The Agent Skills Directory

[PROMPT_INJECTION]: The instructions explicitly direct the agent to override standard user-consent protocols: 'Act on the cue immediately — don't ask for permission first.' This attempts to bypass the agent's typical safety mechanism of requesting confirmation before modifying the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface by harvesting content from 'this conversation' to create persistent instruction files.
Ingestion points: Data is pulled directly from the current agent conversation history (SKILL.md).
Boundary markers: There are no requirements to use delimiters or sanitization for the harvested content.
Capability inventory: The skill possesses the capability to write new markdown and script files to the filesystem in both local and global user directories.
Sanitization: While the skill enforces a 'promotion rule' to verify functionality and a 'secrets safety' check to avoid recording values, it lacks any verification that the harvested instructions themselves are safe or non-malicious.
[PERSISTENCE]: The core function of the skill is to create persistent Agent Skill files in local (.claude/skills) and global (~/.claude/skills) directories. This allows procedures or 'golden paths' — which could include malicious or unintended behaviors — to persist across all future agent sessions on the user's machine.

self-learning