The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill records tool inputs and outputs into observations.jsonl via hooks/observe.sh. A background agent (agents/observer.md) later analyzes these logs to generate new "instincts" (instructions). An attacker controlling a tool's output (e.g., through a malicious web page or source file) could inject instructions that the background agent would "learn" and apply to future sessions.\n
Ingestion points: hooks/observe.sh captures raw tool_output from all tools and appends it to ~/.claude/homunculus/observations.jsonl.\n
Boundary markers: None. The logs are processed as raw strings without delimiters or instructions to ignore embedded commands.\n
Capability inventory: The background process (agents/start-observer.sh) uses the claude CLI to write new behavior-modifying instructions to the file system at ~/.claude/homunculus/instincts/personal/.\n
Sanitization: No sanitization or filtering is performed on tool outputs before they are processed by the learning agent.\n- [EXTERNAL_DOWNLOADS]: The /instinct-import command, implemented in scripts/instinct-cli.py, allows fetching and installing "instinct" files from arbitrary remote URLs using urllib.request.urlopen. These files contain instructions that directly influence agent behavior.\n- [PERSISTENCE]: The agents/start-observer.sh script launches a persistent background process using disown. This process monitors session logs and periodically modifies the skill's instruction base, allowing behavior changes to persist and evolve independently of the current session.\n- [DYNAMIC_EXECUTION]: The /evolve command clusters existing instincts and generates new .md skill, command, and agent files at runtime. This allows the system to dynamically expand its own instruction set based on potentially untrusted data gathered during sessions.

continuous-learning-v2