The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is instructed to browse external websites to gather knowledge for lessons.
Ingestion points: External resources and websites are accessed via the WebFetch and WebSearch tools to populate RESOURCES.md and generate content for lessons in ./lessons/ and assets in ./assets/.
Boundary markers: The instructions do not define clear boundaries or provide warnings to the agent to ignore potentially malicious instructions embedded in the retrieved web content.
Capability inventory: The agent has broad capabilities including shell command execution (Bash), file creation (Write), and file modification (Edit).
Sanitization: There is no explicit requirement for the agent to sanitize or validate external content before using it to generate executable lesson components (like quiz widgets or simulators) or before opening files via the command line.
[COMMAND_EXECUTION]: The skill uses the Bash tool to interact with the local workspace, specifically to open generated lesson files for the user. While intended for convenience, this tool combined with external data ingestion increases the overall attack surface.

teach