Skills cc-skill-continuous-learning

📦

cc-skill-continuous-learning

Name: cc-skill-continuous-learning
Author: affaan-m

v1.0 Content revision r1 High Risk 📁 Filesystem access⚙️ External commands

Review Claude Code Sessions for Learning

Long coding sessions often contain fixes that are hard to remember. This skill adds a Stop hook that flags reusable patterns for Claude Code review.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "cc-skill-continuous-learning" from https://skillstore.io/skills/sickn33-cc-skill-continuous-learning.md and its manifest at https://skillstore.io/api/skills/sickn33-cc-skill-continuous-learning/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-cc-skill-continuous-learning.md Signed manifest GET /api/skills/sickn33-cc-skill-continuous-learning/manifest Signed lockfile GET /api/skills/sickn33-cc-skill-continuous-learning/lockfile

Test it

Using "cc-skill-continuous-learning". A long debugging session fixed repeated test setup failures.

Expected outcome:

The review identifies a reusable test setup lesson, recommends a short skill name, and asks for approval before saving.

Using "cc-skill-continuous-learning". A short three-message session ended without a reusable pattern.

Expected outcome:

The hook reports that the session is too short and does not request learning review.

Using "cc-skill-continuous-learning". A project-specific workaround includes sensitive customer details.

Expected outcome:

The review rejects sensitive details, keeps only general workflow guidance, and recommends manual approval.

Security Audit

High Risk

v4 • 7/5/2026 Open versioned report

The skill is a small Claude Code Stop-hook script, not a network exfiltration tool. The main risks are automatic shell execution, local transcript-derived learning, and persistence under a hidden Claude skills directory. Comment-only hidden path matches were dismissed, while runtime home-directory and hook risks remain confirmed.

Files scanned

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

evaluate-session.sh:42-50 evaluate-session.sh:58-60

Session Transcript Learning Can Persist Sensitive Context

The hook reads the Claude transcript path, counts user messages, and asks Claude Code to evaluate long sessions for reusable patterns saved to the learned-skills path. This can persist project-specific or sensitive lessons across future sessions if users enable it without review.

Lines 42-50 use the Claude transcript path and count messages, while lines 58-60 request evaluation and name the save location. The script does not write transcript contents itself, so confidence is high but not absolute.

Medium

evaluate-session.sh:2-3 evaluate-session.sh:9-17

Automatic Stop Hook Execution Requires Explicit Consent

The script is designed to run from a Claude Code Stop hook after sessions end. Users need clear opt-in because the hook runs local commands and can create persistent learning state after normal coding sessions.

The file header and hook example clearly show Stop-hook usage. The hook is manually configured, so this is a consent and transparency risk rather than covert installation.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

config.json:5

Hidden file in home directory

"learned_skills_path": "~/.claude/skills/learned/",

The config sets learned_skills_path to ~/.claude/skills/learned, a hidden Claude skills directory. That location can persist generated behavior across future Claude Code sessions.

High

evaluate-session.sh:36

Hidden file in home directory

LEARNED_SKILLS_PATH=$(jq -r '.learned_skills_path // "~/.claude/skills/learned/"' "$CONFIG_FILE" | s

The script loads a learned-skills path that defaults to ~/.claude/skills/learned and later creates that directory. This can establish persistent skill state under the hidden Claude home.

High

evaluate-session.sh:30

Hidden file access

LEARNED_SKILLS_PATH="${HOME}/.claude/skills/learned"

The script initializes LEARNED_SKILLS_PATH to ${HOME}/.claude/skills/learned. It later creates that directory, which persists data under a hidden Claude skills location.

High

evaluate-session.sh:36

Hidden file access

LEARNED_SKILLS_PATH=$(jq -r '.learned_skills_path // "~/.claude/skills/learned/"' "$CONFIG_FILE" | s

The config-derived path keeps the default hidden Claude skills directory and is used for local persistence. This is a real hidden home-directory access pattern.

Medium

config.json:5

Hidden file access

"learned_skills_path": "~/.claude/skills/learned/",

The configured output path targets a hidden directory in the user home. This is intentional persistence and should be reviewed before enabling the hook.

