The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests "learnings" and patterns from the current session context to create or update permanent instructions. This creates a vulnerability surface where an attacker providing data to the agent (e.g., via a malicious pull request or external file) could influence the agent to propose "improvements" that are actually prompt injections, such as instructions to bypass safety guidelines or leak data in future sessions.
Ingestion points: SKILL.md (Process: 1. Identify Learnings) reads session history and user-provided feedback.
Boundary markers: The instructions do not specify any delimiters or safety markers for the identified learnings to distinguish them from original instructions.
Capability inventory: The skill uses file-write capabilities to modify ~/.claude/skills/, ~/CLAUDE.md, and project CLAUDE.md files.
Sanitization: There is no mention of sanitization or validation of the learnings before they are drafted for persistence.
[PERSISTENCE]: The skill's primary purpose is to maintain access and influence across sessions by modifying global and project-specific configuration files. Specifically, it routes information to ~/CLAUDE.md and ~/.claude/skills/, which directly controls agent behavior in all subsequent sessions. While the skill mandates user confirmation (Step 3), the ability to persistently alter the agent's core instructions is a high-risk capability if misused.

self-improve