ai-engineering-curriculum
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes an installation command
npx skills add rohitg00/ai-engineering-from-scratchwhich retrieves code from an external GitHub repository not associated with the author context.\n - Evidence: Located in the 'Overview' section of SKILL.md.\n- [COMMAND_EXECUTION]: The skill suggests the use of the
npx skills addcommand, which downloads and executes logic that modifies the agent's operational environment.\n- [PROMPT_INJECTION]: The skill processes user requests and quiz responses to guide curriculum navigation, representing an indirect prompt injection surface.\n - Ingestion points: User queries about starting points and specific AI topics (e.g., 'Where should I start learning AI?').\n
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the documentation.\n
- Capability inventory: Recommending curriculum modules and conducting knowledge quizzes (non-privileged information processing).\n
- Sanitization: There is no evidence of input validation or content filtering for user-provided data.
Audit Metadata