The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses git clone to download external code from user-provided GitHub repositories. It also fetches font assets from well-known Google Fonts domains (fonts.googleapis.com and fonts.gstatic.com).
[COMMAND_EXECUTION]: The skill executes a local shell command bash build.sh to assemble the course components into a single HTML file. The script itself is static and performs simple file concatenation.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill's primary function is to analyze an entire, untrusted codebase provided by the user, reading README files, entry points, UI code, and other source files as defined in Phase 1 of the skill process.
Boundary markers: No explicit delimiters or instructions are provided to the agent to differentiate between its own instructions and content found within the analyzed files, which increases the risk of the agent following instructions embedded in the codebase.
Capability inventory: The skill possesses the ability to clone repositories, read and write files, and execute shell commands. An attacker could place malicious instructions in a repository's metadata or source code to manipulate the agent's behavior during the analysis or construction phase.
Sanitization: The skill does not perform sanitization or escaping on the data extracted from the codebase before it is used to generate the final interactive course content, which could allow for script injection in the generated output.

codebase-to-course