The Agent Skills Directory

[PROMPT_INJECTION]: The background observer agent is explicitly instructed to bypass standard interaction protocols and safety guardrails. The prompt template in 'agents/observer-loop.sh' directs the sub-agent: "You MUST use the Write tool directly to create files. Do NOT ask for permission, do NOT ask for confirmation, do NOT output summaries instead of writing. Just read, analyze, and write." This removes user oversight for an automated system processing untrusted session data.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the continuous learning loop, where session data is used to generate future behavioral instructions.
Ingestion points: Session data (prompts and tool outputs) enters the system via 'hooks/observe.sh' and is stored in 'observations.jsonl'.
Boundary markers: No robust delimiters or "ignore" instructions are used when session data is sampled into the observer agent's prompt in 'agents/observer-loop.sh'.
Capability inventory: The background sub-agent has the ability to write "instinct" files using the platform's Write tool, which can permanently modify the agent's future behavior.
Sanitization: Sanitization is limited to a regex-based secret scrubber; there is no semantic validation or filtering to prevent embedded instructions in tool outputs from being adopted as new instincts.
[DATA_EXFILTRATION]: The system captures and persists comprehensive logs of user prompts and tool interactions to the local file system in '~/.claude/homunculus/'. Although a regex-based scrubber is used in 'hooks/observe.sh' to mask common secret patterns, session logs frequently contain sensitive business logic, personal data, or credentials that may not be caught by simple pattern matching, leading to potential local data exposure.
[EXTERNAL_DOWNLOADS]: The 'scripts/instinct-cli.py' utility provides an import feature that fetches content from arbitrary URLs using 'urllib.request.urlopen'. This allows for the ingestion of behavioral instructions from remote sources without integrity verification or source validation.
[COMMAND_EXECUTION]: The skill utilizes shell and Python scripts (such as 'observe.sh' and 'start-observer.sh') to manage background processes and project detection. These scripts execute several subprocesses, including the 'claude' CLI and 'git' commands, to perform background analysis and update the system's registry.

continuous-learning-v2