agents-skills-feedback-loop

The code is not obviously obfuscated and does perform plausible 'learning capture' logic, but it contains high-risk execution paths: it allows arbitrary shell command execution via LEARNINGS_REFLECT_CMD ('bash -c'), and it executes a local append_learning.py script derived from an environment-influenced/discovered skills_root. It also sends transcript content to an external 'claude' CLI. These behaviors make the module potentially dangerous in a supply-chain/sandboxed automation context and warrant review of how LEARNINGS_REFLECT_CMD and LEARNINGS_SKILLS_ROOT are set and whether append_learning.py is trusted.

No clear embedded malware, obfuscation, or direct data exfiltration is present in this module. The primary security concern is supply-chain/sandbox risk: when grader='model', the script executes an arbitrary shell command from the environment variable PROMOTION_EVAL_CMD using 'bash -c', passing a prompt built from untrusted JSON/eval content and sample text. If PROMOTION_EVAL_CMD (or its execution environment) is compromised, this module becomes an OS-command execution vector.

This module is an installer/registrar that establishes per-user persistence by copying a bundled Python script into ~/.agents/hooks/learnings_capture.py and injecting an event hook command (python3 <DEST>) into Claude (SessionEnd) and optionally Codex (Stop) hook configuration JSON files using a broad wildcard matcher ('*'). While the fragment shows no direct malicious behavior (no network calls or explicit exfiltration), it enables automatic execution of an unreviewed payload at session lifecycle boundaries, which is a significant supply-chain and persistence risk. Security assessment should focus on the contents and behavior of assets/learnings_capture.py and how the host tools execute hook commands.