agents-skills-feedback-loop

SUSPICIOUS. The core file-editing and consolidation behavior matches the stated purpose, but the optional machine-global hook materially broadens scope by reading session transcripts, invoking an external model CLI, and autonomously appending data across all repos. No clear malware indicators or deceptive exfiltration endpoint appear, yet the transcript-to-model data flow and persistent hook installation make this higher-risk than a normal memory-management skill.

The code is not obviously obfuscated and does perform plausible 'learning capture' logic, but it contains high-risk execution paths: it allows arbitrary shell command execution via LEARNINGS_REFLECT_CMD ('bash -c'), and it executes a local append_learning.py script derived from an environment-influenced/discovered skills_root. It also sends transcript content to an external 'claude' CLI. These behaviors make the module potentially dangerous in a supply-chain/sandboxed automation context and warrant review of how LEARNINGS_REFLECT_CMD and LEARNINGS_SKILLS_ROOT are set and whether append_learning.py is trusted.

No clear embedded malware, obfuscation, or direct data exfiltration is present in this module. The primary security concern is supply-chain/sandbox risk: when grader='model', the script executes an arbitrary shell command from the environment variable PROMOTION_EVAL_CMD using 'bash -c', passing a prompt built from untrusted JSON/eval content and sample text. If PROMOTION_EVAL_CMD (or its execution environment) is compromised, this module becomes an OS-command execution vector.

This module is an installer/registrar that establishes per-user persistence by copying a bundled Python script into ~/.agents/hooks/learnings_capture.py and injecting an event hook command (python3 <DEST>) into Claude (SessionEnd) and optionally Codex (Stop) hook configuration JSON files using a broad wildcard matcher ('*'). While the fragment shows no direct malicious behavior (no network calls or explicit exfiltration), it enables automatic execution of an unreviewed payload at session lifecycle boundaries, which is a significant supply-chain and persistence risk. Security assessment should focus on the contents and behavior of assets/learnings_capture.py and how the host tools execute hook commands.