The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to 'harvest' lessons from the conversation context and persist them into 'durable memory' surfaces such as CLAUDE.md, user-profile.md, or individual skill definitions. This creates a vulnerability surface where malicious instructions embedded in untrusted data (like web content or code comments processed during a task) can be promoted into permanent, high-privilege system instructions.
Ingestion points: The skill explicitly ingests data from the current chat history in its 'Harvest' step (Step 1) to identify errors, corrections, or surprises.
Boundary markers: While the skill uses a 'situation-tagged entry format' (Step 4) to provide structure, it lacks explicit instructions to sanitize or valid inputs for prompt injection markers that might attempt to hijack the agent's future behavior.
Capability inventory: The skill possesses the capability to modify the root CLAUDE.md (a core instruction file for many agents), 02-DOCS/wiki/harness/user-profile.md, and 02-DOCS/wiki/harness/decisions.md. It also delegates structural changes to other skills via author-skill, allowing it to modify tool logic or validation scripts.
Sanitization: No sanitization, escaping, or strict schema validation is mentioned for the content harvested from the chat before it is written to the durable surfaces.

continuous-learning