teach-unit
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The skill is designed to generate interactive educational content, including local JavaScript (unit.js) and HTML. The instructions proactively define security constraints, explicitly prohibiting network operations and persistence within these generated scripts to ensure they remain safe for the user. These scripts are intended solely for manipulating subject matter behavior.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from learner submissions in the work/ directory. While this provides a surface for indirect prompt injection, the agent is instructed to use this data solely for providing instructional feedback rather than as a source of executable commands. The attack surface is limited to the reflection of learner content in feedback artifacts.
- Ingestion points: Scans the work/ directory for learner submissions to trigger the homework-feedback workflow (SKILL.md).
- Boundary markers: Implements a 'zero-stakes firewall' to separate learner evidence from evaluative measures (RECALL-PAGE.md), though it lacks explicit sanitization instructions for the content of submissions.
- Capability inventory: Possesses the ability to write and update markdown files (.tickets, .records, learner.md), HTML pages, and local JavaScript assets within the unit's directory structure.
- Sanitization: The documentation does not specify protocols for escaping or filtering learner-provided text before its inclusion in feedback or unit records.
Audit Metadata