The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute shell commands (such as mkdir, python, and cp) where arguments like student names and search keywords are derived directly from user input. This pattern is vulnerable to command injection if a user provides input containing shell metacharacters like semicolons or pipes.
[PROMPT_INJECTION]: User input (the student name) is used to construct file paths for reading student profiles (students/profiles/<姓名>.md) and writing output files. This creates a path traversal risk where a malicious user could attempt to access or overwrite files outside the intended directories.
[COMMAND_EXECUTION]: The skill executes a local Python script extract_questions.py, which in turn uses subprocess.run to invoke an external script extract_docx.py from a different skill directory. This execution chain introduces additional complexity and potential risk if the relative paths are not strictly validated.
[PROMPT_INJECTION]: The skill ingests data from external student profiles and physics exam papers which act as untrusted input sources for indirect prompt injection.
Ingestion points: students/profiles/<姓名>.md and .docx files in gaokao_physics_past_exams/.
Boundary markers: None; the skill does not use delimiters or instructions to ignore embedded commands in the source data.
Capability inventory: The agent has access to Write, Edit, and Bash tools during the generation process.
Sanitization: No evidence of sanitization or filtering of the content extracted from the documents before it is processed by the agent.

gen-exercise