The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local workspace which could be used to influence agent behavior.
Ingestion points: At the start of every session, the skill reads MISSION.md, NOTES.md, GLOSSARY.md, and the contents of the learning-records/ directory.
Boundary markers: The instructions do not specify any delimiters or safety warnings for the agent when processing these files.
Capability inventory: The skill has the capability to execute CLI commands and perform network operations to search for resources.
Sanitization: There is no mention of sanitizing or validating the content of the workspace files before they are read into the agent's context.
[COMMAND_EXECUTION]: The skill is explicitly instructed to use system commands to enhance the user experience.
Evidence: The instructions state "Open the file for the user with a CLI command when you can" in reference to the HTML files generated in the lessons/ folder. While intended for benign use (e.g., using open or xdg-open), this represents a command execution surface that relies on the agent safely handling file paths.

teach