The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external sources (defined in RESOURCES.md) and user-provided goals (MISSION.md) to generate educational content. This creates a vulnerability surface where adversarial instructions embedded in a cited resource could influence the agent's behavior or the content of the generated lessons.
Ingestion points: RESOURCES.md, MISSION.md, and files within the ./learning-records/ directory.
Boundary markers: None identified; instructions do not explicitly require the agent to wrap external content in delimiters or ignore embedded instructions.
Capability inventory: The skill performs file writes to ./lessons/, ./reference/, and ./assets/, and uses shell commands to open files.
Sanitization: No explicit sanitization or validation of external resource content is defined.
[DYNAMIC_EXECUTION]: The instructions direct the agent to generate HTML files that include shared components from the ./assets/ directory, such as "quiz widgets" and "simulators." These components may contain JavaScript. Since the content of these lessons is derived from external inputs, there is a risk of generating or including malicious scripts if the inputs are compromised.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to "open the lesson file for the user by running a CLI command." While intended for convenience (e.g., using open or start), this pattern involves the automated execution of generated files, which could be exploited to launch malicious payloads if the generated content is successfully poisoned.

teach