The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a self-improving instruction loop that extracts learnings from conversation transcripts. This creates a vulnerability surface where untrusted data encountered during a session (such as content from an external file or web search) could be identified as a correction and permanently written into the agent's skill files or the global CLAUDE.md configuration.
Ingestion points: scripts/extract_signals.py parses transcript files located in ~/.claude/session-env/.
Capability inventory: The skill can write to instruction files using scripts/update_skill.py and scripts/promote_learning.py, and modifies its own repository via scripts/reflect.py.
Boundary markers: The system utilizes markdown headers like ## Critical Corrections to organize updates but lacks robust sanitization for the extracted message content.
Sanitization: Detection relies on regex matching and LLM-based intent analysis in scripts/semantic_detector.py, which are susceptible to adversarial prompting.
[COMMAND_EXECUTION]: The skill uses the subprocess module to execute external tools for repository management and content analysis.
scripts/learning_ledger.py runs git remote get-url origin to identify the project scope.
scripts/reflect.py performs git add and git commit operations to version control instruction updates.
scripts/semantic_detector.py invokes the claude CLI (claude -p) to evaluate the intent of user messages.
[PERSISTENCE]: The skill includes an automatic reflection feature activated by /reflect-on. This mechanism installs a stop hook (scripts/hook-stop.sh) that triggers a background reflection process every time a session ends, ensuring persistent execution of the skill's logic.

reflect