The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (Sources) to generate course content, creating an attack surface for indirect prompt injection.
Ingestion points: The agent fetches external URLs to identify and read "Sources" as described in SKILL.md.
Boundary markers: The skill provides clear instructions to the agent to treat fetched pages as data, not instructions, and to ignore pages that attempt to override its task or include commands.
Capability inventory: The skill can write files to the system temp and a user-specified project directory, execute bundled scripts via Node.js, and perform network requests to fetch sources.
Sanitization: The build-course.mjs script includes an html template function that escapes character literals (&, <, >, ", ') to prevent XSS in the generated output.
[DATA_EXPOSURE]: The skill includes a limited capability to read and copy local HTML files into a user-accessible directory.
Evidence: In scripts/build-course.mjs, the video field in the course data is used as a file path for readFileSync(). If the agent is directed to an existing local HTML file, the script will read and copy its content into the output project folder. Additionally, isDocumentUrl in the same script explicitly allows the file: protocol for source URLs.
[COMMAND_EXECUTION]: The skill executes bundled scripts and a CLI tool using Node.js subprocesses.
Evidence: SKILL.md and scripts/am.mjs facilitate the execution of the am CLI and the build-course.mjs script. While the commands are largely controlled, they represent an execution capability that depends on the integrity of the agent-generated data file.

open-course