The Agent Skills Directory

[DATA_EXFILTRATION]: The skill implements a 'Vault Sync' feature (Phase 7) described in references/memory-and-settings.md. It prompts the user to synchronize module information—including sensitive metadata such as the 'Folder Path'—to an external database identified by placeholders like YOUR-MODULES-STUDENT-DATABASE-ID-HERE. While this action requires user consent, it establishes a pattern for exfiltrating local environment data to unspecified external sinks.
[COMMAND_EXECUTION]: In Phase 6, the skill creates a .claude/settings.local.json file that modifies the agent's execution environment. This file explicitly grants permissions for the agent to use powerful shell tools such as npm, node, and latexmk. By programmatically suggesting these permissions, the skill expands the attack surface of the project directory without requiring the user to manually configure these high-risk tools.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant surface for indirect prompt injection. During Phase 1 (Scan), it uses ls, tree, find, and Read to inventory the entire directory. The 'Workshop Naming' logic in references/organise-templates.md specifically instructs the agent to read the contents of PDFs or Word documents to infer topics. A malicious file encountered during this automated scan could contain instructions aimed at subverting the agent's behavior during the organization or sync phases.
[PROMPT_INJECTION]: The instructions in Phase 2 ('Interview') direct the agent to use a 'structured-question mechanism' and 'Always interview — even if scan is comprehensive.' While primarily instructional, this emphasizes overriding the agent's autonomous judgment (inferring from the scan) in favor of a mandatory interaction loop, which is a mild form of behavioral constraint overriding.

init-project-course