The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute Node.js scripts (scripts/excalidraw-graph.mjs and scripts/worksheet.mjs) to perform specialized tasks such as parsing diagrams and generating interactive HTML worksheets.
[COMMAND_EXECUTION]: For engineering and science topics, the skill utilizes system tools and utilities (e.g., curl, docker, tcpdump, strace) to run "labs" that provide real-world feedback. These operations are governed by safety guidelines, such as running in isolated containers or requesting user confirmation before using sudo.
[INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it ingests untrusted external data from URLs (canonical sources) and learner-provided files (drawings, spreadsheets).
Ingestion points: Canonical source URLs (SKILL.md), drawing files in Excalidraw, PNG, or SVG formats, and spreadsheet exports (references/channels.md).
Boundary markers: No explicit delimiter markers are specified for source interpolation, but the agent is instructed to summarize content into "chunks" of under 200 words.
Capability inventory: Shell command execution via node and open, system diagnostics tools, file system read/write access for course state, and network access for fetching study materials.
Sanitization: The agent is explicitly cautioned to treat downloaded data as untrusted and to "read them, never execute them."
[PRIVILEGE_ESCALATION]: The skill documentation mentions the use of sudo for certain system diagnostic tools (e.g., fs_usage) but strictly requires the agent to "ask first" before attempting to run these with elevated privileges.
[PERSISTENCE]: Course state and learner data are persisted in standard local directories (XDG_DATA_HOME and XDG_CACHE_HOME). This is standard behavior for maintaining a multi-session learning experience with no evidence of malicious persistence intent.

one-oh-one