The Agent Skills Directory

[PERSISTENCE]: The skill describes a 'Learning Through Self-Modification' pattern where agents write learned information, such as user preferences, to instruction files (e.g., 'agent/user_preferences.yaml'). These files are automatically loaded in subsequent sessions, allowing potentially malicious or unauthorized modifications to persist and influence agent behavior indefinitely.
[INDIRECT_PROMPT_INJECTION]: The described patterns for scratchpads and self-modification ingest external data from tool outputs and user input that could contain malicious instructions.
Ingestion points: External data enters the context through 'handle_tool_output', terminal log syncing, and the 'remember_preference' function.
Boundary markers: The provided patterns do not include explicit delimiters or 'ignore embedded instructions' warnings for the data stored in the filesystem.
Capability inventory: The skill requires the agent to have file system access for 'write_file', 'write_yaml', 'read_file', 'grep', and 'ls' operations.
Sanitization: The patterns lack specific sanitization or escaping mechanisms to prevent external content from being interpreted as instructions when re-loaded.
[METADATA_POISONING]: The skill's YAML frontmatter includes a 'risk: critical' field. This metadata uses alarming risk labeling that could be deceptive or intended to override standard security evaluations.
[SAFE]: The documentation references the official 'Anthropic: Agent Skills specification', which is a trusted industry resource.

filesystem-context