The Agent Skills Directory

[PROMPT_INJECTION]: The background observer agent's prompt in 'agents/observer-loop.sh' explicitly instructs the AI to bypass standard safety and confirmation protocols, specifically stating 'Do NOT ask for permission, do NOT ask for confirmation'. This removes critical human-in-the-loop oversight for the agent's automated file operations.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It captures raw tool inputs and outputs, including potentially untrusted data from external sources, into 'observations.jsonl' which is then processed by a background LLM to generate behavioral rules. 1. Ingestion points: 'observations.jsonl' files located in project directories. 2. Boundary markers: Absent in the observer's prompt template. 3. Capability inventory: The background agent is granted 'Read' and 'Write' tool access. 4. Sanitization: Includes basic secret scrubbing via regex, but lacks content sanitization to prevent instruction injection.
[COMMAND_EXECUTION]: The skill implements a background loop in 'agents/observer-loop.sh' that dynamically generates and writes markdown and YAML files to the filesystem based on LLM analysis of session observations. This autonomous modification of the environment based on potentially untrusted data is a security risk.
[COMMAND_EXECUTION]: Shell commands and Python scripts are executed via subprocess calls for tasks such as project detection and registry management in 'scripts/instinct-cli.py'.
[EXTERNAL_DOWNLOADS]: The 'scripts/instinct-cli.py' script includes an 'import' command capable of fetching and parsing data from arbitrary remote URLs using the 'urllib.request' module.
[DATA_EXFILTRATION]: Detailed session activity, including tool inputs and outputs, is recorded and transmitted to an external LLM for pattern analysis. While the skill includes logic to scrub common secret patterns, this process inherently involves transmitting potentially sensitive context to a remote model provider.

continuous-learning-v2