The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md suggest that the agent should 'open the lesson file for the user by running a CLI command'. While intended for user convenience (e.g., using open or xdg-open), this grants the agent the capability to execute shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external, untrusted sources (articles, books, and web resources) to create lessons. There is a risk that malicious instructions embedded in these external resources could influence the agent's behavior.
Ingestion points: External articles and web pages referenced in RESOURCES.md and processed via the agent's search/retrieval tools.
Boundary markers: None identified; the skill does not instruct the agent to use specific delimiters or ignore instructions within the fetched content.
Capability inventory: Writing markdown and HTML files to the local workspace (./lessons/, ./learning-records/, etc.) and executing CLI commands to open files.
Sanitization: There are no instructions provided for sanitizing or escaping content fetched from external resources before including it in generated HTML files, posing a potential XSS risk if the user opens these files in a browser.

teach