The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell scripts and subprocess calls to manage project context and background tasks. Evidence includes:
scripts/detect-project.sh uses backticks and subshells to execute git and python for project identification.
scripts/instinct-cli.py invokes subprocess.run for git operations and project root detection.
hooks/observe.sh and agents/start-observer.sh use nohup to spawn background processes.
[EXTERNAL_DOWNLOADS]: The CLI tool includes a feature to import 'instincts' from remote network locations. Evidence includes:
scripts/instinct-cli.py uses urllib.request.urlopen(source) to fetch content from user-supplied URLs.
[REMOTE_CODE_EXECUTION]: While not executing binary code, the skill allows for the remote delivery of 'instincts'—behavioral instructions that modify how the agent interacts with the user and system. Importing these from untrusted URLs allows for remote modification of agent behavior.
[DATA_EXFILTRATION]: The skill captures a comprehensive log of all session activity, including tool inputs and outputs, which is stored in ~/.claude/homunculus/. Evidence includes:
hooks/observe.sh intercepts PreToolUse and PostToolUse events to record data.
Although it employs a regex-based scrubber (_SECRET_RE) to mask credentials, this approach may not capture all sensitive data types, resulting in the persistent local storage of potentially sensitive session history.
[PROMPT_INJECTION]: The background observer process presents an indirect prompt injection surface. Evidence includes:
agents/observer-loop.sh feeds captured tool outputs directly into a prompt for a secondary LLM (Haiku) to distill behavioral patterns. Malicious instructions embedded in tool responses (e.g., from web pages or files) could influence the creation of 'instincts' that alter the agent's future behavior.

continuous-learning-v2