The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs users to configure a 'Stop' hook in the agent's settings (~/.claude/settings.json) to execute a local shell script (evaluate-session.sh) automatically at the end of every session.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface by converting untrusted session data into persistent instructions (learned skills).
Ingestion points: The skill reads full session transcripts, which include untrusted user input and potentially malicious tool outputs.
Boundary markers: No specific delimiters or validation mechanisms are described to prevent the agent from misinterpreting malicious text as a legitimate 'reusable pattern'.
Capability inventory: The generated patterns are saved to ~/.claude/skills/learned/, where they are likely loaded as authoritative instructions for future agent sessions.
Sanitization: There is no evidence of sanitization or human-in-the-loop review before session data is promoted to a 'learned skill'. An attacker could craft a conversation that tricks the agent into 'learning' a pattern that compromises security in subsequent tasks.

continuous-learning