teach
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from various workspace files including MISSION.md, RESOURCES.md, and learning records to ground its teaching. This creates an ingestion surface for potential indirect prompt injection if those files are populated with untrusted content, though this is a functional requirement for a stateful teaching agent.\n
- Ingestion points: MISSION.md, RESOURCES.md, ./reference/.html, and ./learning-records/.md.\n
- Boundary markers: None explicitly defined in the instructions.\n
- Capability inventory: The agent has capabilities to write files to the workspace and execute CLI commands to open generated files.\n
- Sanitization: The instruction to use a dash-cased naming convention for files (e.g., 0001-dash-case-name.html) provides a degree of protection against shell metacharacter injection when opening files via CLI.\n- [COMMAND_EXECUTION]: The skill instructs the agent to run a CLI command to open lesson files for the user. This functional behavior is used to enhance the user experience in a development or learning workspace and does not involve high-risk command patterns or privilege escalation.
Audit Metadata