teach
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to 'open the lesson file for the user by running a CLI command.' This provides a mechanism for local command execution. While intended for viewing HTML files, it could be exploited if the agent is persuaded to execute commands on malicious or unexpected file paths.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its stateful workspace.
- Ingestion points: The agent reads MISSION.md, RESOURCES.md, and learning records from ./learning-records/*.md to determine teaching strategy.
- Boundary markers: The workspace file formats do not specify the use of delimiters or instructions to ignore embedded commands within the data.
- Capability inventory: The agent has the ability to write files to the local system and execute CLI commands.
- Sanitization: The instructions do not include steps to sanitize or validate the content of workspace files before the agent processes them.
- [EXTERNAL_DOWNLOADS]: The agent is encouraged to fetch knowledge from external sources defined in RESOURCES.md. If the agent fetches data from untrusted URLs to generate executable components like 'simulators' or 'widgets' in the assets folder, it creates a risk of remote content influencing local file generation.
Audit Metadata