The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, such as pull request diffs, repository code, and documentation (SKILL.md, Step 1). This data is passed to parallel 'Explore' and 'Review' agents to generate and validate course content. This creates a surface where malicious instructions embedded in source materials could influence the agent's behavior or output.
Ingestion points: SKILL.md Step 1 (Intake) retrieves source material (repo path, PR number, diff, docs).
Boundary markers: The instructions do not define explicit delimiters or 'ignore embedded instructions' warnings for the sub-agents processing the source data.
Capability inventory: The skill performs file system writes (build.py, fix_entries.py), executes Python scripts via the CLI, and publishes artifacts using the artifact-design skill (SKILL.md, Step 7).
Sanitization: Content is processed by LLM agents without explicit sanitization or filtering beyond standard agent guardrails; build.py uses json.dumps for final JS interpolation.
[DYNAMIC_EXECUTION]: The build process involves dynamic loading and execution of Python code. The build.py script uses importlib.util to load and execute lessons.py (build.py, lines 27-31). Since lessons.py is a file populated by the agent based on analysis of untrusted source material, this represents a dynamic execution path for generated content.
[COMMAND_EXECUTION]: The skill instructions mandate the execution of several Python scripts (audit.py, build.py) via the command line to validate and build the course artifact (SKILL.md, Step 5).
[EXTERNAL_DOWNLOADS]: The skill's HTML templates (course.html and course-base.html) include references to Google Fonts (fonts.googleapis.com and fonts.gstatic.com). These are well-known services and are considered safe.

explainer-course