The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection due to its core workflow of reading and processing external, user-provided files.
Ingestion points: Phase 0 involves reading source materials such as lecture files (.tex, .qmd), research papers, and dataset headers to define learning objectives and notation.
Boundary markers: The instructions do not define boundary markers or provide explicit guidelines for the agent to ignore instructions embedded within these source files.
Capability inventory: The skill is granted Read, Grep, Glob, Write, and Bash permissions, allowing it to interact with the file system and execute shell commands.
Sanitization: There is no evidence of sanitization or filtering of the external content before it is used to influence the generation of problems and solutions.
[DYNAMIC_EXECUTION]: Phase 2 of the workflow requires the agent to execute AI-generated code snippets to verify their correctness.
Evidence: The skill explicitly instructs: "Coding solutions must actually run; if Bash + R/Stata are available, execute the snippet and paste real output." This involves running dynamically generated code in a shell environment.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute statistical software commands (R or Stata). While intended for verification of exercises, this provides a mechanism for arbitrary command execution if the agent is manipulated by malicious input from the ingested source materials.

scaffold-exercises