The Agent Skills Directory

[SAFE]: The skill is entirely composed of Markdown instructions and YAML metadata. It contains no scripts, binaries, or executable code, posing no risk of unauthorized command execution or system persistence.
[SAFE]: No network operations, external URLs, or remote dependency downloads are present in the skill files.
[SAFE]: The skill does not request access to sensitive file paths, environment variables, or credentials.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection as it ingests untrusted data for analysis.
Ingestion points: External data is interpolated into the system prompt via the {{student_work_sample}} and {{student_profiles}} variables in SKILL.md.
Boundary markers: The prompt utilizes bold Markdown labels (e.g., **Student work:**) to provide some structural separation, though it lacks explicit defensive instructions to ignore embedded commands within these fields.
Capability inventory: The skill has no access to dangerous tools or capabilities; it cannot perform network requests, file system writes, or subprocess execution.
Sanitization: There is no evidence of input sanitization or filtering for the data provided by the teacher or context engine.
Conclusion: The risk is negligible as any successful injection would be confined to the generated text response without impacting the underlying system or user environment.

error-analysis-protocol