Medium

evaluate-session.sh:1

Unix shell invocation

#!/bin/bash

The skill ships a Bash script intended to run as a Claude Code Stop hook. Automatic local command execution is a real risk factor even when the current commands are simple.

Risk Factors

📁 Filesystem access (12)

config.json:5 config.json:5 evaluate-session.sh:9 evaluate-session.sh:16 evaluate-session.sh:24 evaluate-session.sh:36 evaluate-session.sh:9 evaluate-session.sh:16 evaluate-session.sh:24 evaluate-session.sh:30 evaluate-session.sh:36 evaluate-session.sh:50

⚙️ External commands (5)

evaluate-session.sh:28 evaluate-session.sh:35 evaluate-session.sh:36 evaluate-session.sh:50 evaluate-session.sh:1

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-cc-skill-continuous-learning/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-cc-skill-continuous-learning/security.svg)](https://skillstore.io/skills/sickn33-cc-skill-continuous-learning?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-cc-skill-continuous-learning?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-cc-skill-continuous-learning/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-cc-skill-continuous-learning.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

affaan-m. (2026). cc-skill-continuous-learning security audit report (audit version 4) [Author version 1.0]. Skillstore. https://skillstore.io/skills/sickn33-cc-skill-continuous-learning/audits/4

BibTeX citation

@techreport{affaan-m-sickn33-cc-skill-continuous-learning-2026,
  author = {affaan-m},
  title = {cc-skill-continuous-learning security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/sickn33-cc-skill-continuous-learning/audits/4},
  note = {Author version 1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cc-skill-continuous-learning security audit report (audit version 4)"
version: "1.0"
type: report
authors:
  - name: "affaan-m"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/sickn33-cc-skill-continuous-learning/audits/4"
identifiers:
  - type: other
    value: "skillstore:sickn33-cc-skill-continuous-learning:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Capture debugging lessons

Review long Claude Code sessions for repeatable fixes and workflow patterns.

Standardize recurring fixes

Identify patterns that could become reviewed team guidance or reusable local skills.

Test learning workflows

Evaluate how Stop hooks can support memory without adding per-message latency.

Try These Prompts

Review my last session

Use the continuous learning hook output to identify one reusable debugging pattern. Show the lesson and why it is worth saving.

Draft a learned skill

Review the session summary and draft a concise learned skill for a repeated workflow. Keep sensitive project details out.

Tune detection settings

Inspect my continuous learning configuration and suggest safer threshold, pattern, and output path choices for my workflow.

Audit before enabling

Evaluate this hook setup for privacy, persistence, and shell execution risks. Recommend changes before I enable it across projects.

Best Practices

Review generated learning content before saving it to a shared skill directory.
Use a project-local output path when sessions may include private details.
Keep the minimum session length high enough to avoid noisy captures.

Avoid

Do not enable the hook globally before reviewing its filesystem behavior.
Do not save raw transcript excerpts as reusable skills.
Do not assume every long session contains a useful pattern.

Frequently Asked Questions

Does this skill automatically create complete skills?

No. The script creates the learned-skills directory and signals Claude Code to review longer sessions.

What data does it read?

It reads the transcript path from Claude Code and counts user messages in that transcript.

Does it require extra tools?

Yes. The script expects Bash, jq, grep, and Claude Code hook support.

Can I change the output location?

Yes. Change learned_skills_path in config.json before enabling the hook.

Is it safe for private projects?

Use caution. Review outputs manually and avoid saving sensitive project details.

Can Codex use it?

Codex can inspect the files, but the automatic Stop hook is designed for Claude Code.

Developer Details

Author

affaan-m

License

MIT

Author version

v1.0

Skillstore revision

Version notice

The author-declared version is not valid SemVer.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/cc-skill-continuous-learning

Ref

6425ec35f4ac137735cff58cd7877843bba23e3b

Maintenance freshness

7/18/2026

Usage

6 downloads · 162 views

File structure

📄 config.json

📄 evaluate-session.sh

📄 SKILL.md