The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/create_learning_project.py) to initialize the project directory structure. This script takes arguments, such as the project path and topic, which are derived from user input. While the script itself uses standard libraries and includes checks to avoid overwriting unrelated directories, the pattern of executing scripts with user-controlled parameters is a known capability surface.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of user answers to assessment questions. These answers are recorded in persistent files (e.g., 04-assessments/module-XX-attempt-YY.md) and are used by the agent to generate remediation content and determine progress. This creates a surface where malicious instructions embedded in a user's 'answer' could potentially influence the agent's future logic during the remediation or evaluation phases.
Ingestion points: User answers to Feynman detection questions are read into the context and stored in the project directory (SKILL.md, references/session-template.md).
Boundary markers: The skill uses structured templates for sessions and assessments but lacks explicit instructions to the LLM to ignore potentially adversarial content within user answers.
Capability inventory: The skill has the capability to read/write files and execute a specific local Python script (SKILL.md, scripts/create_learning_project.py).
Sanitization: There is no explicit sanitization or filtering mentioned for the content provided by users in their assessment responses.
[DATA_EXPOSURE]: The skill requires access to a local directory to maintain the learning project. While the instructions emphasize obtaining explicit user consent for the directory path and include logic to avoid unrelated directories, the ability to read and write to the file system inherently carries risks if the path provided by a user is not properly validated or scoped by the execution environment.

feynman-learning