The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest content from external sources identified by the agent (stored in RESOURCES.md) and use this data to generate lessons and reference materials. This creates a surface for malicious instructions embedded in external resources to influence the agent's behavior.
Ingestion points: External URLs and content descriptions in RESOURCES.md, as well as user-defined goals in MISSION.md.
Boundary markers: The skill does not provide instructions to treat external data as untrusted or use delimiters to prevent instruction leakage from fetched content.
Capability inventory: The agent writes to the local file system (.html and .md files) and is instructed to execute CLI commands to open these files.
Sanitization: There are no requirements for sanitizing or validating external content before it is incorporated into the teaching workspace.
[COMMAND_EXECUTION]: The SKILL.md file encourages the agent to "open the lesson file for the user by running a CLI command." While the intended use is benign (e.g., using open or xdg-open on an HTML file), this provides a mechanism for the agent to interact with the host system's shell, which could be misused if the generated filename or the command itself is influenced by untrusted external data.

teach