The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to fetch and prioritize external information from URLs provided in RESOURCES.md over its own internal knowledge. This creates a vulnerability to indirect prompt injection where an attacker could provide a malicious resource that influences the agent's teaching logic or lesson content.
Ingestion points: The agent reads from RESOURCES.md, MISSION.md, and local learning records (./learning-records/*.md).
Boundary markers: None present in the provided instructions or templates to distinguish between instructions and potentially malicious external data.
Capability inventory: The agent has the capability to write HTML and asset files (scripts) to the local filesystem and is encouraged to execute shell commands to open these files. This creates a chain where external data influences code generation and subsequent file operations.
Sanitization: No sanitization or validation of the external content is prescribed before it is processed or incorporated into lessons.
[COMMAND_EXECUTION]: The skill prompt includes an instruction to "open the lesson file for the user by running a CLI command." While intended for user convenience, this establishes a pattern of using shell execution to interact with files generated based on potentially untrusted external inputs.
[DYNAMIC_EXECUTION]: The skill facilitates the creation of interactive learning components such as "quiz widgets, simulators, and diagram helpers" as HTML/JavaScript assets. This dynamic generation of executable client-side code based on external research constitutes a script generation surface.

teach