The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill extracts 'learnings' from active session data and project context to update durable agent prompts. This creates an attack surface where malicious content encountered during a session (e.g., in a file or API response) could be misinterpreted as a valid behavior rule and persisted into the agent's core instructions.
Ingestion points: The $request argument in SKILL.md and the broader session history are used as sources for new rules.
Boundary markers: No technical boundary markers are used to isolate the extracted text, though manual classification and user review are required.
Capability inventory: The skill uses the Write and Edit tools to modify .agents/agents/*/AGENT.md and .claude/agents/* files.
Sanitization: Relies entirely on the AskUserQuestion tool for manual user verification and the agent's ability to classify the scope according to references/learning-scope.md.
[PERSISTENCE]: The skill's primary purpose is to establish behavioral persistence by modifying agent definition files (AGENT.md) across multiple CLI trees. By updating these durable files, changes to the agent's instructions persist across all future sessions within the repository.
Evidence: Steps 4 and 5 in SKILL.md explicitly describe writing to the central learnings file and syncing those changes into live agent prompt surfaces (.agents/ and .claude/ directories).

update-agent-learnings