The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied learning materials from a corpus/ directory to ground the tutor's responses. This creates a surface for indirect prompt injection, where malicious instructions embedded in a textbook or lecture note could attempt to influence the agent's behavior.
Ingestion points: The agent is instructed to read content from the corpus/ directory (e.g., corpus/accounting-notes.txt) which is populated with user-uploaded documents.
Boundary markers: Absent. The instructions do not provide explicit delimiters or warnings to the agent to ignore potentially malicious directives embedded within the ingested study materials.
Capability inventory: The agent has the ability to execute the grep command and run a local Node.js script (scripts/docx-to-text.js). This script can perform subprocess calls to the unzip utility and perform file operations.
Sanitization: Absent. The conversion script decodes HTML entities but does not sanitize the resulting text for malicious prompt injection patterns.
[COMMAND_EXECUTION]: The skill includes a Node.js utility script (scripts/docx-to-text.js) that uses the system's unzip command to convert .docx files to plain text. While the script uses execFileSync (a secure method that avoids shell interpretation), it grants the agent the capability to execute a subprocess and interact with the local filesystem to process files.

cpa-tutor