The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instinct-cli.py script allows importing 'instincts' (agent instructions) directly from remote URLs using urllib.request.urlopen. These instructions are written to the local filesystem and subsequently used to guide the behavior of the AI agent without integrity verification or sandboxing. This allows for the injection of new, unverified behaviors from arbitrary network sources.
[PROMPT_INJECTION]: The system is highly susceptible to indirect prompt injection. The observe.sh hook captures all tool outputs, including potentially malicious content from external sources like web pages or third-party logs. These logs are processed by a background agent (observer-loop.sh) which is explicitly instructed to automatically create or update global instructions ('instincts') if patterns are detected 3+ times without asking for user permission. An attacker could exploit this by presenting specific 'patterns' in tool outputs to install malicious global behaviors.
[DATA_EXFILTRATION]: The hooks/observe.sh script logs comprehensive session data, including every tool input and output, to a centralized project directory. While it includes a basic regex-based secret scrubber, this concentration of sensitive session activity (prompts, code, API responses) represents a significant data exposure risk if the storage directory is compromised or if an injected instinct is used to exfiltrate the logs.
[COMMAND_EXECUTION]: The skill relies extensively on shell command execution to manage its background processes and git integration. Scripts like start-observer.sh, observe.sh, and detect-project.sh execute shell commands and utilize environment variables to determine paths and project context. This infrastructure, while functional, provides multiple points where local command execution is triggered automatically during session activity.

continuous-learning-v2