The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module to execute system commands including git, gh (GitHub CLI), python3, sqlite3, and various package managers such as npm, pip, and composer. These are used for repository identification, applying diffs, and checking tool versions.
[PERSISTENCE]: The scripts/hook_healer.py and scripts/init_coach.py scripts modify the global ~/.claude/settings.json configuration file to install and maintain 'hooks'. This mechanism ensures that the Coach system's signal detection scripts are automatically invoked by the agent platform during various interaction phases (pre-processing, tool execution, and turn completion), ensuring the skill's logic runs persistently across sessions and survives plugin updates.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user messages and tool error outputs (stderr) to generate learning candidates and rules, creating a potential attack surface for indirect prompt injection.
Ingestion points: detect_signals.py reads user input and tool stderr; aggregate.py parses full session transcripts from ~/.claude/projects/.
Boundary markers: No explicit delimiters or 'ignore' instructions are used to isolate untrusted content during signal analysis or rule generation.
Capability inventory: The skill can modify core agent instructions (CLAUDE.md and AGENTS.md), write standalone checklist/snippet files, and create git commits.
Sanitization: Filenames and git branch names are sanitized to prevent command injection, but the content of generated rules is derived directly from parsed friction signals. Mitigation is provided by requiring manual user approval via /coach approve before any changes are applied.

coach