The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that override standard agent behavior by directing it to bypass user confirmation for file operations. It explicitly states "Act on the cue immediately — don't ask for permission first" and "harvest it without asking first."
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the current conversation history to create persistent SKILL.md files, creating a surface for persisting malicious instructions as trusted skills.
Ingestion points: Conversation history (SKILL.md).
Boundary markers: Absent; the skill does not use delimiters to isolate harvested content.
Capability inventory: The skill directs the agent to create and update files on the filesystem (e.g., in .claude/skills or ~/.claude/skills).
Sanitization: While the skill provides logic for redacting secrets, it lacks filtering or validation to prevent the persistence of malicious prompts or instructions harvested from the session.
[COMMAND_EXECUTION]: The skill facilitates autonomous filesystem modifications, as it directs the agent to write new skill files based on its own assessment of the conversation without requiring human oversight.

self-learning