The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is authorized to read a wide range of project files including session records (.records/), lessons, and learner work submissions to perform its auditing function. It demonstrates security awareness by explicitly defining 'forbidden reads' to prevent access to sensitive files like recall.html and office-hours.md. No unauthorized exfiltration to external domains was detected.
[PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests and processes untrusted data from learner-authored submissions and teacher-authored lessons.
Ingestion points: Files in unit.md, lessons/ (excluding recall.html), work/ (submissions and feedback), and .records/ directories.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when reading these files.
Capability inventory: The skill has the capability to append 'attainment lines' to transcript.md and write audit reports to the .audit/ directory.
Sanitization: There is no explicit logic provided for sanitizing or escaping content retrieved from untrusted files before it is processed or written back to the filesystem.
[COMMAND_EXECUTION]: The skill mentions the use of 'research subagents' to verify claims against source material. While the specific tools used by these subagents are not defined in the provided files, the skill's frontmatter includes disable-model-invocation: true, which acts as a platform-level control to restrict unauthorized tool use or command execution.

audit