The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session transcripts via the $CLAUDE_TRANSCRIPT_PATH environment variable, which contains untrusted content from user and assistant messages.
Ingestion points: The transcript file is identified and signaled for analysis in evaluate-session.sh, then processed by the agent to extract patterns.
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands within the processed transcripts, making the agent susceptible to instructions hidden in the chat log.
Capability inventory: The skill has the capability to write files to the local filesystem (~/.Codex/skills/learned/) to persist new skills.
Sanitization: No sanitization or filtering of the transcript content is performed before the agent evaluates it for pattern extraction.
[DYNAMIC_EXECUTION]: The skill facilitates the generation of new executable skill files based on data collected at runtime.
The agent is instructed to "extract reusable patterns" and "save them as learned skills." This creates new Markdown files in the skill directory that the agent will load and obey in future sessions.
If a transcript contains malicious instructions disguised as "useful workarounds" or "debugging techniques," the agent may inadvertently codify these into a permanent skill, leading to persistent malicious behavior or unauthorized command execution in future sessions.

continuous-learning