypted using AES-256-GCM before transmission, it establishes a network channel for transmitting the knowledge base.
[EXTERNAL_DOWNLOADS]: The sync pull command downloads data from a remote server to update the local knowledge store files.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from past conversations and uses that data to automatically create or "patch" the instructions of other agent skills. A malicious message in a conversation could influence the reviewer to generate a backdoored skill that the agent would subsequently load and obey.
Ingestion points: Conversation history read from opencode.db via the search and review logic.
Boundary markers: The skill uses  headers in generated markdown files to denote managed sections.
Capability inventory: The skill possesses the ability to write to the local file system, modify its own configuration, and create/patch other agent skills via symlinking.
Sanitization: Implementation relies on basic lexical tokenization and Jaccard similarity checks; it lacks semantic verification to ensure that instructions extracted from conversations are safe or appropriate.

autolearn-reviewer