The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality relies on the ingestion and processing of external, untrusted codebase content which may contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Instructions in SKILL.md (Session start, steps 2 and 3) and references/learning-report-template.md direct the agent to read live source code, manifests, and documentation from external volumes or mirrors.
Boundary markers: The instructions do not define technical delimiters or specific prompt-level directives to ignore or escape natural language instructions that might be embedded in code comments, README files, or other repository metadata.
Capability inventory: The skill instructs the agent to read arbitrary files within the repository and write output (reports and a risk ledger) to the filesystem (e.g., docs/learning/).
Sanitization: While the skill includes a safety policy (Core Rule 12) prohibiting the exposure of secrets and PII, it lacks technical controls to sanitize or validate that the interpreted codebase content does not contain prompt injection attacks.
[NO_CODE]: The skill package does not contain executable scripts or binary files; it is composed of markdown-based instructions and YAML configuration files, reducing the risk of direct malicious code execution from the skill itself.

codebase-teacher