The Agent Skills Directory

[PROMPT_INJECTION]: The background observer agent is vulnerable to indirect prompt injection because it processes session logs (observations.jsonl) that may contain untrusted data from external tool outputs or attacker-influenced content.
Ingestion points: The agents/observer-loop.sh script reads from observations.jsonl, which is populated with tool inputs and outputs by the hooks/observe.sh hook.
Boundary markers: The prompt used to invoke the observer agent in agents/observer-loop.sh does not use strong isolation markers (such as XML tags or explicit "ignore instructions" delimiters) to separate its instructions from the ingested log data.
Capability inventory: The observer agent is invoked via the claude CLI with restricted permissions (--allowedTools "Read,Write"), preventing it from executing arbitrary shell commands or editing existing code, though it can create or update instinct files.
Sanitization: While the hooks/observe.sh script performs regex-based scrubbing of common secret and credential patterns, it does not sanitize the logs for potentially malicious instructions intended for the observer agent.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its core project detection and observation functionality.
The scripts/detect-project.sh and hooks/observe.sh scripts execute git and python3 to resolve project metadata and process JSON data safely.
The scripts/instinct-cli.py tool uses subprocess.run to call git for repository root and remote URL detection, employing safe argument passing.
[EXTERNAL_DOWNLOADS]: The scripts/instinct-cli.py CLI provides an import command that allows users to manually fetch instinct configurations from remote HTTP/HTTPS URLs using Python's urllib.request module.

continuous-learning-v2