teach
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The SKILL.md file instructs the agent to 'open the lesson file for the user by running a CLI command,' which facilitates interaction with the system shell and could be exploited to run unintended commands.
- [DYNAMIC_EXECUTION]: The agent is tasked with creating interactive lessons and reusable components in the ./lessons/ and ./assets/ directories. This involves generating and later executing code (HTML and Javascript), representing a dynamic code generation surface.
- [INDIRECT_PROMPT_INJECTION]: The agent's logic relies on reading data from several local files (e.g., MISSION.md, learning-records) that store user-provided context. This creates a surface where malicious instructions could be embedded in the tracked data and influence the agent's behavior.
- Ingestion points: The skill reads from MISSION.md, RESOURCES.md, NOTES.md, and files within the learning-records/ and reference/ directories.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the guidelines.
- Capability inventory: The agent has file system access (read/write) and is encouraged to execute CLI commands to open files.
- Sanitization: There are no instructions for sanitizing or validating the content read from these files before it is used to generate new lessons or insights.
Audit Metadata