teach
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands to open generated lesson files for the user when possible.
- Evidence: In SKILL.md, the instruction states: "条件允许时，用命令行替用户打开课程文件" (When conditions allow, use the command line to open the course file for the user).
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple files within the learning workspace, creating a surface for indirect prompt injection.
- Ingestion points: The agent reads and processes content from
MISSION.md,RESOURCES.md,GLOSSARY.md,learning-records/*.md, andNOTES.md(all defined in SKILL.md). - Boundary markers: Absent; there are no instructions to use delimiters or ignore potentially malicious instructions embedded in the processed files.
- Capability inventory: The agent has the capability to write various markdown and HTML files to the local directory and execute shell commands to open files.
- Sanitization: Absent; the skill does not specify any validation, filtering, or escaping for the content ingested from the workspace files.
Audit Metadata