The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches curriculum data, meeting summaries, and recommended agent definitions from agency-lab.glebkalinin.com. This domain is owned by the skill's author (glebis) and the operations are central to the skill's stated purpose of providing educational content.
[DATA_EXFILTRATION]: Reads sensitive local files such as goals.md, projects.md, and profile.md to personalize the generated homework tasks. The analysis confirmed that this data is used only as context for the local generation of markdown files and is not transmitted back to the external API.
[COMMAND_EXECUTION]: The curriculum schema includes an optional toolkit field with installation commands (e.g., npx skills add). However, this skill's workflow only involves writing markdown files to the .claude/agents/ directory after explicit user confirmation, and does not execute the manifest's installation commands directly.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external content (summary_md and agent instructions) from the curriculum API. This represents a potential attack surface where compromised remote content could influence agent behavior. However, the risk is mitigated by the fact that the source is a vendor-controlled domain and the skill requires user confirmation before persistent changes (like agent installation) are made.

lab-homework