academy-guide
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches an educational resource catalog from the official Claude Academy domain (academy.claude.com).
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process an external JSON catalog, creating a potential surface for indirect injection. However, it includes mandatory safety instructions to mitigate this:
- Ingestion points: The agent fetches
catalog.jsonfrom academy.claude.com (SKILL.md). - Boundary markers: The instructions explicitly state that the file is data, not instructions.
- Capability inventory: The skill uses a fetch tool to retrieve the external JSON.
- Sanitization: The agent is instructed to take nothing from the file except specific item entries and ignore anything else it may contain.
Audit Metadata