The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/promote_learning.py and assets/learnings_capture.py use subprocess.run to execute shell commands provided through environment variables (PROMOTION_EVAL_CMD and LEARNINGS_REFLECT_CMD). This enables arbitrary command execution if the execution environment is compromised or if these variables are set to malicious commands.
[COMMAND_EXECUTION]: The script scripts/install_capture_hook.py modifies global agent configuration files (~/.claude/settings.json and ~/.codex/hooks.json) to install a persistent session-end hook. This hook executes a local Python script automatically on every agent termination, establishing a permanent persistence mechanism on the host machine.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. The assets/learnings_capture.py script reads session transcripts, which contain untrusted content, and interpolates them directly into a model prompt for "reflection" without adequate sanitization or strict boundary markers.
Ingestion points: Raw session transcripts are read from the filesystem in assets/learnings_capture.py (via transcript_path) and analyzed for insights.
Boundary markers: The system relies on simple text labels within the prompt which may be easily bypassed by instructions embedded in the transcript.
Capability inventory: The reflection loop can write to the filesystem via append_learning.py and potentially trigger further shell execution via environment variable overrides.
Sanitization: No filtering or validation of the ingested transcript content is performed to prevent malicious instructions from influencing the learning capture process.

agents-skills-feedback-loop