The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill harvests 'lessons' from past session transcripts to generate new agent instructions. This creates a surface where malicious payloads encountered in previous tasks could be misinterpreted as valid corrections and proposed as permanent rules.
Ingestion points: The skill reads session transcripts (.jsonl files) from the ~/.claude/projects/ directory and Markdown files from the auto-memory directory.
Boundary markers: The instructions explicitly warn the agent that candidate text is evidence and not active instructions. A mandatory human review gate (Phase 4) is implemented, where the user must approve all proposed additions, removals, or modifications.
Capability inventory: The skill possesses the capability to read extensive session history and write to critical instruction files (e.g., CLAUDE.md, ~/.claude/CLAUDE.md) and modify permission settings in .claude/settings.json.
Sanitization: The agent is tasked with synthesizing evidence into new imperative sentences, but the final safety check relies entirely on the user's manual approval of the proposed changes.
[COMMAND_EXECUTION]: The skill uses the Bash tool to run a bundled Node.js script (extract-corrections.mjs). While the allowed-tools frontmatter restricts the tool to this specific script, the script has broad read access to the local filesystem, including user configuration and history directories.
[DATA_EXFILTRATION]: The skill accesses sensitive local data, specifically the ~/.claude/ directory containing the user's session history and agent configuration. Although this data is processed locally to generate instruction updates, the access to full transcripts represents a significant exposure of private user-agent interaction history.

debrief