The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core logic relies on reading several user-modifiable files within the workspace to determine teaching goals and history. Malicious instructions placed in these files could influence the agent's behavior during lesson generation or resource selection.
Ingestion points: The agent is instructed to read MISSION.md, RESOURCES.md, NOTES.md, and files within the ./learning-records/ directory.
Boundary markers: No specific boundary markers or instructions to treat workspace data as untrusted are present in the skill definition.
Capability inventory: The agent has the capability to write files (HTML, CSS, JS) and is encouraged to execute CLI commands to open these files for the user.
Sanitization: There are no instructions for sanitizing or escaping data retrieved from the workspace before it is interpolated into new lessons or prompts.
[DYNAMIC_EXECUTION]: The skill involves the generation of executable web content, including JavaScript-based "simulators" and "quiz widgets" stored in the ./assets/ and ./lessons/ directories.
Evidence: SKILL.md explicitly directs the agent to author reusable components like simulators and diagram helpers, which are then integrated into HTML lessons. If the agent incorporates untrusted data from the mission or resources into these scripts, it could lead to script injection.
[COMMAND_EXECUTION]: The skill encourages the agent to use the host's command-line interface to facilitate the user's learning experience.
Evidence: SKILL.md contains the instruction: "If possible, open the lesson file for the user by running a CLI command." This involves invoking shell commands (e.g., open, xdg-open) based on filenames generated by the agent.

teach