The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to automatically ingest and process content from various local files and external code repositories to personalize the learning experience. This creates a surface for indirect prompt injection if those files contain malicious instructions.\n
Ingestion points: SKILL.md (under 'Silent Prep') explicitly directs the agent to read AGENTS.md, MISSION.md, PROGRESS.md, LEARNER-BACKGROUND.md, sources/ contents, and project source code.\n
Trigger mechanism: The agents/openai.yaml configuration sets allow_implicit_invocation: true, allowing the agent to activate and process workspace files automatically, which increases the potential for silent exploitation via injected instructions.\n
Boundary markers: The instructions lack specific delimiters or directives to ignore embedded commands within the ingested data.\n
Capability inventory: The skill utilizes file writing (workspace management), network access (GitHub search), and command execution (running/debugging code).\n
Sanitization: There are no procedures defined to sanitize or filter the content of ingested files before processing them.\n- [COMMAND_EXECUTION]: The skill instructions frequently mention running code, setting breakpoints, and debugging as primary teaching methods ('Run and Debug are the classroom'). This encourages the agent to execute code within the user's local environment, which could be risky if the project code being studied contains malicious components.\n- [EXTERNAL_DOWNLOADS]: The agent is instructed to search for, evaluate, and suggest cloning external repositories from platforms like GitHub when the user does not have a project of their own. While GitHub is a well-known service, executing code from these third-party sources carries inherent risks.

learning-coach