The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests session transcripts from ~/.gemini/antigravity/brain/ and ~/.claude/logs/ (Ingestion points). It extracts technical "facts" using regex patterns such as Root cause:\s*(.+), which serve as weak boundary markers that can be bypassed by malicious content within a transcript. The skill has the capability to execute agent-kernel remember commands and write durable markdown files to the workspace (Capability inventory). Sanitization includes regex-based tag removal and filtering of generic phrases and specific local paths, but it lacks robust validation to prevent adversarial instructions from influencing persistent agent memory (Sanitization).
[COMMAND_EXECUTION]: The scripts/extract_learnings.py script executes various system commands using subprocess.run, including agent-kernel, gbrain, npm, and bun. These commands are used to store extracted learnings and manage dependencies.
[EXTERNAL_DOWNLOADS]: The skill attempts to dynamically install the agent-kernel tool using npm install -g or bun install -g if the binary is not detected on the system. While targeting standard registries, this dynamic installation of an external dependency at runtime represents a security concern.
[DATA_EXFILTRATION]: The skill accesses and reads full session transcripts and logs from directories like ~/.gemini/antigravity/brain/ and ~/.claude/logs/. Although the skill intends to distill this information and includes logic to redact secrets, the ingestion of raw transcript files that may contain sensitive developer information poses a risk.
[DYNAMIC_EXECUTION]: CLI commands for persistence tools are dynamically constructed and executed at runtime based on data parsed from transcripts.

fable-learning