The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly instructs the agent to use shell commands to facilitate user interaction with generated files.
Evidence: In SKILL.md, the instructions state: "If possible, open the lesson file for the user by running a CLI command."
[INDIRECT_PROMPT_INJECTION]: The skill's core functionality relies on reading and processing various local files (MISSION.md, RESOURCES.md, learning-records/*.md) that are populated with data from user input and summarized external research. This creates an attack surface where malicious instructions embedded in external resources could influence the agent's future behavior.
Ingestion points: SKILL.md identifies MISSION.md, RESOURCES.md, NOTES.md, and the learning-records/ directory as sources of state and guidance for the agent.
Boundary markers: Absent. There are no instructions to use specific delimiters or to ignore embedded instructions when reading these files.
Capability inventory: The agent has the capability to write files, generate HTML/JavaScript content (quizzes and simulators), and execute CLI commands.
Sanitization: Absent. The skill does not provide guidelines for sanitizing or escaping content retrieved from external sources before saving it to the workspace files.
[EXTERNAL_DOWNLOADS]: The skill encourages the agent to bypass its internal knowledge and fetch information from the internet, which may lead to the retrieval of untrusted content.
Evidence: SKILL.md states "Never trust your parametric knowledge" and directs the agent to "find high-quality resources" and "high-reputation communities" (e.g., subreddits) to populate RESOURCES.md.

teach