The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill architecture involves a high degree of indirect prompt injection risk by design, as the agent is tasked with proposing edits to its own instructions, prompts, and harness code based on its own execution traces.
Ingestion points: Agent proposals for edits to the harness, prompts, context playbook, and workflow as described in the Activation criteria.
Boundary markers: The skill explicitly recommends runtime enforcement of budgets and permissions rather than relying on prompt-level constraints which are easily evolved away.
Capability inventory: The described systems involve file-system writes for candidate archiving, harness code modification, and tool execution for diagnostic navigation (grep, cat).
Sanitization: Recommends a "two-split acceptance gate" (comparing held-in vs held-out data performance) and non-model logic for merging context deltas to prevent optimization-induced collapse.
[DYNAMIC_EXECUTION]: The skill documents and enables the creation of self-modifying agent systems that perform script generation and runtime execution of their own code (Recursive Self-Improvement loops).
Evidence: The skill describes mechanisms for an agent to "propose edits to its own harness," conduct "meta-level search over harness or scaffold code," and optimize its own "optimizer code" (STOP pattern).
Mitigations: Suggests OS or container-level sandboxing and keeping the evaluator source and permission instrumentation outside the surface the loop can modify to prevent reward hacking and evaluator gaming.

self-improvement-loops