teach
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection by ingesting data from external resources to generate lesson content.\n
- Ingestion points: External links curated in the
RESOURCES.mdfile and user-provided learning topics.\n - Boundary markers: The instructions lack explicit boundary markers or delimiters to isolate untrusted external content from the agent's internal instructions.\n
- Capability inventory: The skill has the capability to write persistent files to the local workspace (HTML, markdown) and is instructed to execute shell commands to open them.\n
- Sanitization: While the skill guidelines suggest a manual policy of using 'High-trust' primary sources, there are no instructions for automated technical sanitization of the retrieved content.\n- [COMMAND_EXECUTION]: The skill instructions explicitly direct the agent to 'open the lesson file for the user by running a CLI command,' which involves the invocation of shell tools to interact with the host environment.
Audit Metadata