The Agent Skills Directory

[PERSISTENCE]: The skill explicitly facilitates the modification of global agent configuration files, including skills, commands, and subagents (often stored in directories like ~/.claude/skills/). By allowing the agent to update these files with 'learnings' from the current session, it creates a mechanism for instructions to persist across different projects and future sessions, effectively enabling self-modification of the agent's core behavior.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the recent conversation context—which may include outputs from tools, third-party APIs, or web content—and processes it into persistent instructions or documentation. This represents a significant attack surface where a malicious payload hidden in external data could be formatted as a 'learning' and saved into the system.
Ingestion points: Conversation history analyzed in Step 1 of SKILL.md.
Boundary markers: The workflow includes a 'Step 6: Present Changes for Confirmation' which requires user approval, serving as a manual boundary marker.
Capability inventory: The skill uses ls and find for discovery and requires file-write capabilities to modify project and global skill files as described in Step 7.
Sanitization: The instructions in SKILL.md advise the agent to avoid capturing secrets like API keys, but there is no explicit sanitization or filtering to detect and block prompt injection patterns within the captured content.
[COMMAND_EXECUTION]: The skill utilizes shell commands (ls, find) to discover existing documentation files within the project's .claude/ directory and root folder. While these discovery commands are common, they are used here to identify targets for modification.

capture-learning