The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill accesses a remote API at grcengclub.github.io/scf-api to retrieve framework crosswalk data when local plugin documentation is unavailable. This is a vendor-owned resource used for the skill's primary educational purpose.- [INDIRECT_PROMPT_INJECTION]: The skill presents a potential surface for indirect prompt injection as it ingests and processes data from external sources.
Ingestion points: The agent reads markdown files from local plugin directories (plugins/frameworks/) and JSON/text data from the grcengclub.github.io API.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat this external content as untrusted data or to ignore embedded instructions.
Capability inventory: The skill has access to the Read, Glob, Grep, and Bash tools, which could be leveraged if malicious instructions were successfully injected through the ingested data.
Sanitization: There is no specified mechanism for sanitizing or validating the content retrieved from external files or the API before it is incorporated into the tutoring responses.

framework-tutor