teach-me
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill maintains context by reading user-controlled files within the workspace, which represents a potential attack surface for indirect prompt injection.\n
- Ingestion points: Reads
MISSION.md,RESOURCES.md,learning-records/*.md, andNOTES.md(as described in SKILL.md) to ground its teaching behavior.\n - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within these user-supplied files.\n
- Capability inventory: The skill is capable of writing files to the local directory (lessons, assets, glossary) and performing network operations via the
vg deploycommand.\n - Sanitization: There is no evidence of sanitization or filtering of the content read from these markdown files before they are processed by the agent.\n- [EXTERNAL_DOWNLOADS]: The skill references and integrates with external game development tools and libraries.\n
- The instructions reference standard engines such as Phaser and Three.js for game logic.\n
- It acknowledges adaptation from the
mattpocock/skillsGitHub repository.\n- [COMMAND_EXECUTION]: The skill utilizes specific CLI tools for project workflow.\n - Mentions the use of
vg generatefor asset creation andvg deployfor project deployment to thevibedgamesplatform. These are external command-line operations integral to the skill's primary teaching purpose.
Audit Metadata