The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/improve.py uses subprocess.run to execute git remote get-url origin. This is used for environment discovery to automatically determine the project name for rule categorization.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection and Agent Poisoning. It is designed to capture user feedback and corrections, then write them into persistent instruction files (AGENTS.md) that influence the agent's future behavior. There is no sanitization or validation of the content being recorded.
Ingestion points: Arbitrary strings from user messages are captured via the observe command in scripts/improve.py.
Boundary markers: The rules are written as bullet points in markdown files without specific delimiters or instructions to treat them as untrusted data.
Capability inventory: The skill possesses the capability to write to the global agent configuration (~/.config/opencode/AGENTS.md) and project-local instructions. This means a single malicious correction could persistently affect the agent's behavior across all projects.
Sanitization: No filtering or escaping is performed on the rule text. A user (or an attacker providing data the user copies) could provide a 'correction' that contains malicious system instructions, which the agent would then permanently adopt.
[PROMPT_INJECTION]: The seed command in scripts/improve.py parses external markdown files and imports lines as rules. This provides an additional vector for ingesting untrusted instructions into the agent's persistent rule set.

self-improving-agent