The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions advise the agent to open generated lesson files using a CLI command. This introduces a potential execution vector where a maliciously named file or a crafted input could lead to command injection if the agent does not properly sanitize the filename or the resulting shell command.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data stored in various workspace files, creating a significant attack surface for indirect prompt injection if a user opens a workspace containing untrusted or malicious files.
Ingestion points: The agent is instructed to read content from MISSION.md, RESOURCES.md, ./learning-records/*.md, ./reference/*.html, and NOTES.md to inform its teaching strategy.
Boundary markers: The instructions lack any requirement for delimiters or specific warnings to ignore instructions embedded within the processed data files.
Capability inventory: The skill has the capability to read and write files across several directories and execute CLI commands to open these files for the user.
Sanitization: There are no instructions provided to sanitize, validate, or escape the content read from the workspace before it is incorporated into the agent's context or rendered into HTML lessons.

teach