The Agent Skills Directory

[PERSISTENCE]: The skill implements a 'Learn' procedure (Step 8) that instructs the agent to write user-provided corrections directly into its own source code or rule files. This allows changes to the agent's logic to persist across sessions, creating a risk for long-term behavioral poisoning.\n- [CREDENTIALS_UNSAFE]: The orchestration logic in SKILL.md (Step 3) and references/brief-template.md explicitly allows for the reading and writing of 'protected paths' such as ~/.claude and ~/.codex. These directories are known to store sensitive session tokens, configuration, and internal platform state.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user requests verbatim and uses them to generate instructions for other agents, creating a significant injection surface.\n
Ingestion points: User input is captured in the 'Intake' step and stored in the 'Owner request' field of the brief template.\n
Boundary markers: The brief template uses markdown blockquotes to isolate user requests.\n
Capability inventory: The skill can perform file writes, modify its own rules, and access restricted system directories.\n
Sanitization: No sanitization or validation of the owner's request is performed before it is used to modify the agent's behavioral rules.\n- [COMMAND_EXECUTION]: Step 6 of the orchestration logic encourages the agent to resolve obstacles by running 'scriptable sources' or existing user scripts, which involves executing code on the host system.\n- [DYNAMIC_EXECUTION]: The 'Learn' mechanism (Step 8) involves the runtime generation and application of new instructional code (rules) into the agent's skill library.

lead-orchestration