The Agent Skills Directory

[PERSISTENCE]: The skill allows the agent to persistently modify its own configuration by writing hook definitions directly to .claude/settings.json or hooks/hooks.json when the --install flag is used. These modifications persist across all future sessions.
[COMMAND_EXECUTION]: The skill generates and installs custom hook scripts (e.g., Node.js implementations) that the agent executes during specific lifecycle events like PreToolUse. This enables the execution of dynamically generated code during normal tool operations.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface by ingesting 'analysis findings' from .planning/kaizen/, which are derived from session transcripts that may contain untrusted data.
Ingestion points: The skill reads findings stored in markdown files within the .planning/kaizen/ directory.
Boundary markers: There are no explicit boundary markers or instructions to ignore potential injections within the findings files.
Capability inventory: The findings are used to trigger high-privilege actions, including writing to agent settings, generating executable scripts, and modifying other agents' system prompts via the subagent-refactorer.
Sanitization: The skill lacks sanitization or validation logic to ensure that instructions extracted from findings do not contain malicious payloads intended to hijack the improvement generation process.
[PROMPT_INJECTION]: The skill explicitly uses prompt injection patterns in its SubagentStart hooks, using priority markers like 'CRITICAL:' to inject instructions that override the default behavior of subagents.
[DYNAMIC_EXECUTION]: The skill dynamically generates and writes script files (e.g., JavaScript) based on analysis templates and then integrates them into the agent's hook execution environment.

kaizen-improvement