The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements an automated feedback loop that captures and persists conversation data, creating a surface for Indirect Prompt Injection.
Ingestion points: The skill reviews conversation history for mistakes and user corrections to generate entries for the persistent store (SKILL.md).
Boundary markers: No explicit boundary markers or instructions to ignore embedded prompts are used when writing entries to the .learnings/LEARNINGS.md file.
Capability inventory: The skill has access to Bash, Write, and Edit tools, and can trigger secondary skills such as hookify:writing-rules.
Sanitization: There is no logic to sanitize or escape content extracted from conversation history, meaning malicious instructions stored in the learnings file could be automatically re-injected into future sessions via session-start.sh.
[COMMAND_EXECUTION]: The Preamble section executes shell commands to determine environment configuration.
Evidence: The command ship-plugin-root is executed via command substitution to resolve the plugin path, and a preflight.sh script is sourced from that directory. While this appears to be part of the vendor's standard plugin architecture, it involves the execution of local tooling and scripts during skill initialization.

learn