The Agent Skills Directory

[PROMPT_INJECTION]: The background observer agent is vulnerable to indirect prompt injection from analyzed session data.\n
Ingestion points: Session tool inputs and outputs are recorded in observations.jsonl via hooks/observe.sh and later read by the observer agent in agents/observer-loop.sh.\n
Boundary markers: The system uses natural language rules in the analysis prompt to guide the background LLM, such as 'Be conservative' and 'Never include actual code snippets'.\n
Capability inventory: The background analysis process has the capability to write new files to the local file system in the instincts/ and evolved/ directories via the claude CLI.\n
Sanitization: The skill implements regex-based scrubbing for secrets in the observation hook, but does not provide robust protection against malicious instructions embedded in processed session logs.\n- [DATA_EXFILTRATION]: The skill records session history, including tool inputs and outputs, and transmits this data to a remote LLM provider for pattern analysis. While a secret scrubber is implemented in hooks/observe.sh, the use of regular expressions is not an exhaustive safeguard against the transmission of sensitive information.\n- [EXTERNAL_DOWNLOADS]: The instinct-cli.py script provides an import command that can fetch content from arbitrary URLs using urllib.request.urlopen. The downloaded content is parsed as YAML and stored in the local instinct library.\n- [COMMAND_EXECUTION]: The system executes local system commands, primarily git, via subprocess.run and shell scripts to detect project context and manage the background observer process. The execution patterns utilize argument lists rather than raw shell strings, mitigating command injection risks.

continuous-learning-v2