The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Documentation in scripts/check-course-depth.py contains instructions to download and execute a script from https://astral.sh/uv/install.sh by piping it directly to the shell (sh). This method of execution from an unverified external source bypasses security controls and allows for arbitrary code execution.
[COMMAND_EXECUTION]: The server logic in viewer/handler.py and viewer/course_state.py utilizes the subprocess.run function to execute Python scripts stored within the skill directory. While these scripts are part of the project, the programmatic execution of shell-level commands significantly increases the system's attack surface.
[DATA_EXFILTRATION]: The diagram rendering module in viewer/diagrams.py sends diagram source code to an external third-party endpoint (https://kroki.io). Since diagram source may contain sensitive information or user-provided data, this represents an unauthorized data exposure risk to a non-whitelisted domain.
[PROMPT_INJECTION]: The generation instructions in references/phase-2-generation.md include directives to conceal the agent's internal thought processes, environment constraints, and verification caveats from the final output files. This concealment pattern is considered a security risk as it can be used to hide malicious intent or operational anomalies from the user.
[PROMPT_INJECTION]: The skill's research workflow creates an attack surface for indirect prompt injection by ingesting and processing content from external, untrusted websites (references/phase-1-research.md).
Ingestion points: Data is ingested from the web during the Phase 1 research stage.
Boundary markers: The instructions lack specific delimiters or negative constraints to prevent the agent from obeying instructions embedded in the researched content.
Capability inventory: The agent possesses the capability to execute commands via subprocesses and perform persistent file system writes.
Sanitization: No sanitization or validation of the ingested research text was identified before its use in course generation.

study