The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/verify_selftest.py uses the subprocess.run function to execute the local Python utility scripts/verify_course.py. This is part of a benign regression test suite that operates on temporary directories and does not use a shell (shell=False is implied by the argument array), presenting no risk of command injection from untrusted input.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript and document data provided by the user, representing an indirect prompt injection surface.
Ingestion points: Raw text files are ingested from the local file system by scripts/index_sources.py during the indexing phase.
Boundary markers: The workflow uses a deterministic manifest system (course-manifest.json) and specific Markdown headers to isolate content, although it lacks explicit 'ignore embedded instructions' delimiters for the ingested text itself.
Capability inventory: The skill has the capability to read/write local files and execute local scripts within its package. It does not have network access or administrative privileges.
Sanitization: The skill applies regex-based cleanup to remove speaker tags and timestamps, but does not sanitize content for adversarial LLM instructions. However, the use of a deterministic verification tool (scripts/verify.sh) that checks content fidelity against the original source index significantly mitigates the risk of an agent obeying injected commands.

course-generator